Fine-Grained Personal Access Tokens don't need `repo:admin` about buildbot-nix HOT 7 CLOSED

Sounds like #127?

from buildbot-nix.

@MagicRB is it still on your agenda to convert buildbot-nix into only using the GitHub app for everything?

from buildbot-nix.

Yep, I should get to it this weekend

@MagicRB is it still on your agenda to convert buildbot-nix into only using the GitHub app for everything?

Was planning to start earlier, but then my parents came to visit and then right after I got sick. So that ate two weeks :)

from buildbot-nix.

@MagicRB you can steal the code for re-newing GITHUB_TOKEN's from an github app from here: https://github.com/NixOS/nixpkgs-merge-bot/blob/1aad9bf9b570889da6555650f82d670fc2f73658/nixpkgs_merge_bot/github/GitHubClient.py#L218

You want to use buildbot's secret backend likely because than you can read the token from a file. Those github tokens need to be refresh every hour or so. Last time I read the buildbot code, I think there was one case where it wouldn't use the secret backend and cache the the token - but we can probably patch and upstream the fix. Unfortunately I don't recall where this was the case and if it was fixed.

from buildbot-nix.

The PR exists, the code is in place, a mess has been created: #156

Next step: refactoring

from buildbot-nix.

@lorenzleutgeb #156 is in place, is that enough for your use case? Or do you still desire file-grained PATs?

from buildbot-nix.

I believe so. Otherwise feel free to re-open this.

from buildbot-nix.