chalk icon indicating copy to clipboard operation
chalk copied to clipboard

add VCS key for sending repo id as per API

Open miki725 opened this issue 1 year ago • 1 comments

Description

Currently chalk reports include the origin URI which should be able to identify a repo on backend. That can have edge cases on repo renames/clones/etc as repo URI can change over time. It would be helpful if chalk can optionally send underlying github/gitlab repo ID so that repo can be identified by some unique ID not related to its name.

for gitlab/github native CI products, they make it available their API keys via env var so chalk should be able to query their APIs to get their repo ID and optionally send it in the report

miki725 avatar Apr 02 '24 14:04 miki725

For GitHub, the environment variables that are set by default for workflow runs include:

  • GITHUB_REPOSITORY_ID The ID of the repository. For example, 123456789. Note that this is different from the repository name.
  • GITHUB_REPOSITORY_OWNER_ID The repository owner's account ID. For example, 1234567. Note that this is different from the owner's name.

I believe these correspond to the values returned by:

gh api /repos/crashappsec/chalk --jq '.id, .owner.id'

However, I believe that at least the id value may change over time , so I think we want do to the equivalent of this:

gh api /repos/crashappsec/chalk --jq '.node_id, .owner.node_id'

I think it used to be possible for those identifiers to change in the past too, but from here, I think they shouldn't anymore:

We guarantee the IDs will be unique, therefore you can rely on them directly as references.

ee7 avatar Apr 02 '24 14:04 ee7