GitHub Application Data Source Credential

From Lingoport Wiki
Jump to navigation Jump to search

Introduction

Command Center as a private GitHub app offers a number of benefits:

  • It operates as its own identity, independent of any user account.
  • Access is scoped to exactly the repositories where the app is installed.
  • Installation tokens are short-lived (1 hour) and auto-rotated; there is nothing to expire manually.
  • All activity is attributed to the app in the GitHub audit log.
  • The app does not need to be published to the GitHub Marketplace. A private app installed on a single organization is sufficient.

Command Center uses Data Source Credentials to connect to GitHub repositories.

  • One GitHub Credential type is based on account and PAT.
  • The other is based on an installed GitHub App, used as a Data Source Credentials

A specific instance of Command Center is a GitHub app and that GitHub app needs to be installed on the GitHub organization.

On GitHub

  • For systems administered by Lingoport, you can choose to install the Lingoport-CommandCenter GitHub App. It's been registered and is a public GitHub App. You can choose to register your own private application.
  • For other systems which are not administered by Lingoport, you will need to register your own private application.


Installing the public Lingoport-CommandCenter GitHub App

For systems administered by Lingoport, request at support at lingoport dot com to add the corresponding Data Source Credential on Command Center.

Lingoport support will create a new Data Source Credential, named LingoportGitHubApp by default, for https://github.com/apps/lingoport-commandcenter.

Only repositories with the Lingoport-CommandCenter GitHub App can be on-boarded with this credential.

To install the public Lingoport-CommandCenter GitHub App on organizations/repositories you own, use

See for installation details:

Internal Note for Support: "GitHub App Lingoport-CommandCenter" in Vault



Private Organization GitHub Side Configuration

This section is for Command Centers not administered by Lingoport. The registration of the GitHub App is done by the GitHub organization owners. The App ID and Private Key (.pem) are under the control of the customer, not Lingoport.


Registering your Command Center GitHub App

GitHub Apps can be installed directly on organizations and personal accounts and granted access to specific repositories. Create a private GitHub App and install on the organization.

By default, only organization owners can manage the settings of GitHub Apps in an organization. To allow additional users to change the developer settings of GitHub Apps owned by the organization, an owner can grant them GitHub App manager permissions. GitHub App Managers can't manage third-party applications. For more information about adding and removing GitHub App managers in your organization, see Roles in an organization.

To configure a private GitHub app, see: https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app

The creation process starts under the General tab.

  • Note:
    • Most options are not necessary
    • The minimum required permission setting is Repository permissions > Content Read/Write
    • No callbacks are required, set the Active to false
Home Page URL

Copy the URL for the Command Center, something like:

App ID

The GitHub App ID can be found at the top of the GitHub App page:

Private Key

The private key generation is located towards the end of the GitHub App page:

Identicon

Copy and use the following to set the Lingoport Github App logo:

Note: https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/creating-a-custom-badge-for-your-github-app

Make sure to copy the GitHub app ID and the private key as those are needed in the next section.

Permissions: Content R/W

Under the tab Permissions click Content for Read/Write for Localyzer projects, Read for Globalyzer projects only


Install on Repositories

Pick the repositories or all repositories. Only those selected repositories can then use the Command Center credentials.

Command Center Configuration

[Administrator] Once the application is installed, to create a GitHub App Credential:

  • navigate to Global Setting
  • set Command Center in Maintenance Mode
  • click on 'Credentials'
  • click on + (New Credentials)
  • Click on GitHub App (not GitHub, those are the traditional account/PAT)
  • Fill in the GitHub App ID and private key (.pem file)
  • Continue as for any other Data Source Credential configuration

Project Configuration

When creating a project using a GitHub app Credential, the GitHub app must have been installed on the corresponding repository. Otherwise, the following error will arise.

  • GitHub App is not installed on <RepoName>, or the App credentials are invalid (HTTP 404)


This will need to be corrected on the GitHub side.


Allowing the GitHub App to Bypass Signed/Verified Commits Requirements

In 4.7.z, GitHub App do not create verified commits.

If the GitHub repository requires signed and verified commits, commits created by the Command Center GitHub App may be rejected unless the GitHub App is configured to bypass the applicable repository ruleset.

The configuration below allows the GitHub App to create commits without requiring those commits to be signed and verified, while continuing to require signed commits for other users.

Configure the Repository Ruleset

On GitHub:

  1. Open the repository.
  2. Navigate to Settings → Rules → Rulesets.
  3. Open the ruleset that applies to the branch used by Command Center.
  4. Locate the Bypass list.
  5. Click Add bypass.
  6. Select the Command Center GitHub App (for example, Lingoport-CommandCenter or the customer's private Command Center GitHub App).
  7. Save the ruleset.

The GitHub App must be installed on the organization and repository before it can be selected as a bypass actor.


Signed Commits vs. Commit Verification

GitHub's requirement for signed commits and the verification status displayed for a commit are separate concepts:

  • Require signed commits — A repository ruleset can require commits to have a valid signature.
  • Verified status — GitHub displays whether it can verify the signature associated with a commit.
  • A commit created by Command Center may therefore be displayed as Unverified even when the GitHub App is permitted to push the commit.

If the repository requires signed commits, configure the GitHub App as a bypass actor in the applicable ruleset.

For more information, see the GitHub documentation on GitHub repository rulesets. ```

Retrieved from "https://wiki.lingoport.com/index.php?title=GitHub_Application_Data_Source_Credential&oldid=100352"