Activity

1. matejchalk commented on Jul 16, 2025

   

   matejchalk

   on Jul 16, 2025

   Contributor

   More actions

   Thanks for the write-up, the proposal sounds good to me 👍 Fallback to default github.token also makes it a non-breaking change, which is welcome.

   App identity: Should we use code-pushup-staging or create a more general code-pushup app?

   I'd create a separate code-pushup app for production. We can use the code-pushup-staging app for testing this feature in our own repos, but as the name suggests, it's not intended for users outside our organization.

   • Permission compatibility: Does the current app have sufficient permissions?

   I believe not. It's currently only used to give portal access to GitHub API, so the permissions are restricted for this purpose. Specifically, it only has Read-only Metadata (mandatory) and Read-only Contents (selected) permissions.

   

   So I believe we'd need to add a Read and write Pull requests permission, is that right?

   • Marketplace priority: Should we create a GitHub Marketplace listing to help users discover the app (requirements for listing an app)?

   Not sure about this. I think we can list it as a free app, but even so it seems like there are some hoops to jump through and I'm not sure it gives us much advantage to be discoverable through the GitHub Marketplace. What do you think, @vmasek?

   👍React with 👍1Reacted by Vojtech Mašek

   🚀React with 🚀1Reacted by Vojtech Mašek
2. vmasek commented on Jul 16, 2025

   

   vmasek

   on Jul 16, 2025

   Contributor

   More actions

   I would not prioritize creating market place app for now, but having separate app for prod and using our logo for the icon would definitely be a nice touch
3. hanna-skryl commented on Jul 16, 2025

   

   hanna-skryl

   on Jul 16, 2025

   CollaboratorAuthor

   More actions

   Makes perfect sense to set up a production app. I can create a ticket for someone with owner/admin privileges to do this.

   So I believe we'd need to add a Read and write Pull requests permission, is that right?

   I think I was too quick to add pull-requests: write permission in the proposal technical requirements. Looking at the code, the action uses GitHub's Issues API endpoints to manage PR comments. So, the app will likely need Issues: Read and write permissions. But this needs to be tested.

   I would not prioritize creating market place app for now

   Agreed. A marketplace listing can always be added later if we find users have trouble discovering the app.

   I'm thinking we'll need two separate tickets:

   1. GitHub Apps setups:
      • configure code-pushup-staging app with proper permissions
      • create production code-pushup app
      • add both apps' IDs and private keys to repository secrets
   2. Implementation. Once the apps are ready, someone can implement the authentication changes using the PoC from the proposal

   One question, though: how do you think we should approach testing this feature on Code PushUp repositories before creating a public release?

   👍React with 👍1Reacted by Matěj Chalk
4. matejchalk commented on Jul 16, 2025

   

   matejchalk

   on Jul 16, 2025

   Last edited by matejchalk

   Contributor

   More actions

   One question, though: how do you think we should approach testing this feature on Code PushUp repositories before creating a public release?

   This is suprisingly easy when it comes to GitHub Actions, we can reference any Git branch, commit or tag in our workflows. For example, let's say you had a work-in-progress implementation pushed to a github-app-auth branch. Then you can create a dummy PR in code-pushup/cli with the following change and it'll execute your code:

   diff --git a/.github/workflows/code-pushup.yml b/.github/workflows/code-pushup.yml
   index cc135147..c8be8069 100644
   --- a/.github/workflows/code-pushup.yml
   +++ b/.github/workflows/code-pushup.yml
   @@ -34,6 +34,6 @@ jobs:
          - name: Install dependencies
            run: npm ci
          - name: Run Code PushUp action
   -        uses: code-pushup/github-action@v0
   +        uses: code-pushup/github-action@github-app-auth
            with:
              bin: npx nx code-pushup --

   👍React with 👍1Reacted by Hanna Skryl
5. matejchalk commented on Jul 16, 2025

   

   matejchalk

   on Jul 16, 2025

   Contributor

   More actions

   Looks like adding permissions will prompt existing GitHub users to accept them 🤔

   

   So maybe it would best to test it with a new GitHub App until it's ready. I can create it, just ping me when you need it. I'm guessing you'll want to implement it, @hanna-skryl?
6. hanna-skryl commented on Jul 16, 2025

   

   hanna-skryl

   on Jul 16, 2025

   CollaboratorAuthor

   More actions

   @matejchalk Sure, I'd like to try and implement it. There is no rush on the app setup. If you can do it this week, that's great, but it can wait until later.
7. matejchalk commented on Jul 24, 2025

   

   matejchalk

   on Jul 24, 2025

   Contributor

   More actions

   I've just created the new GitHub App Code PushUp - we'll use it for production later, but for now you can use it to for testing (saves creating an extra app). I've given the new app Contents: Read, Metadata: Read and Issues: Read and write permissions. I'll share the private key with you on Slack, @hanna-skryl. Let me know if you need anything else 🙂

   👍React with 👍1Reacted by Hanna Skryl
8. matejchalk commented on Oct 1, 2025

   

   matejchalk

   on Oct 1, 2025

   Contributor

   More actions

   Closed via:

   • Implement GitHub App authentication with fallback #186
   • feat: support prod and staging GitHub Apps #189
9. matejchalk

   closed this as completedon Oct 1, 2025
10. matejchalk

    assigned

    hanna-skryl

    on Oct 1, 2025