GitHub Token

Previously all of the workflows used secrets.GITHUB_TOKEN. In the end the de-privileged nature of this token proved to be too much and this change migrates the workflows to use bot-specific token instead. Signed-off-by: Ben Hale <[email protected]>
paketo-buildpacks · Nov 3, 2020 · 7c57515 · 7c57515
1 parent 480d302
commit 7c57515
Show file tree

Hide file tree

Showing 15 changed files with 41 additions and 25 deletions.
diff --git a/.github/pipeline-descriptor.yml b/.github/pipeline-descriptor.yml
@@ -1,11 +1,13 @@
+github_token: ${{ secrets.JAVA_GITHUB_TOKEN }}
+
 codeowners:
 - path:  "*"
   owner: "@paketo-buildpacks/java-buildpacks"
 
 docker_credentials:
 - registry: ghcr.io
-  username: ${{ secrets.JAVA_GHCR_USERNAME }}
-  password: ${{ secrets.JAVA_GHCR_TOKEN }}
+  username: ${{ secrets.JAVA_GITHUB_USERNAME }}
+  password: ${{ secrets.JAVA_GITHUB_TOKEN }}
 
 actions:
 - source: adopt-openjdk-dependency

diff --git a/.github/workflows/update-pipeline.yml b/.github/workflows/update-pipeline.yml
@@ -9,7 +9,6 @@ jobs:
         runs-on:
             - ubuntu-latest
         steps:
-            - uses: actions/checkout@v2
             - uses: actions/setup-go@v2
               with:
                 go-version: "1.15"
@@ -20,6 +19,7 @@ jobs:
                 set -euo pipefail
 
                 GO111MODULE=on go get -u -ldflags="-s -w" github.com/paketo-buildpacks/pipeline-builder/cmd/octo
+            - uses: actions/checkout@v2
             - id: pipeline
               name: Update Pipeline
               run: |
@@ -56,7 +56,7 @@ jobs:
                 echo "::set-output name=release-notes::${RELEASE_NOTES//$'\n'/%0A}"
               env:
                 DESCRIPTOR: .github/pipeline-descriptor.yml
-                GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                GITHUB_TOKEN: ${{ secrets.JAVA_GITHUB_TOKEN }}
             - uses: peter-evans/create-pull-request@v3
               with:
                 body: |-
@@ -75,4 +75,4 @@ jobs:
                 labels: semver:patch, type:task
                 signoff: true
                 title: Bump pipeline from ${{ steps.pipeline.outputs.old-version }} to ${{ steps.pipeline.outputs.new-version }}
-                token: ${{ secrets.GITHUB_TOKEN }}
+                token: ${{ secrets.JAVA_GITHUB_TOKEN }}
diff --git a/README.md b/README.md
@@ -10,6 +10,7 @@ The Pipeline Builder is a collection of tools related to GitHub Actions and othe
       - [Pipeline Updater](#pipeline-updater)
       - [Release Drafter](#release-drafter)
     - [Descriptor](#descriptor)
+      - [`github_token` (REQUIRED)](#github_token-required)
       - [`codeowners`](#codeowners)
       - [`package`](#package)
       - [`builder`](#builder)
@@ -88,7 +89,15 @@ A pipeline-updating workflow is added to the repository to ensure that workflows
 Draft release notes are created on every commit to `main`.  These notes take into account every PR since the previous release in order to create a division of the types of changes that were made and the semver scope of the change to work out the next release number.
 
 ### Descriptor
-The descriptor is a YAML document with a number of top-level keys that correspond to new workflows, modified workflows, or artifacts.  All top-level keys are optional.
+The descriptor is a YAML document with a number of top-level keys that correspond to new workflows, modified workflows, or artifacts.  All top-level keys except `github_token` are optional.
+
+#### `github_token` (REQUIRED)
+```yaml
+github_token: ${{ secrets.JAVA_GITHUB_TOKEN }}
+```
+`github_token` represents the token to be used in the many places where the GitHub API access is required.  The token must be granted the `repo`, `write:packages`, and `workflow` scopes.
+
+![Token Scopes](token-scopes.png)
 
 #### `codeowners`
 ```yaml

diff --git a/octo/builder_dependencies.go b/octo/builder_dependencies.go
@@ -64,7 +64,7 @@ func ContributeBuilderDependencies(descriptor Descriptor) ([]Contribution, error
 		}
 	}
 
-	if c, err := contributeLifecycle(); err != nil {
+	if c, err := contributeLifecycle(descriptor); err != nil {
 		return nil, err
 	} else {
 		contributions = append(contributions, c)
@@ -118,7 +118,7 @@ func contributeBuildImage(descriptor Descriptor, image string, classifier string
 					{
 						Uses: "peter-evans/create-pull-request@v3",
 						With: map[string]interface{}{
-							"token": "${{ secrets.GITHUB_TOKEN }}",
+							"token": descriptor.GitHubToken,
 							"commit-message": fmt.Sprintf(`Bump %[1]s from ${{ steps.build-image.outputs.old-version }} to ${{ steps.build-image.outputs.new-version }}
 
 Bumps %[1]s from ${{ steps.build-image.outputs.old-version }} to ${{ steps.build-image.outputs.new-version }}.`, image),
@@ -142,7 +142,7 @@ Bumps %[1]s from ${{ steps.build-image.outputs.old-version }} to ${{ steps.build
 	return NewActionContribution(w)
 }
 
-func contributeLifecycle() (Contribution, error) {
+func contributeLifecycle(descriptor Descriptor) (Contribution, error) {
 	w := actions.Workflow{
 		Name: "Update Lifecycle",
 		On: map[event.Type]event.Event{
@@ -177,7 +177,7 @@ func contributeLifecycle() (Contribution, error) {
 							"glob":       `lifecycle-v[^+]+\+linux\.x86-64\.tgz`,
 							"owner":      "buildpacks",
 							"repository": "lifecycle",
-							"token":      "${{ secrets.GITHUB_TOKEN }}",
+							"token":      descriptor.GitHubToken,
 						},
 					},
 					{
@@ -191,7 +191,7 @@ func contributeLifecycle() (Contribution, error) {
 					{
 						Uses: "peter-evans/create-pull-request@v3",
 						With: map[string]interface{}{
-							"token": "${{ secrets.GITHUB_TOKEN }}",
+							"token": descriptor.GitHubToken,
 							"commit-message": `Bump lifecycle from ${{ steps.lifecycle.outputs.old-version }} to ${{ steps.lifecycle.outputs.new-version }}
 
 Bumps lifecycle from ${{ steps.lifecycle.outputs.old-version }} to ${{ steps.lifecycle.outputs.new-version }}.`,

diff --git a/octo/buildpack_dependencies.go b/octo/buildpack_dependencies.go
@@ -75,7 +75,7 @@ func ContributeBuildpackDependencies(descriptor Descriptor) ([]Contribution, err
 						}, {
 							Uses: "peter-evans/create-pull-request@v3",
 							With: map[string]interface{}{
-								"token": "${{ secrets.GITHUB_TOKEN }}",
+								"token": descriptor.GitHubToken,
 								"commit-message": fmt.Sprintf(`Bump %[1]s from ${{ steps.buildpack.outputs.old-version }} to ${{ steps.buildpack.outputs.new-version }}
 
 Bumps %[1]s from ${{ steps.buildpack.outputs.old-version }} to ${{ steps.buildpack.outputs.new-version }}.`, d.Name),

diff --git a/octo/create_builder.go b/octo/create_builder.go
@@ -77,7 +77,7 @@ func ContributeCreateBuilder(descriptor Descriptor) (*Contribution, error) {
 						Run:  statikString("/update-release-digest.sh"),
 						Env: map[string]string{
 							"DIGEST":       "${{ steps.builder.outputs.digest }}",
-							"GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}",
+							"GITHUB_TOKEN": descriptor.GitHubToken,
 						},
 					},
 				},

diff --git a/octo/create_package.go b/octo/create_package.go
@@ -110,7 +110,7 @@ func ContributeCreatePackage(descriptor Descriptor) (*Contribution, error) {
 						Run:  statikString("/update-release-digest.sh"),
 						Env: map[string]string{
 							"DIGEST":       "${{ steps.package.outputs.digest }}",
-							"GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}",
+							"GITHUB_TOKEN": descriptor.GitHubToken,
 						},
 					},
 				},

diff --git a/octo/descriptor.go b/octo/descriptor.go
@@ -27,6 +27,7 @@ import (
 )
 
 type Descriptor struct {
+	GitHubToken       string `yaml:"github_token"`
 	Path              string
 	CodeOwners        []CodeOwner
 	Builder           *Builder
@@ -101,6 +102,10 @@ func NewDescriptor(path string) (Descriptor, error) {
 		return Descriptor{}, fmt.Errorf("unable to decode descriptor from %s\n%w", path, err)
 	}
 
+	if d.GitHubToken == "" {
+		return Descriptor{}, fmt.Errorf("github_token is required")
+	}
+
 	if d.Path == "" {
 		d.Path = ".."
 	}

diff --git a/octo/draft_release.go b/octo/draft_release.go
@@ -88,7 +88,7 @@ func ContributeDraftRelease(descriptor Descriptor) ([]Contribution, error) {
 					{
 						Id:   "release-drafter",
 						Uses: "release-drafter/release-drafter@v5",
-						Env:  map[string]string{"GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}"},
+						Env:  map[string]string{"GITHUB_TOKEN": descriptor.GitHubToken},
 					},
 				},
 			},
@@ -141,7 +141,7 @@ func ContributeDraftRelease(descriptor Descriptor) ([]Contribution, error) {
 				Name: "Update draft release with buildpack information",
 				Run:  statikString("/update-draft-release-buildpack.sh"),
 				Env: map[string]string{
-					"GITHUB_TOKEN":     "${{ secrets.GITHUB_TOKEN }}",
+					"GITHUB_TOKEN":     descriptor.GitHubToken,
 					"RELEASE_ID":       "${{ steps.release-drafter.outputs.id }}",
 					"RELEASE_TAG_NAME": "${{ steps.release-drafter.outputs.tag_name }}",
 					"RELEASE_NAME":     "${{ steps.release-drafter.outputs.name }}",

diff --git a/octo/labels.go b/octo/labels.go
@@ -25,7 +25,7 @@ import (
 	"github.com/paketo-buildpacks/pipeline-builder/octo/labels"
 )
 
-func ContributeLabels() ([]Contribution, error) {
+func ContributeLabels(descriptor Descriptor) ([]Contribution, error) {
 	var contributions []Contribution
 
 	l := []labels.Label{
@@ -100,7 +100,7 @@ func ContributeLabels() ([]Contribution, error) {
 					},
 					{
 						Uses: "micnncim/action-label-syncer@v1",
-						Env:  map[string]string{"GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}"},
+						Env:  map[string]string{"GITHUB_TOKEN": descriptor.GitHubToken},
 					},
 				},
 			},

diff --git a/octo/octo.go b/octo/octo.go
@@ -94,7 +94,7 @@ func (o Octo) Contribute() error {
 		contributions = append(contributions, c...)
 	}
 
-	if c, err := ContributeLabels(); err != nil {
+	if c, err := ContributeLabels(descriptor); err != nil {
 		return err
 	} else {
 		contributions = append(contributions, c...)
@@ -118,7 +118,7 @@ func (o Octo) Contribute() error {
 		contributions = append(contributions, *c)
 	}
 
-	if c, err := ContributeUpdatePipeline(); err != nil {
+	if c, err := ContributeUpdatePipeline(descriptor); err != nil {
 		return err
 	} else {
 		contributions = append(contributions, c)

diff --git a/octo/package_dependencies.go b/octo/package_dependencies.go
@@ -103,7 +103,7 @@ func contributePackageDependency(descriptor Descriptor, name string) (Contributi
 					{
 						Uses: "peter-evans/create-pull-request@v3",
 						With: map[string]interface{}{
-							"token": "${{ secrets.GITHUB_TOKEN }}",
+							"token": descriptor.GitHubToken,
 							"commit-message": fmt.Sprintf(`Bump %[1]s from ${{ steps.package.outputs.old-version }} to ${{ steps.package.outputs.new-version }}
 
 Bumps %[1]s from ${{ steps.package.outputs.old-version }} to ${{ steps.package.outputs.new-version }}.`, name),

diff --git a/octo/statik/statik.go b/octo/statik/statik.go
diff --git a/octo/update_pipeline.go b/octo/update_pipeline.go
@@ -23,7 +23,7 @@ import (
 	"github.com/paketo-buildpacks/pipeline-builder/octo/actions/event"
 )
 
-func ContributeUpdatePipeline() (Contribution, error) {
+func ContributeUpdatePipeline(descriptor Descriptor) (Contribution, error) {
 	w := actions.Workflow{
 		Name: "Update Pipeline",
 		On: map[event.Type]event.Event{
@@ -51,14 +51,14 @@ func ContributeUpdatePipeline() (Contribution, error) {
 						Name: "Update Pipeline",
 						Run:  statikString("/update-pipeline.sh"),
 						Env: map[string]string{
-							"GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}",
+							"GITHUB_TOKEN": descriptor.GitHubToken,
 							"DESCRIPTOR":   filepath.Join(".github", "pipeline-descriptor.yml"),
 						},
 					},
 					{
 						Uses: "peter-evans/create-pull-request@v3",
 						With: map[string]interface{}{
-							"token": "${{ secrets.GITHUB_TOKEN }}",
+							"token": descriptor.GitHubToken,
 							"commit-message": `Bump pipeline from ${{ steps.pipeline.outputs.old-version }} to ${{ steps.pipeline.outputs.new-version }}
 
 Bumps pipeline from ${{ steps.pipeline.outputs.old-version }} to ${{ steps.pipeline.outputs.new-version }}.`,

diff --git a/token-scopes.png b/token-scopes.png