Return protection on master branch back

[yarikoptic]

I am disabling it for now to facilitate bringing back auto-releasing

ℹ  info      Pushing new tag to GitHub
remote: error: GH006: Protected branch update failed for refs/heads/master.        
remote: 
remote: - Changes must be made through a pull request.        
To https://github.com/ReproNim/neurodocker
 * [new tag]         2.1.0 -> 2.1.0
 ! [remote rejected] master -> master (protected branch hook declined)
error: failed to push some refs to 'https://github.com/ReproNim/neurodocker'
Error: Running command 'git' with args [push, --follow-tags, --set-upstream, https://****CWfQ@github.com/ReproNim/neurodocker, master] failed

remote: error: GH006: Protected branch update failed for refs/heads/master.        
remote: 
remote: - Changes must be made through a pull request.        
To https://github.com/ReproNim/neurodocker
 * [new tag]         2.1.0 -> 2.1.0
 ! [remote rejected] master -> master (protected branch hook declined)
error: failed to push some refs to 'https://github.com/ReproNim/neurodocker'

    at ChildProcess.<anonymous> (/snapshot/auto/packages/core/src/utils/exec-promise.ts:76:23)
    at ChildProcess.emit (node:events:527:28)
    at ChildProcess.emit (node:domain:475:12)
    at Process.ChildProcess._handle.onexit (node:internal/child_process:291:12)Error
    at Object.execPromise (/snapshot/auto/packages/core/src/utils/exec-promise.ts:17:20)
    at /snapshot/auto/plugins/git-tag/dist/index.js:85:26
    at eval (eval at create (/snapshot/auto/node_modules/tapable/lib/HookCodeFactory.js:75:10), <anonymous>:16:17)
    at new Promise (<anonymous>)
    at Hook.eval [as promise] (eval at create (/snapshot/auto/node_modules/tapable/lib/HookCodeFactory.js:75:10), <anonymous>:6:8)
    at Hook.PROMISE_DELEGATE [as _promise] (/snapshot/auto/node_modules/tapable/lib/Hook.js:22:14)
    at Auto.publishFullRelease (/snapshot/auto/packages/core/src/auto.ts:1803:32)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async Auto.shipit (/snapshot/auto/packages/core/src/auto.ts:1664:21)
    at async execute (/snapshot/auto/packages/cli/dist/run.js:71:17)
Error: Process completed with exit code 1.

can consult dandi-cli setup on how we did it , and @CodyCBakerPhD who loves protecting his masters!

I see only

ATM

[CodyCBakerPhD]

FYI @asmacdo and I setup auto-release to work with protected branches on nwb2bids and it has been glorious (even allows auto-merge to function properly now)

It really wasn't that hard to figure out (according to Austin); though our solution has been specifically named the 'nwb2bids-releaser' (replacing the previous yarik gitmate). I've been thinking if we just make a generic one for all repos (e.g., 'con-releaser') we can use it everywhere and the setup for you (or other admins) is as I recall a < 30 second procedure to install the GitHub App

[CodyCBakerPhD]

I'd be happy to set this up for ReproNim / CON orgs but it does look like such things should be done per organization for maximum efficiency

Only thing is we would need temporary permissions to manage GitHub apps for each org https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization

[yarikoptic]

that's where I start to worry a little since this organization is quite "wild" (124 repos) so providing a blanket access to some potentially destructive credentials, bots or operations should be taken with extra consideration. But may be you would dismiss my worries assuring it all would be as safe across all of the ReproNim universe ?

[CodyCBakerPhD]

this organization is quite "wild" (124 repos) so providing a blanket access to some potentially destructive credentials, bots or operations should be taken with extra consideration

I'm not 100% sure what you mean here

As an org admin, under this section you should see these two values

The one I am asking for, temporarily, is

E.g.,

I would then:

1. create the GitHub App named ReproNim-releaser
2. give another admin a couple of secret values that can be set at an organizational level (and thus inherited by all repos; much easier than setting the secrets again and again per repo)

• these secrets allow GitHub to accept the certain types of API requests the bot sends to handle automatic releasing, similar to yarik gitmate, but much more secure
• these secrets are only used when the app is INSTALLED on a repo (it is not able to run anything by default unless you give it permission from outside)

3. the only way to INSTALL the app is to click a couple of buttons when prompted as a repo admin