Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Move the danielridgebot workflows off secrets.DR_PAT onto the org GitHub App

Đang mở
  • Có gì không ổn?
#223 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
48/100
Loại issue
Tính năng
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
github, github-actions
Lĩnh vực
ci-cd, devops, security

Hướng nghiên cứu

Bắt đầu với check-gh-pages-version.yml, check-ruby-version.yml và test-issue-labels.yml trong hackforla/check-ghpages-versions; xem lại cách sử dụng DR_PAT hiện có và action create-github-app-token. Kiểm thử từ một branch dùng để loại bỏ với gh workflow run check-gh-pages-version.yml --ref , sau đó xác minh các label, milestone và board 73 trước khi dọn dẹp issue và card kiểm thử. Hoàn tất khi cả hai check đều hoạt động với App token và quyết định về DR_PAT đã được ghi lại.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

complexity: medium feature: security role: DevOps Engineer size: 3pt
Overview

We need the danielridgebot workflows to create issues with a token minted from the org's GitHub App instead of secrets.DR_PAT, because that PAT is a personal access token on a recurring expiry cycle with nothing warning us when it lapses. Its failure mode is silence — a missed GitHub Pages version bump rather than an alert — so we would not find out until someone noticed the bot had gone quiet.

Action Items
  • Confirm first that the HFLA_WORKFLOW_APP_* App is installed on hackforla/devops with Issues: write, and that it has organization Projects: write. The bot creates its issues on hackforla/devops and adds them to board 73, so an installation scoped only to the bot repo is not enough. If the App cannot write to projects, that is the finding — record it on this issue rather than shipping something that silently stops adding board cards.
  • In check-gh-pages-version.yml and check-ruby-version.yml, mint a token with actions/create-github-app-token from secrets.HFLA_WORKFLOW_APP_ID / secrets.HFLA_WORKFLOW_APP_PRIVATE_KEY and pass it as GH_TOKEN to the "Create issue…" step, in place of secrets.DR_PAT. Both org secrets are already readable by this repo — verified 2026-09-07.
  • Leave the git push steps alone. They commit the new version file using the checkout-persisted GITHUB_TOKEN, not DR_PAT, so they are unaffected by this change.
  • Decide what happens to test-issue-labels.yml, the third and last user of DR_PAT: switch it too, or delete it. It is workflow_dispatch-only, it opens issues on the bot repo itself, and the one it left behind — check-ghpages-versions#22, open since May 2024 — is that repo's only open issue, so nothing sweeps what it creates.
  • Test before relying on it. On a throwaway branch, set release-versions/github-pages-gem.txt to an older value and run gh workflow run check-gh-pages-version.yml --ref <branch>. The workflow commits the real version back, so the file self-restores — but it opens a real issue on hackforla/devops with a board card, so close that issue and delete its card afterwards.
  • Check the test issue carries its labels, its milestone and a card on board 73. The board card is both the most likely thing to fail and the one that fails quietly.
  • Once both check workflows are confirmed working on App tokens, delete the DR_PAT repo secret. Decide separately what happens to the danielridgebot user account itself — with the PAT retired it has no remaining job.
  • Note that the issue author changes from danielridgebot to the App's bot identity. Nothing we know of filters on the author, but the weekly label check and anyone reading the board will see a different name — confirm that is acceptable before merging rather than after.
Resources/Instructions
  • The change is a PR on hackforla/check-ghpages-versions. This issue lives on devops because that is where the bot's issues land, where it is documented, and because the bot repo is not on board 73 and has almost no label vocabulary of its own.
  • The bot's documentation: @danielridgebot-DevOps-Wiki
  • DR_PAT was last rotated 2025-10-26 and confirmed working 2026-08-24, so it is currently valid. This is not urgent — it removes a recurring liability rather than fixing an outage.
  • Org secrets already visible to the bot repo, verified 2026-09-07: HFLA_WORKFLOW_APP_ID, HFLA_WORKFLOW_APP_PRIVATE_KEY, HFLA_GRAPHQL_APP_ID, HFLA_GRAPHQL_APP_PRIVATE_KEY.
  • Do not "fix" the issue templates' frontmatter while you are in there. update-gh-pages-version.md and update-ruby-version.md carry projects: as a board title and milestones: plural. GitHub never renders these files — the bot's own parser, github-actions/utils/parse-issue-template.js, reads the frontmatter and feeds it to gh issue create --project "$PROJECTS", where a board title is exactly what is wanted. Changing them to hackforla/73 would break the bot.
  • Do not delete keepalive.yml. It looks like dead code and is load-bearing: GitHub disables scheduled workflows after 60 days with no repository commits, which is what silently killed both checks between 2026-01-07 and 2026-08-24. It is hand-rolled because the action the wiki recommends for this has been blocked by GitHub since 2025-04-21.
Ngôn ngữ chính
PowerShell
Star
8
Fork
10
Merge trung bình
8 giờ 28 phút
Pull request đã merge (30 ngày)
11

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của hackforla/devops

Tất cả issue của hackforla/devops

Issue tương tự

Thêm issue về DevOps

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.