Support setting user Codespaces secrets by joshmgross · Pull Request #4699 · cli/cli

joshmgross · 2021-11-07T20:58:38Z

Supports #4698

This PR adds support for setting a Codespaces user secret via the CLI.

gh secret set -u -bs -vselected -r"cli/cli,github/hub" cool_secret

Codespaces user secrets follow a similar pattern to Actions organization secrets in that they can be shared with all repositories or a specific set of repositories.

To support this, this PR uses the public key and set secret APIs for user Codespaces secrets.

https://docs.github.com/en/rest/reference/codespaces#get-public-key-for-the-authenticated-user
https://docs.github.com/en/rest/reference/codespaces#create-or-update-a-secret-for-the-authenticated-user

Repository selection

Unlike organization secrets, the repositories specified for a user secret do not have to belong to that owner of the secret.

When setting an organization secret via the CLI, the --repos option is used to specify a set of repository names.

For user secrets, I've reused that same --repos option but with the assumption that all repositories specified are fully qualified names with owners (NWOs).

If this is confusing, we could either:

Use a different option for fully qualified repos rather than reusing --repos
Support both repository names and full NWOs. If an owner isn't specified, assume the owner is the current user.

I did not use the second option as I'm unsure how to retrieve the current user's login.

Auth Issues

These APIs require the user or read:user scope, which is not currently requested by default.

Users will need to request the user scope to set a user secret

gh auth refresh -h github.com -s user

Since setting a secret first fetches the public key which requires read:user scopes and the set secret API requiring user scopes, users may hit auth issues twice before they are successful.

>gh secret set -u -bs -vselected -r"cli/cli,github/hub" cool_secret
failed to fetch public key: HTTP 403: This API requires the `read:user` scope. (https://api.github.com/user/codespaces/secrets/public-key)
This API operation needs the "read:user" scope. To request it, run:  gh auth refresh -h github.com -s read:user

>gh auth refresh -h github.com -s read:user 
...

>gh secret set -u -bs -vselected -r"cli/cli,github/hub" cool_secret
failed to set secret: HTTP 403: This API requires the `user` scope. (https://api.github.com/user/codespaces/secrets/cool_secret)
This API operation needs the "user" scope. To request it, run:  gh auth refresh -h github.com -s user

>gh auth refresh -h github.com -s user
...

Testing

Validated that a secret was able to be added:

❯ bin/gh secret set -u -bs -vselected -r"joshmgross/clock,joshmgross/actions-testing" coolSecret
✓ Set secret coolSecret for cli/cli

Fixes #4038

mislav

Thanks! This feature looks great.

Left some comments, but the biggest blocker remains the uncertainty about the type of the selected_repository_ids parameter. Let us know what you learn!

pkg/cmd/secret/set/http.go

pkg/cmd/secret/set/set.go

joshmgross · 2021-11-08T22:28:17Z

Thanks for the review @mislav, I've filed issues with some internal teams to get the selected_repository_ids type issues fixed.

The Actions API is incorrectly documented and does expect those to be integers.

joshmgross · 2021-11-11T04:07:55Z

pkg/cmd/secret/secret.go

 			Secrets can be set at the repository, environment, or organization level for use in
-			GitHub Actions. Run "gh help secret set" to learn how to get started.
-		`),
-		Annotations: map[string]string{


Resolved conflicts with #4675, with this change secrets would no longer just be an Actions command. Let me know if there's a better tag here.

Visibility is only meant for org secrets. User secrets do support scoping to specific repositories, but for that the `--repos` flag can be used without passing `--visibility`.

Let the platform perform validation. We gain nothing from client-side validation other than avoding an API request. By performing client-side validation, we open ourselves to the risk of falling out of sync with what the plaform considers valid secret names.

Do not use `Flags().Changed(...)` when testing for whether a flag has a non-empty value or not. The user might have intentionally sent an empty value.

Ensure the `--repos` list is parsed with the host of the repository as the default host in the case repositories are listed in the `repo` or `owner/repo` formats (which are also most likely).

mislav

This looks great!

I have pushed fixes:

gh secret set --user is now usable when not in a context of a local git repository
--visiblity is now unsupported for --user secrets
do not send the visibility JSON parameter when setting user secrets since that's ignored by the API endpoint
improve docs to clarify different secret levels (repo/environment/org/user)
improve flag parsing and error formatting in secret set
fix secret set --repos for GitHub Enterprise
remove client-side validation of secret names (just for good measure)

@joshmgross The remaining items are now that gh secret list and gh secret remove do not support --user. Do you have time to add those too? I suspect it will be simple. Should that be added in a separate PR? You can base it on this branch.

joshmgross · 2021-11-11T18:17:58Z

Thanks @mislav, your changes look good to me. I completely missed that user secrets didn't have visibility options like organization secrets.

I can add support for gh secret list and gh secret remove in a separate PR, but I don't think I'll be able to use this PR as a base branch since this is a fork pull request.

mislav · 2021-11-11T18:37:22Z

@joshmgross Ah, right! The list and remove commands are completely separate Go packages, so you might be able to base your changes on trunk just as well, even before this PR gets merged.

joshmgross · 2021-11-11T19:36:23Z

Adding list and remove in #4714

Support setting user Codespaces secrets

8c32bcd

joshmgross requested a review from a team as a code owner November 7, 2021 20:58

joshmgross requested review from vilmibm and removed request for a team November 7, 2021 20:58

mislav suggested changes Nov 8, 2021

View reviewed changes

joshmgross marked this pull request as draft November 8, 2021 22:27

joshmgross added 4 commits November 11, 2021 03:47

Use a separate payload for Codespaces secrets

7d0e2bc

Remove unused struct

80a4124

Support fully-qualified repo names for org secrets

e0d9b32

Merge branch 'trunk' into joshmgross/codespaces-set-secret

41dca35

joshmgross commented Nov 11, 2021

View reviewed changes

joshmgross marked this pull request as ready for review November 11, 2021 04:08

joshmgross requested a review from mislav November 11, 2021 04:08

mislav added 6 commits November 11, 2021 12:44

secret set: do not look up base repo in case of user secret

bb06cf8

Do not accept nor submit visibility for user secrets

d9e8450

Visibility is only meant for org secrets. User secrets do support scoping to specific repositories, but for that the `--repos` flag can be used without passing `--visibility`.

Improve secret set docs to clarify different levels

114c42f

Improve flag parsing for secret set

9a3fec7

Do not use `Flags().Changed(...)` when testing for whether a flag has a non-empty value or not. The user might have intentionally sent an empty value.

Improves gh secret set --repos support for GitHub Enterprise

432d4e1

Ensure the `--repos` list is parsed with the host of the repository as the default host in the case repositories are listed in the `repo` or `owner/repo` formats (which are also most likely).

mislav approved these changes Nov 11, 2021

View reviewed changes

mislav requested a review from a team November 11, 2021 18:48

joshmgross mentioned this pull request Nov 11, 2021

Support listing and removing user Codespaces secrets #4714

Merged

darcyclarke assigned mislav Nov 17, 2021

mislav merged commit e82958b into cli:trunk Nov 18, 2021

joshmgross deleted the joshmgross/codespaces-set-secret branch November 18, 2021 15:57

VictorBatta mentioned this pull request Dec 4, 2021

GitHub CLI 2.3.0 #4855

Closed

jenkins-infra-bot mentioned this pull request Dec 20, 2021

[updatecli] Bump ghcli version jenkins-infra/docker-builder#26

Merged

joshmgross mentioned this pull request Jan 27, 2023

Use int64 repository IDs for Codespaces user secrets #6923

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support setting user Codespaces secrets#4699

Support setting user Codespaces secrets#4699
mislav merged 11 commits intocli:trunkfrom
joshmgross:joshmgross/codespaces-set-secret

joshmgross commented Nov 7, 2021 •

edited by mislav

Loading

Uh oh!

mislav left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

joshmgross commented Nov 8, 2021

Uh oh!

joshmgross Nov 11, 2021

Uh oh!

mislav left a comment

Uh oh!

joshmgross commented Nov 11, 2021

Uh oh!

mislav commented Nov 11, 2021

Uh oh!

joshmgross commented Nov 11, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

joshmgross commented Nov 7, 2021 • edited by mislav Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Repository selection

Auth Issues

Testing

Uh oh!

mislav left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

joshmgross commented Nov 8, 2021

Uh oh!

joshmgross Nov 11, 2021

Choose a reason for hiding this comment

Uh oh!

mislav left a comment

Choose a reason for hiding this comment

Uh oh!

joshmgross commented Nov 11, 2021

Uh oh!

mislav commented Nov 11, 2021

Uh oh!

joshmgross commented Nov 11, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

joshmgross commented Nov 7, 2021 •

edited by mislav

Loading