chalk
chalk copied to clipboard
add VCS key for sending repo id as per API
Description
Currently chalk reports include the origin URI which should be able to identify a repo on backend. That can have edge cases on repo renames/clones/etc as repo URI can change over time. It would be helpful if chalk can optionally send underlying github/gitlab repo ID so that repo can be identified by some unique ID not related to its name.
for gitlab/github native CI products, they make it available their API keys via env var so chalk should be able to query their APIs to get their repo ID and optionally send it in the report
For GitHub, the environment variables that are set by default for workflow runs include:
GITHUB_REPOSITORY_IDThe ID of the repository. For example,123456789.Note that this is different from the repository name.GITHUB_REPOSITORY_OWNER_IDThe repository owner's account ID. For example, 1234567. Note that this is different from the owner's name.
I believe these correspond to the values returned by:
gh api /repos/crashappsec/chalk --jq '.id, .owner.id'
However, I believe that at least the id value may change over time , so I think we want do to the equivalent of this:
gh api /repos/crashappsec/chalk --jq '.node_id, .owner.node_id'
I think it used to be possible for those identifiers to change in the past too, but from here, I think they shouldn't anymore:
We guarantee the IDs will be unique, therefore you can rely on them directly as references.