Migrate GitHub OAuth App to GitHub App

readthedocs/api/v2/serializers.py

@@ -93,6 +93,7 @@ class Meta(ProjectSerializer.Meta):
             "environment_variables",
             "max_concurrent_builds",
             "readthedocs_yaml_path",
+            "clone_token",
         )
 
 

readthedocs/core/views/hooks.py

@@ -15,7 +15,7 @@
 log = structlog.get_logger(__name__)
 
 
-def _build_version(project, slug, already_built=()):
+def _build_version(project, version):
     """
     Where we actually trigger builds for a project and slug.
 
@@ -27,24 +27,27 @@ def _build_version(project, slug, already_built=()):
     # Previously we were building the latest version (inactive or active)
     # when building the default version,
     # some users may have relied on this to update the version list #4450
-    version = project.versions.filter(active=True, slug=slug).first()
-    if version and slug not in already_built:
+    if version.active:
         log.info(
             "Building.",
             project_slug=project.slug,
             version_slug=version.slug,
         )
         trigger_build(project=project, version=version)
-        return slug
+        return version.slug
 
-    log.info("Not building.", version_slug=slug)
+    log.info("Not building.", version_slug=version.slug)
     return None
 
 
 def build_branches(project, branch_list):
     """
     Build the branches for a specific project.
 
+    .. warning::
+
+       Deprecated, use ``build_versions_from_names`` instead.
+
     Returns:
         to_build - a list of branches that were built
         not_building - a list of branches that we won't build
@@ -59,14 +62,43 @@ def build_branches(project, branch_list):
                 project_slug=project.slug,
                 version_slug=version.slug,
             )
-            ret = _build_version(project, version.slug, already_built=to_build)
+            if version.slug in to_build:
+                continue
+            ret = _build_version(project, version)
             if ret:
                 to_build.add(ret)
             else:
                 not_building.add(version.slug)
     return (to_build, not_building)
 
 
+def build_versions_from_names(project, version_names: list[tuple[str, str]]):
+    """
+    Build the branches or tags from the project.
+
+    :param project: Project instance
+    :param version_names: A list of tuples with the version name and type.
+    :returns: A tuple with the versions that were built and the versions that were not built.
+    """
+    to_build = set()
+    not_building = set()
+    for version_name, version_type in version_names:
+        for version in project.versions_from_name(version_name, version_type):
+            log.debug(
+                "Processing.",
+                project_slug=project.slug,
+                version_slug=version.slug,
+            )
+            if version.slug in to_build:
+                continue
+            triggered = _build_version(project, version)
+            if triggered:
+                to_build.add(triggered)
+            else:
+                not_building.add(version.slug)
+    return to_build, not_building
+
+
 def trigger_sync_versions(project):
     """
     Sync the versions of a repo using its latest version.
@@ -150,6 +182,7 @@ def get_or_create_external_version(project, version_data):
         external_version.identifier = version_data.commit
         # If the PR was previously closed it was marked as closed
         external_version.state = EXTERNAL_VERSION_STATE_OPEN
+        external_version.active = True
         external_version.save()
         log.info(
             "External version updated.",
@@ -175,7 +208,6 @@ def close_external_version(project, version_data):
         project.versions(manager=EXTERNAL)
         .filter(
             verbose_name=version_data.id,
-            identifier=version_data.commit,
         )
         .first()
     )

readthedocs/oauth/admin.py

@@ -2,12 +2,22 @@
 
 from django.contrib import admin
 
+from .models import GitHubAppInstallation
 from .models import RemoteOrganization
 from .models import RemoteOrganizationRelation
 from .models import RemoteRepository
 from .models import RemoteRepositoryRelation
 
 
+@admin.register(GitHubAppInstallation)
+class GitHubAppInstallationAdmin(admin.ModelAdmin):
+    list_display = (
+        "installation_id",
+        "target_type",
+        "target_id",
+    )
+
+
 @admin.register(RemoteRepository)
 class RemoteRepositoryAdmin(admin.ModelAdmin):
     """Admin configuration for the RemoteRepository model."""

readthedocs/oauth/clients.py

@@ -1,7 +1,10 @@
 from datetime import datetime
 
 import structlog
+from django.conf import settings
 from django.utils import timezone
+from github import Auth
+from github import GithubIntegration
 from requests_oauthlib import OAuth2Session
 
 
@@ -70,3 +73,15 @@ def get_oauth2_client(account):
         token_updater=_get_token_updater(token),
     )
     return session
+
+
+def get_gh_app_client() -> GithubIntegration:
+    """Return a client authenticated as the GitHub App to interact with the API."""
+    app_auth = Auth.AppAuth(
+        app_id=settings.GITHUB_APP_CLIENT_ID,
+        private_key=settings.GITHUB_APP_PRIVATE_KEY,
+        # 10 minutes is the maximum allowed by GitHub.
+        # PyGithub will handle the token expiration and renew it automatically.
+        jwt_expiry=60 * 10,
+    )
+    return GithubIntegration(auth=app_auth)

readthedocs/oauth/constants.py

@@ -1,9 +1,11 @@
 GITHUB = "github"
+GITHUB_APP = "githubapp"
 GITLAB = "gitlab"
 BITBUCKET = "bitbucket"
 
 VCS_PROVIDER_CHOICES = (
     (GITHUB, "GitHub"),
+    (GITHUB_APP, "GitHub"),
     (GITLAB, "GitLab"),
     (BITBUCKET, "Bitbucket"),
 )