2023761 - [GITHUB] Allow use of individual api keys for pull requests and push comments instead of single share secret

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, enhancement, P3)

Description

[David Lawrence [:dkl]]

Currently a single shared secret is store in Bugzilla parameters for authenticating web hooks from Github to Bugzilla. There are two REST API endpoints that use the shared secret:

https://bugzilla.mozilla.org/rest/github/pull_request
https://bugzilla.mozilla.org/rest/github/push_comment

More information and docs can be viewed here https://bmo.readthedocs.io/en/latest/api/core/v1/github.html

Instead of a single share secret, which would be difficult to rotate if needed, we should let users add their API keys for special bot accounts as secrets. Each bot account would create an API key, add it to the secret and then the webhook would pass that along to the endpoints. Then if an API key is leaked, we just disable the bot account and revoke the single API key and create another one.

Comment 1

[BMO Github Automation]

Attachment: [mozilla-bteam/bmo] Bug 2023761 - [GITHUB] Allow use of individual api keys for pull requests and push comments instead of single share secret (#2570)

Comment 2

[BMO Github Automation]

Authored by https://github.com/dklawren
https://github.com/mozilla-bteam/bmo/commit/61a9cac3e571a51ddf216d60b7836ec6131ddd71
[master] Bug 2023761 - [GITHUB] Allow use of individual api keys for pull requests and push comments instead of single share secret