Subject: Re: Travis and AppVeyor continuous integration [Re:
 feature/master/ci]
To: Kartik Ohri <kartikohri13@gmail.com>, thomas@tada.se
References: <5EC17E17.7070002@anastigmatix.net>
 <5ED4EA10.4030801@anastigmatix.net>
 <CAASLQ4Px21jyb2vJYSrjF5P0RqhA-G_DDWR9QHG68r+W+AqbxQ@mail.gmail.com>
 <CAASLQ4NYE-TW6hjbkSOuAY2Z4NM2cYzqSQ9ahO2LAUhdP9axeQ@mail.gmail.com>
 <5ED7E74B.9020800@anastigmatix.net>
 <CAASLQ4Od6-0=3+4ENKh1Z-Wcu5Wir-bwUn_ccO2UCmDhoR4vtQ@mail.gmail.com>
 <5EDA576E.2000204@anastigmatix.net>
 <CAASLQ4OzPwZB6GG_cXNW4WU4zpHa6wm8Q3WRWNv5pZpis+gf3w@mail.gmail.com>
 <5EDBA5D9.8090506@anastigmatix.net>
 <CAASLQ4P8e9XfUh17HFhYE4eMtq5-C4dpHQAX+hCsia-UFNAjtA@mail.gmail.com>
 <5EE7AE8C.2040201@anastigmatix.net>
 <CAASLQ4PoMTiTZUPxTR7VS8LLo9tosAMu-89T5ikWub7VbM+r4Q@mail.gmail.com>
 <5EEA6F85.9040009@anastigmatix.net> <5F063C86.3070301@anastigmatix.net>
 <5F47EB62.2060306@anastigmatix.net>
 <CAASLQ4N6_=u6nbi+0tD8SSCSO0oPjGLMib7n2c2u5=rSKE+MNw@mail.gmail.com>
 <5F4816A0.8020208@anastigmatix.net>
 <CAO5TtCuTyvyUDkY4iNGr-zUYJe6gy9+RmmO7Dm6QiNzL2p8WLA@mail.gmail.com>
 <CAASLQ4NyFGd8J3iUpA3sCnkQ=4JccDjcHC=xrCemq9L4AdK+HQ@mail.gmail.com>
Cc: pljava-dev@lists.postgresql.org
From: Chapman Flack <chap@anastigmatix.net>
Message-ID: <5F4A53C3.1040102@anastigmatix.net>
Date: Sat, 29 Aug 2020 09:10:27 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.7.0
MIME-Version: 1.0
In-Reply-To: 
 <CAASLQ4NyFGd8J3iUpA3sCnkQ=4JccDjcHC=xrCemq9L4AdK+HQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 08/29/20 04:35, Kartik Ohri wrote:
> Hi!
> On Sat, Aug 29, 2020 at 12:55 PM Thomas Hallgren <thomas@tada.se> wrote:
>> I'm somewhat reluctant to TravisCI due to its requirement for write
>> permissions to *all* my repositories and associated data. Why would anyone
>> grant an external CI service such permissions just to handle CI of *one* of
>> my repositories, and why don't they offer a read-only alternative?
>>
> 
> Travis recommends all repositories access but that can be easily restricted
> to a single repository. Once, the application has been authorized. Github
> will ask whether to install in a single repository or all.
> 
> Also, I checked which permissions the Travis app installed on my repo has.
> The current Travis App has the write access to checks, commit statuses,
> deployments, and repository hooks. The first three make sense but I am not
> sure about the role of repository hooks. For what it's worth, AppVeyor
> requires write access to only checks, commit statuses.

I will admit to a bit of a shock yesterday when, out of curiosity, I went
to https://travis-ci.com/plans and clicked "SET UP YOUR OPEN SOURCE PROJECT
NOW" and was immediately faced with a GitHub "Authorize Travis CI" dialog
requesting:

=====
Organizations and teams
Read-only access

This application will be able to read your organization, team membership,
and private project boards.


Repositories
Public and private

This application will be able to read and write all public and private
repository data. This includes the following:

    Code
    Issues
    Pull requests
    Wikis
    Settings
    Webhooks and services
    Deploy keys
    Collaboration invites


Personal user data
Email addresses (read-only)

This application will be able to read your private email addresses.
=====

The "Cancel" button is still smoking from how hard I hit it.

But I think that must have been their older, pre-GitHub-App, signup
process. I am not sure why they still have a working link that goes there.


Thomas, if their current permission requests, when configured as a
GitHub App, are as Kartik describes, and can be limited to the PL/Java
repo only, would that answer your concerns (even if not perfectly,
perhaps acceptably)?

It seems to me also that such concerns can have a "duration" dimension:
if even their more limited, app-based, permissions are not entirely
satisfactory, perhaps they would be tolerable for a limited period
(a calendar quarter, perhaps) to immediately reap the benefits of
Kartik's work while affording time to explore migrating the scripts
to Github Actions without a rush?

As I mentioned earlier, I suspect the migration would be fairly
straightforward. Kartik's GSoC-sponsored period concludes this weekend,
however. and migrating it all to GitHub Actions is probably not quite
*that* straightforward.

Regards,
-Chap