-
Notifications
You must be signed in to change notification settings - Fork 421
feat(ci): dispatch GitHub analytics action #2161
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
f174581
to
aa3f4a4
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Two tiny changes. fantastic work, Ruben!
It's quite a genius move to do this and cut down all the infra required to exchange tokens and whatnot per repo
repository-projects: read | ||
security-events: read | ||
statuses: read | ||
|
||
jobs: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we run in an environment do secrets are encrypted from forks?
You never know if we ever accidentally make a mistake in the IAM OIDC and allow any repo. This will prevent this attack vector.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done, created a new "analytics" environment and moved the secrets there. I've removed the old secrets too.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please note that the IAM OIDC would not be assumable since there's a condition to only be assumable by this repository too. In any case, it's better this way.
Hey folks, do we need something like this in the TS repo? |
@dreamorosi yes Andrea, I will send instructions and open PR for the rest of the runtimes during the day! |
Issue number: #2160
Summary
Changes
This PR adds a new GitHub action that runs every hour. The action assumes an OIDC role and calls a Lambda Function that dispatches all the crawling functions synchronously.
User experience
After this change, we should see fresh analytics every hour.
Checklist
If your change doesn't seem to apply, please leave them unchecked.
Is this a breaking change?
RFC issue number:
Checklist:
Acknowledgment
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.