[mentioning] Do all repositories need access to the PAT of org admin? about outside-collaborators HOT 5 CLOSED

Indeed, that would be a good approach.

I will try to get it working in our GitHub App / Lambda setup. ( https://github.com/philips-labs/terraform-aws-github-runner )
If I get it to work, I will create a similar PR here.

from outside-collaborators.

@JeroenKnoops with a second thought I could do the following: instead of propagating the information from the automated repos to the central dashboard, we can isolate the processing locally to the repositories thus without needing any PAT.

As a result, we will still need a PAT for running the main scripts in the central dashboard but, in this case, the PAT is not required to be organization-wide. Access to the dashboard is granted only to org admins.

from outside-collaborators.

Hi @JeroenKnoops

Thanks for pointing out this vulnerability 👍🏻
I could actually add it up to the ⚠ Known limitations/issues section.

Do the other repositories also need a PAT with org admin rights?

A PAT with full repo scope is needed for the mentioning mechanism of the automated repos. Non-automated repos do not need any PAT, although the PAT as I've formulated the framework is organization-wide.

One could circumvent this by:

• Creating local PAT for each automated repo, but I'm afraid that the user owning the PAT should remain an org admin. Thus, the vulnerability persists. A PAT should be required even if the script responsible for mentioning would be running locally to the repo as we still need to grab information from the central repo dashboard.
• Not using the mentioning mechanism but only the centralized managing of outside collaborators.

When GitHub will provide the possibility to trigger workflows with webhooks (see FAQ), we will be able to get rid of the specific local triggering workflow.

I haven't looked into trying to fix this vulnerability outright yet; I might be fiddling with this in the next days. However, if you have suggestions, please don't hesitate to get back here!

Thanks again!

from outside-collaborators.

Another possibility to get around the PAT would be designing an equivalent GitHub App, I suppose.

from outside-collaborators.

Actually I have no experience with GitHub Apps, so that would really help out.

from outside-collaborators.