Skip to content

chore(gocd): use GitHub App credentials #600

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joshuarli wants to merge 2 commits into
base: main
Choose a base branch
from
+3 −2
Open

chore(gocd): use GitHub App credentials #600

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
11129e3
chore(gocd): use GitHub App credentials
joshuarli Aug 26, 2026
88d280c
use checkruns2 for GitHub App credentials
joshuarli Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion gocd/templates/bash/github-check-runs.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash

checks-githubactions-checkruns \
checks-githubactions-checkruns2 \

@sentry sentry Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The script now calls checks-githubactions-checkruns2 and uses new auth variables. This assumes the binary is deployed and compatible, which isn't guaranteed by the code changes.
Severity: HIGH

Suggested Fix

Add a fallback mechanism to use the old binary if the new one is not found. Alternatively, add error handling to provide a clear message if checks-githubactions-checkruns2 is missing or fails. Consider adding a check for the binary's existence at the start of the script. It would also be beneficial to document the deployment requirements for this new binary within the repository.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: gocd/templates/bash/github-check-runs.sh#L3

Potential issue: The script `github-check-runs.sh` is updated to call a new binary,
`checks-githubactions-checkruns2`, and the configuration in `utils.libsonnet` switches
from using `GITHUB_TOKEN` to `GITHUB_APP_ID` and `GITHUB_APP_PRIVATE_KEY`. This change
relies on the `checks-githubactions-checkruns2` binary being present in the execution
environment's `PATH` and being compatible with the new authentication environment
variables. If the binary is not deployed, is named differently, or expects different
variables, the GoCD check-run stages will fail, potentially with a "command not found"
error, which could block all deployments.

Also affects:

  • gocd/templates/libs/utils.libsonnet:21~22

getsentry/objectstore \
"${GO_REVISION_OBJECTSTORE_REPO}" \
"Test (all features)" \
Expand Down
3 changes: 2 additions & 1 deletion gocd/templates/libs/utils.libsonnet
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@ local gocdtasks = import 'github.com/getsentry/gocd-jsonnet/libs/gocd-tasks.libs
jobs: {
checks: {
environment_variables: {
GITHUB_TOKEN: '{{SECRET:[devinfra-github][token]}}',
GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}',
GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}',
Comment on lines +21 to +22

@sentry sentry Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The switch to GitHub App credentials may be incompatible with the pinned version of the getsentry/gocd-jsonnet dependency (v3.0.7), potentially breaking the pipeline's check reporting stage.
Severity: HIGH

Suggested Fix

Verify that version 3.0.7 of the getsentry/gocd-jsonnet dependency supports authentication using GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY. If it does not, consider upgrading the dependency to a compatible version or implementing a fallback mechanism to ensure backward compatibility.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: gocd/templates/libs/utils.libsonnet#L21-L22

Potential issue: The code replaces the `GITHUB_TOKEN` environment variable with
`GITHUB_APP_ID` and `GITHUB_APP_PRIVATE_KEY` for GitHub authentication. However, the
pipeline relies on an external dependency, `getsentry/gocd-jsonnet` pinned to v3.0.7,
which consumes these variables. There is a risk that this specific version of the
dependency does not support authentication via GitHub Apps and only expects
`GITHUB_TOKEN`. If this is the case, the `checks-githubactions-checkruns` binary will
fail to authenticate with GitHub, causing the `checks` stage of the pipeline to fail at
runtime. This would break the pipeline's ability to report check-run statuses.

Did we get this right? 👍 / 👎 to inform future reviews.

},
timeout: 1800,
elastic_profile_id: 'objectstore',
Expand Down
Loading