CodeBuild projects for public repos do not appear to always have auth info

[mattsb42]

Because the PR updater attempts to piggy-back on the CodeBuild GitHub permissions, if permissions are not present, the updater will fail.

It looks like even if the CodeBuild Project was configured through GitHub OAUTH, if the GitHub repo is public, CodeBuild does not obtain an auth token. IMO, this is reasonable and good, because they aren't writing anything, so they don't need one. However, it does mean that for these public repos (the primary purpose of this project's functionality), this project does not appear to consistently work.

hephaestus:pipipxx matt$ aws codebuild batch-get-projects --names pipipxx-linux-py37
{
    "projects": [
        {
            "name": "pipipxx-linux-py37",
            "arn": "arn:aws:codebuild:us-west-2:111222333444:project/pipipxx-linux-py37",
            "source": {
                "type": "GITHUB",
                "location": "https://github.com/mattsb42/pipipxx.git",
                "gitCloneDepth": 1,
                "gitSubmodulesConfig": {
                    "fetchSubmodules": false
                },
                "buildspec": ".codebuild/linux-buildspec.yaml",
                "reportBuildStatus": false,
                "insecureSsl": false
            },
            "secondarySources": [],
            "artifacts": {
                "type": "NO_ARTIFACTS"
            },
            "secondaryArtifacts": [],
            "cache": {
                "type": "NO_CACHE"
            },
            "environment": {
                "type": "LINUX_CONTAINER",
                "image": "aws/codebuild/standard:2.0",
                "computeType": "BUILD_GENERAL1_SMALL",
                "environmentVariables": [
                    {
                        "name": "PYTHON_BUILD_VERSION",
                        "value": "3.7",
                        "type": "PLAINTEXT"
                    }
                ],
                "privilegedMode": false,
                "imagePullCredentialsType": "CODEBUILD"
            },
            "serviceRole": "arn:aws:iam::111222333444:role/service-role/test-codebuild-pipipxx",
            "timeoutInMinutes": 60,
            "queuedTimeoutInMinutes": 480,
            "encryptionKey": "arn:aws:kms:us-west-2:111222333444:alias/aws/s3",
            "tags": [],
            "created": 1558918666.096,
            "lastModified": 1558924935.24,
            "webhook": {
                "url": "https://api.github.com/repos/mattsb42/pipipxx/hooks/112678088",
                "payloadUrl": "xxxxxxxxxxxxxxxx",
                "filterGroups": [
                    [
                        {
                            "type": "EVENT",
                            "pattern": "PUSH, PULL_REQUEST_CREATED, PULL_REQUEST_UPDATED, PULL_REQUEST_REOPENED",
                            "excludeMatchedPattern": false
                        }
                    ]
                ]
            },
            "badge": {
                "badgeEnabled": true,
                "badgeRequestUrl": "https://codebuild.us-west-2.amazonaws.com/badges?uuid=eyJlbmNyeXB0ZWREYXRhIjoiQU5URTJKdnBHQkFwTStnckNjNGlaUGZQNk51V0s1V1JDL0FIUjBERWNmYnNnckM5Vy8vNlZNOWUxWElMLyt3SjlVY2RhSTk3QlByaDZsOEVkZFYzWDVNPSIsIml2UGFyYW1ldGVyU3BlYyI6Ik53bU14aTBqQkFkWmpET2UiLCJtYXRlcmlhbFNldFNlcmlhbCI6MX0%3D&branch=master"
            },
            "logsConfig": {
                "cloudWatchLogs": {
                    "status": "ENABLED"
                },
                "s3Logs": {
                    "status": "DISABLED",
                    "encryptionDisabled": false
                }
            }
        }
    ],
    "projectsNotFound": []
}

[jlhood]

@mattsb42 Thanks for reporting this. So the workaround is to initialize the CodeBuild project with an OAuth token with write access to the repo, but it sounds like you would prefer not to do that. Would adding an optional parameter to explicitly specify an OAuth token to the app instead of automatically using the one from the CodeBuild project address this issue?

[trivikr]

Would adding an optional parameter to explicitly specify an OAuth token to the app instead of automatically using the one from the CodeBuild project address this issue?

Yes please, this would be helpful!

[jlhood]

@trivikr Thanks for the feedback. I'll look into adding this feature.

[mattsb42]

This sounds like a reasonable plan to me. The reason I said it was good and reasonable the CodeBuild wasn't keeping a token around for public repos is because they only read, so if the repo is public, they don't actually need any credentials to read, so why keep any credentials around.

[jlhood]

PR has been merged. Will be available in v1.1.0, but publishing to SAR is delayed. ETA for the new release is 10/9.

[jlhood]

Fixed in v1.1.0 (now released and published to SAR)