Comments (6)
Whatever the permission is, I think the bot already has it - I tried using its API key to query the orgs/Qiskit/membership/jakelishman end point, and it gives me the right data.
from qiskit-bot.
Heh, github sure makes it hard to find the potential values for the author_association
field. The closest I've found is: https://docs.github.com/en/graphql/reference/enums#commentauthorassociation
Based on the potential values there, I think @jakelishman is correct and the best path forward here is to query the github api to ask for the list of organization membership explicitly and verify against that
from qiskit-bot.
Actually, I think to be reliable, we'll need to use an API key with admin:org
and permissions to read the private members of Qiskit, then get the information from the Qiskit org API call, rather than the per-user one. For example, my membership is apparently private (I don't remember choosing, tbh), so I don't appear in the list if you use my user's organisations call.
from qiskit-bot.
Hmm, I'm a bit concerned if that's the case. I've very specifically been keeping the bots permissions limited. I'd worry about giving it org admin permissions since it opens up the account to a lot more. I'd only really feel comfortable with that level of permission for the the bot if it had 2fa and not a shared account. We might want to rethink this feature if the github api doesn't reliably provide an api method to detect organization membership reliably without special permissions.
from qiskit-bot.
After a bit more investigation, I found that the author_association
data to the PR does actually see me as a member, but only if the data is generated using the bot's API key (i.e. with the right permission level). The bot is getting fed only public information in its hooks, which is why it previously saw me as a contributor. I've since made my membership of the Qiskit org public, and now I appear as a member, even without authorisation.
The right solution here is probably to either make sure the bot is getting the full data in its webhooks, or using the repo
object (which is created with a privileged API key) to query the membership status, as I mentioned above.
from qiskit-bot.
I don't know if the webhook interface lets us get data as an authorized user. It basically is just send raw http requests with a json body to an endpoint. There is minimal auth in the form of a shared secret but that's independent of user credentials. I guess we'll just have to update the code to query the rest api which does use the bot's key. That should hopefully be sufficient
from qiskit-bot.
Related Issues (16)
- Change default_branch default value after qiskit migrates to use main
- Change release trigger mechanism HOT 1
- tag as "community PR" when PR author is not in the organization HOT 1
- Add support for publishing pre-releases
- Add release notes link to changelog generation output HOT 1
- Add enhancements for external contributor activity
- Bump each element version after release HOT 1
- Make notifications varied so that people don't automatically ignore it HOT 3
- Notify first time contributor / community contributors to fulfill PR checklists HOT 3
- Don't post "Thank you for opening a new pull request" for frequent contributors HOT 2
- comment on visualization changes with binder for visualization testing HOT 2
- Add support for auto tagging and releasing meta package versions HOT 1
- Drop metapackage handling
- Add support for configurable notifications
- Add support for marking PRs as explicitly not needing a changelog entry
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from qiskit-bot.