Prequisite: I have read: https://docs.aws.amazon.com/codebuild/latest/userguide/sample-github-pull-request.html
I also read this: https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-env-vars.html
and this: Accessing GitHub pull request details within AWS CodeBuild
We have several codebuild jobs that trigger on Github pull requests/pull request updates.
As that other question states, far I have seen $CODEBUILD_WEBHOOK_EVENT which shows something like PULL_REQUEST_UPDATED and CODEBUILD_WEBHOOK_TRIGGER which shows something like pr/123
However I am trying to get the actual payload of the webhook event - specifically the title and description of the PR. How can I obtain these?
My fear is that the answer is this information is lost, and that somehow I need to connect to the github API from within the codebuild job in a back and forth. But then they question will be how to authenticate since this is a private repo..
Not sure if you ever found an answer to this, but I ran into something similar. To get other info from GitHub, I used its API. For authentication, you can add the GitHub token as an environment variable in the buildspec file. I'd recommend storing it in Parameter Store as a secure string. Here's a working example file that retrieves the name of the first label on the PR:
version: 0.2
env:
shell: bash
parameter-store:
GITHUB_AUTH_TOKEN: GITHUB_AUTH_TOKEN
phases:
install:
runtime-versions:
nodejs: 16
build:
commands:
- |
PR_NUMBER=$(cut -d "/" -f2 <<< "$CODEBUILD_SOURCE_VERSION")
echo $PR_NUMBER;
PR_LABEL_NAME=$(curl --request GET --url "https://api.github.com/repos/<put repo name here>/pulls/$PR_NUMBER" --header "Authorization:Bearer $GITHUB_AUTH_TOKEN" | jq -r '.labels[0].name');
If the build is triggered by a PR being created or updated, the CODEBUILD_SOURCE_VERSION var will have a value of "pr/1234" where "1234" is the pull request number. I'm using cut to get the number and drop "pr/".
Related
I'm attempting to create a Terraform-integrated script that will create and configure a Google Cloud VM that will install Github Runner as self-hosted. The repository is under my workplace's 'organization' and it is closed to the public. Everything goes smoothly until I need to configure the runner. In repository instructions for creating self-hosted runner written as this:
# Create the runner and start the configuration experience
$ ./config.cmd --url https://github.com/my_work_place_organizaiton_name/repository_name --token ASZER2QS4UVEAL3YLMZ3DIMUIC
The issue is that, because it is an unattended script, it will run entirely on its own with no strings attached, and everything should be generated as automatically as possible. So I need a way to generate/retrieve this token ASZER2QS4UVEAL3YLMZ3DIMUIC automatically.
I think I found a way (correct me if I wrong) here: Create a registration token for an organization. So far so good. I managed to create a powershell script to execute all steps in new Github self-hosted runner until the step where I need to generate token. Once I run the command (even in Github CLI) I get an error back like this:
gh api --method POST -H "Accept: application/vnd.github+json" /orgs/my_work_place_organizaiton_name/actions/runners/registration-token
{
"message": "Must have admin rights to Repository.",
"documentation_url": "https://docs.github.com/rest/reference/actions#create-a-registration-token-for-an-organization"
}
gh: Must have admin rights to Repository. (HTTP 403)
gh: This API operation needs the "admin:org" scope. To request it, run: gh auth refresh -h github.com -s admin:org
I am an admin in this repository but not in the organization, and I am afraid that no one will grant me admin access to the organization, and even more, I cannot simply put admin:org credentials in some script - this is a "no go."
So, my question is, how can I fully automate the generation of this Github token (which is generated for everyone in the instructions page without any admin privileges)?
After a lot of try and catches it seems I found an answer. What is work for me is generating token for repository and not generating token for repository in organization.
According to Github documentation: Create a registration token for a repository this is a POST request you must send from Github CLI for example:
gh api \
--method POST \
-H "Accept: application/vnd.github+json" \
/repos/OWNER/REPO/actions/runners/registration-token
and according to documentation:
OWNER
string
Required
The account owner of the repository. The name is not case sensitive.
REPO
string
Required
The name of the repository. The name is not case sensitive.
So I put my organization name as an OWNER and not my username and voila ! it is worked !
so - instead sending request as:
/repos/my_user_name/REPO/actions/runners/registration-token
I send it as:
/repos/my_organization_name/REPO/actions/runners/registration-token
and immediately get a valid token back.
I am trying to add users to a private Github repo within an organisation. Starting from this post, I've simply changed the API endpoint to cope with organizations (as explained here), and I end up with the following command:
gh api orgs/MY_ORG/repos/MY_USER_NAME/MY_REPO/collaborators/COLLABORATOR_USER_NAME -f '{"permission":"maintain"}';
This command systematically returns a 404 error (note that I also get a 404 when I just try to check if a user has access to a repo, i.e. the GET version of the above command).
I also need to mention that this doesn't seem to be a trivial gh auth login issue since a command like gh repo create MY_ORG/MY_REPO works fine.
Here is also some technical details:
os: macosx 10.15.16
git: 2.24.3
gh: 1.1.0
I take the initiative to answer my own question here since after some investigations (thanks to mislav for his help) and trials and errors, I ve found the proper way to add collaborators to a GitHub repo within an organization with the CLI. I think it is worth posting it, hopefully this will help others.
Invite an outside collaborator to a repo within an organization
gh api -X PUT repos/:org/:repo/collaborators/:username -f permission=:perm
the -X PUT specifies that the request is a PUT and not a GET (default request). The repo's identifier is specified by :org/:repo (note that if the repo is not under an organization, the identifier will be :owner/:repo). The :perm argument indicates the type of access, the default value is push (see here)
So assume I want to provide admin access to jonsnow to the repo winterfell under the organization got, I will use the following command
gh api -X PUT repos/got/winterfell/collaborators/jonsnow -f permission=admin
Note that if you send an invite for the repo directly, the user will appear as an outside collaborator (not as an organization member)
Add a member to the organization and invite him to a repo
You just need to include the user as a member to the organisation beforehand with
gh api -X PUT /orgs/:org/memberships/:username -f role=:role
and then you can provide him access to a specific repo with the same command as above, i.e.
gh api -X PUT repos/:org/:repo/collaborators/:username -f permission=:perm
Note that the value for the various :role can be found here
You can set organization membership for a user
put /orgs/{org}/memberships/{username}
You can add a collaborator to a repo
put /repos/{owner}/{repo}/collaborators/{username}
But I don't think you can combine the two (add a collaborator to an org repo)
That is because that collaborator need to be a member of the organisation first (so receive and accept the invitation), before being added to a repository.
Usually one must click link "Invite teams or people" after accessing "https://github.com///settings/access" in a web browser.
But, I wish to do this through a command line interface, because I must invite
many persons. Is it possible?
You could use the GitHub API in order to add a collaborator
PUT /repos/:owner/:repo/collaborators/:username
See for instance here:
curl -H "Authorization: token YOUR_TOKEN" "https://api.github.com/repos/YOUR_USER_NAME/YOUR_REPO/collaborators/COLLABORATOR_USER_NAME" -X PUT -d '{"permission":"admin"}'
With permission level being one of:
pull - can pull, but not push to or administer this repository.
push - can pull and push, but not administer this repository.
admin - can pull, push and administer this repository.
maintain - Recommended for project managers who need to manage the repository without access to sensitive or destructive actions.
triage - Recommended for contributors who need to proactively manage issues and pull requests without write access.
(default is "push")
Update Sept. 2020, considering GitHub CLI gh is now 1.0, it could be a good feature to add (a kind of gh repo invite)
In the meantime, you can use gh pi to make a similar API call, automatically authenticated, with -f to add POST fields.
gh api repos/YOUR_USER_NAME/YOUR_REPO/collaborators/COLLABORATOR_USER_NAME" -f '{"permission":"admin"}'
An alternative using hub:
1- Check all users with permissions in your repo:
hub api --flat 'repos/YOUR_USER_OR_ORGANIZATION_NAME/YOUR_REPO/collaborators' | grep -E 'login|permissions'
2- Give permission to an user :
hub api 'repos/YOUR_USER_OR_ORGANIZATION_NAME/YOUR_REPO/collaborators/COLLABORATOR_USER_NAME' -H X:PUT -H d:'{"permission":"admin"}'
You can use the github cli or call the github api directly through curl. In this example I add a member to a company repo using the github cli:
gh api "orgs/$target_repo/teams/$team/repos/$target_repo/$repo_new_name" -X PUT -f permission=admin
Also see the docs: https://docs.github.com/en/rest/reference/teams#add-or-update-team-repository-permissions
For your situation you can use this endpoint:
https://docs.github.com/en/rest/reference/repos#add-a-repository-collaborator
I am looking for some ways to create a github issue from travis.
I am calling some scripts in travis.yaml file and I need to create a github issue when travis is executed. I came across documents on calling github APIS using curl command.
Eg: curl -u $username -i -H "Content-Type: application/json" -X POST --data '{"title":"'$title'", "body":"'$body'"}' https://api.github.com/repos/$username/$repo_name/issues
Instead of username , since the build is triggered via travis, should I use github tokens? Is there any environment variable available which represents github token.
Found the answer myself. Create a github token using the github API and add that as ENV variable to your Travis CI settings.
This token can be used to perform the curl operation in travis shell script.
Helpful link : https://blogs.infosupport.com/accessing-githubs-rest-api-with-curl/
I need to get the latest travis build status of a repo through their API. I need a behavior identical to that of build status badge i.e it shows passing when a "push" is passing, even if a newer "pull_request" is failing.
One way of achieving is to list all builds of a repo using this and then traverse in reverse direction until I find a build which is not a pull requests and then check its status.
However, there must be a short way of doing it because the same behavior is used by build status badge. Traversing the builds every time just to get the last build status seems like a pain.
What is the API endpoint use by build status batch to directly get the last "push" build status of a repo?
The easiest solution is to not use Travis API but the build status badge. The test "passing" or "failing" is embedded as text in the SVG image:
curl -s 'https://api.travis-ci.org/$USER/$REPO.svg?branch=$BRANCH' | grep pass
curl -s 'https://api.travis-ci.org/$USER/$REPO.svg?branch=$BRANCH' | grep fail
Unless you know the build.id, the best way I think is to use the API you are referring to and pass in the query parameter limit. Something like this:
repo/{repository.id}/builds/builds?limit=1
repo/{+repository.slug}/builds/builds?limit=1
Response would still be an array but index 0 will be the most recent build. limit is not documented but it is used by Travis for their pagination.
Thank you for your question, I am looking to accomplish the same objective, here are some detailed examples of how the API should work. From that I derived the following steps to get the build status of a repository default branch using Travis CI. Below are detailed instructions:
TLDR
travis status -r a-t-0/sponsor_example --com --token <your personal Travis token>
Detailed instructions
Open a terminal and login to use the Travis Api. You can do that by first getting a Travis token, by login in with git from your terminal:
travis login --com --auto
If that does not work(returning Not Found), you should add a GitHub Token manually.
Source: https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token
2.1 To get this token, first verify your github email adress if you did not yet do that.
2.2 Go to: https://github.com/settings/tokens
2.3 Add a new token and select:
2.3.1 repo control of private repositories
2.3.2 admin:org control of orgs and teams, read and write org projects
2.3.3 admin:repo_hook Full control of repository hooks
2.3.4 admin:org_hook control of organization
2.4 Write down the secret personal access token from github. It can have a form like: 1somelettersandsomenumbersordigitsandth4
2.5 Next, use this token to login to either the --pro, --com or --org account types of Travis using:
travis login --pro --github-token 1somelettersandsomenumbersordigitsandth4
travis login --com --github-token 1somelettersandsomenumbersordigitsandth4
travis login --org --github-token 1somelettersandsomenumbersordigitsandth4
That should return: Successfully logged in as <your github username>!.
2.6 Note there are three types of api call licenses: pro, com, org. This is visible in `travis status -h
2.7 To get your pro token:
travis token --pro
Your access token is <somepersonalprotoken>
2.8 To get your --org token:
travis token --org
Your access token is <somepersonalorgtoken>
2.9 To get your --com token:
travis token --com
Your access token is <somepersonalcomtoken>
Export your travis token to terminal before running the tests with:
COM_TRAVIS_TOKEN="<your secret travis pro/com token>"
Get the build status with:
travis status -r {your GitHub username}/{your repo name} --com --token $COM_TRAVIS_TOKEN
E.g.
travis status -r a-t-0/sponsor_example --com --token $COM_TRAVIS_TOKEN