1506740 - Assess use of external addon AWS CodeBuild (Oregon)" from aws-codesuite in Mozilla's GitHub organization mozilla

Status: RESOLVED FIXED

(mozilla.org :: Github: Administration, task)

Description

[Daniel Hartnell [:danielh]]

I want to use the AWS CodeBuild (Oregon)" from aws-codesuite addon in mozilla for the following reasons:

Below are my answers to your stock questions:

** Which repositories do you want to have access? (all or list)

mozillians

** Are any of those repositories private?

No

** Provide link to vendor's description of permissions needed and why

It is requesting "access of the user who requested the integration". I cannot find any documentation to link. In this case, mozilla-auth0 has public-read access to the repository so it should be limited to that.

** Provide the Install link for a GitHub app

https://github.com/orgs/mozilla/policies/applications/437940

Comment 1

[Daniel Hartnell [:danielh]]

I do not have a hard deadline to complete this work but it is currently blocking a colleague. Once this is in place, our CodeBuild jobs can read the repository and trigger builds on pushes. Until then, we cannot automate deployments which impacts the developer workflow.

Comment 2

[Hal Wine [:hwine] use NI!]

I've denied the request, as it is an old style OAuth app asking for permissions to private repositories.

Since you're using the application on a public repository, it should work fine without approval. Most of these old apps want permissions to install hooks on your behalf -- they should have instructions on how to manually configure those. A GitHub user with "admin" rights on the repo will need to configure that part.

If you have problems, please work with the app vendor to get specific instructions.

Comment 3

[Guillaume Destuynder [:kang] [this account is no longer active]]

After chatting with Hal and Gene, we decided to enable this momentarily in order to let CodeBuild setup the webhook, then disable it.

This is because CodeBuild does not allow you to get the webhook endpoint URL (it can only automatically create it without giving you any visibility)

The user that is tied to this is mozilla-auth0, which additionally only has read permissions to public repos regardless.

Comment 4

[Guillaume Destuynder [:kang] [this account is no longer active]]

we've done the setup (mozilla/mozillians now has 3 webhooks with codebuild) and disabled (denied) the grant again afterwards

Comment 5

[Guillaume Destuynder [:kang] [this account is no longer active]]

for reference:

repo affected: https://github.com/mozilla/mozillians/
user: mozilla-auth0
grant: https://github.com/orgs/mozilla/policies/applications/437940
timestamp: 10:43 AM PDT (2018-11-14)

Comment 6

[Guillaume Destuynder [:kang] [this account is no longer active]]

additional note: if the infra is recreated (e.g. with a cloudformation change) the hook will change and you would need to do this again so that aws can update the hook URL