From 618152dca2a5fabcc036011c0c86b4835de86dc6 Mon Sep 17 00:00:00 2001 From: davidvader Date: Tue, 29 Oct 2024 14:42:57 -0500 Subject: [PATCH] fix: move netrc defaults into github implementation --- compiler/native/compile.go | 14 +------------- scm/github/repo.go | 19 +++++++++++++------ scm/service.go | 3 ++- 3 files changed, 16 insertions(+), 20 deletions(-) diff --git a/compiler/native/compile.go b/compiler/native/compile.go index c751d9f9b..5e0f7a857 100644 --- a/compiler/native/compile.go +++ b/compiler/native/compile.go @@ -48,20 +48,8 @@ func (c *client) Compile(ctx context.Context, v interface{}) (*pipeline.Build, * // this has to occur after Parse because the scm configurations might be set in yaml // netrc can be provided directly using WithNetrc for situations like local exec if c.netrc == nil && c.scm != nil { - // ensure restrictive defaults for the netrc for scms that support granular permissions - if p.Git.Repositories == nil { - p.Git.Repositories = []string{c.repo.GetName()} - } - - if p.Git.Permissions == nil { - p.Git.Permissions = map[string]string{ - constants.AppInstallResourceContents: constants.AppInstallPermissionRead, - constants.AppInstallResourceChecks: constants.AppInstallPermissionWrite, - } - } - // get the netrc password from the scm - netrc, err := c.scm.GetNetrcPassword(ctx, c.repo, c.user, p.Git.Repositories, p.Git.Permissions) + netrc, err := c.scm.GetNetrcPassword(ctx, c.repo, c.user, p.Git) if err != nil { return nil, nil, err } diff --git a/scm/github/repo.go b/scm/github/repo.go index f6b84f1fd..91f0c5e21 100644 --- a/scm/github/repo.go +++ b/scm/github/repo.go @@ -14,6 +14,7 @@ import ( "github.com/sirupsen/logrus" api "github.com/go-vela/server/api/types" + "github.com/go-vela/server/compiler/types/yaml" "github.com/go-vela/server/constants" ) @@ -679,7 +680,7 @@ func (c *client) GetBranch(ctx context.Context, r *api.Repo, branch string) (str // GetNetrcPassword returns a clone token using the repo's github app installation if it exists. // If not, it defaults to the user OAuth token. -func (c *client) GetNetrcPassword(ctx context.Context, r *api.Repo, u *api.User, repos []string, perms map[string]string) (string, error) { +func (c *client) GetNetrcPassword(ctx context.Context, r *api.Repo, u *api.User, g yaml.Git) (string, error) { l := c.Logger.WithFields(logrus.Fields{ "org": r.GetOrg(), "repo": r.GetName(), @@ -692,10 +693,11 @@ func (c *client) GetNetrcPassword(ctx context.Context, r *api.Repo, u *api.User, // repos that the token has access to // providing no repos, nil, or empty slice will default the token permissions to the list // of repos added to the installation - // - // the compiler will set restrictive defaults with access to the triggering repo + repos := g.Repositories + + // use triggering repo as a restrictive default if repos == nil { - repos = []string{} + repos = []string{r.GetName()} } // convert repo fullname org/name to just name for usability @@ -719,7 +721,12 @@ func (c *client) GetNetrcPassword(ctx context.Context, r *api.Repo, u *api.User, Checks: github.String(constants.AppInstallPermissionWrite), } - for resource, perm := range perms { + permissions := g.Permissions + if permissions == nil { + permissions = map[string]string{} + } + + for resource, perm := range permissions { ghPerms, err = applyGitHubInstallationPermission(ghPerms, resource, perm) if err != nil { l.Errorf("unable to create github app installation token with permission %s:%s: %v", resource, perm, err) @@ -735,7 +742,7 @@ func (c *client) GetNetrcPassword(ctx context.Context, r *api.Repo, u *api.User, // maybe take an optional list of repos and permission set that is driven by yaml t, err := c.newGithubAppInstallationRepoToken(ctx, r, repos, ghPerms) if err != nil { - l.Errorf("unable to create github app installation token for repos %v with permissions %v: %v", repos, perms, err) + l.Errorf("unable to create github app installation token for repos %v with permissions %v: %v", repos, permissions, err) // return the legacy token along with no error for backwards compatibility // todo: return an error based based on app installation requirements diff --git a/scm/service.go b/scm/service.go index 9e8ff96d9..beb5eec0b 100644 --- a/scm/service.go +++ b/scm/service.go @@ -7,6 +7,7 @@ import ( "net/http" api "github.com/go-vela/server/api/types" + "github.com/go-vela/server/compiler/types/yaml" "github.com/go-vela/server/database" "github.com/go-vela/server/internal" ) @@ -143,7 +144,7 @@ type Service interface { GetHTMLURL(context.Context, *api.User, string, string, string, string) (string, error) // GetNetrc defines a function that returns the netrc // password injected into build steps. - GetNetrcPassword(context.Context, *api.Repo, *api.User, []string, map[string]string) (string, error) + GetNetrcPassword(context.Context, *api.Repo, *api.User, yaml.Git) (string, error) // SyncRepoWithInstallation defines a function that syncs // a repo with the installation, if it exists. SyncRepoWithInstallation(context.Context, *api.Repo) (*api.Repo, error)