Add workflow to push-sync files to pulp/.github - #4
Conversation
| app-id: ${{ secrets.PULP_APP_ID }} | ||
| private-key: ${{ secrets.PULP_APP_PRIVATE_KEY }} | ||
| owner: pulp | ||
| repositories: .github |
There was a problem hiding this comment.
These are all set:
- The GithubApp content write permission is scoped to
pulp/.github - The ID/PRIVATE_KEY secrets access are scoped to
pulp/governance.
There was a problem hiding this comment.
So this action should be called login?
"create-github-app-token" sounds like security theatre.
There was a problem hiding this comment.
Looks like a login and smells like a login 🤷
| f"https://github.com/{GOVERNANCE_REPO}/blob/{branch}/" | ||
| "docs/vulnerability-management-policy.md" | ||
| ) | ||
| return content.replace("docs/vulnerability-management-policy.md", replacement) |
There was a problem hiding this comment.
I can update the link to point to pulpproject.org when that's published there, but I don't think it's a bad idea to point directly to the repository blob (that's the most up-to-date possible).
| class ContentHandler(Protocol): | ||
| """Processes file content during sync.""" | ||
|
|
||
| def __call__(self, content: str) -> str: ... |
There was a problem hiding this comment.
Is this a wordy way to say Callable[[str], str]?
There was a problem hiding this comment.
Yes. Self-documenting I would say
| app-id: ${{ secrets.PULP_APP_ID }} | ||
| private-key: ${{ secrets.PULP_APP_PRIVATE_KEY }} | ||
| owner: pulp | ||
| repositories: .github |
There was a problem hiding this comment.
So this action should be called login?
"create-github-app-token" sounds like security theatre.
2 participants
Adding a push-sync workflow, as discussed here.