Integrations

Transcript

1. Integrations Keavy McMinn // Engineer b keavy
2. “Who opens PRs?”
3. repo GET /repos/:owner/:repo/pulls
4. repo Grants read/write access to code, commit statuses, repository invitations, collaborators, and deployment statuses
5. repo Grants read/write access to code, commit statuses, repository invitations, collaborators, and deployment statuses for public and private repositories
6. repo Grants read/write access to code, commit statuses, repository invitations, collaborators, and deployment statuses for public and private repositories and organizations.
9. ┌────┐ ┌─────────────────┐ ┌────────┐ │User│ │ Integrator │ │ GitHub │ └──┬─┘ └────────┬────────┘ └────┬───┘ │ │ │ │ User visits Integrator site │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ │ Authorize Integrator with OAuth │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ Integrator receives and stores │ │ OAuth access token for user │ │ │ ⾢ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ │ │ │ │ │ │ List accessible orgs for user │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ List accessible repos for user │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ Display list of repos to user │ │ │ ⾢ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ │ │ │ │ │ │ User selects repos to build │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ Set up hooks, create keys for │ selected repos │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ │ │
13. Uh. Where’s CI?
15. “We need this level of access because GitHub…”
16. “Type a quote here.”
17. I’ve got 99 problems, and they’re all OAuth
18. Scopes
19. Outside-in flow
20. Install flow efficiency
21. No Connection between an org and a service
22. Multiple accounts
23. Multiple accounts
26. “If we were building integrations from scratch, knowing what we know now... what would we do differently?” b jasonrudolph
28. Integrations Early Access
30. Users
36. Integrator
44. Thorny areas
45. Checking permissions
46. Checking permissions
47. Checking permissions
48. Checking permissions
49. # A user with push access to commit status role :status_writer do |context| ... user && repo.pushable_by?(user) end Checking permissions
50. # A user with push access to commit status role :status_writer do |context| ... user && (repo.pushable_by?(user) || repo.statuses.writeable_by?(user)) end Checking permissions
51. # A user with push access to commit status role :status_writer do |context| ... user && repo.resources.statuses.writeable_by?(user) end Checking permissions
52. Identity flow
53. " # $ Identity flow
54. Identity flow " # $
55. OAuth Possible solutions:
56. Possible solutions: Single Sign-On
57. OAuth-like flow
59. Led by UX
63. Trust
66. Alternatives now
67. repo Grants read/write access to code, commit statuses, repository invitations, collaborators, and deployment statuses for public and private repositories and organizations.
70. ┌────┐ ┌─────────────────┐ ┌────────┐ │User│ │ Integrator │ │ GitHub │ └──┬─┘ └────────┬────────┘ └────┬───┘ │ │ │ │ User visits Integrator site │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ │ Authorize Integrator with OAuth │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ Integrator receives and stores │ │ OAuth access token for user │ │ │ ⾢ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ │ │ │ │ │ │ List accessible orgs for user │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ List accessible repos for user │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ Display list of repos to user │ │ │ ⾢ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ │ │ │ │ │ │ User selects repos to build │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ Set up hooks, create keys for │ selected repos │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │
71. ┌────┐ ┌─────────────────┐ ┌────────┐ │User│ │ Integrator │ │ GitHub │ └──┬─┘ └────────┬────────┘ └────┬───┘ │ │ │ │ User visits integration page │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┼ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─▶ │ │ User installs integration on selected repos │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─▶ │ │ │ Integrator receives webhook event │ │ of new installation │ │ │ ⾢ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ │ │ │ │ │ │ │
73. Octokit::Client.new( :access_token => installation_access_token )
74. Take action independently of a specific user Allow users to install on an organization Allow users to install on a per repository basis Want granular permissions When to use an Integration?
75. Code Scanners Continuous Integration Continuous Deployment Issue Management Anything else you can dream up! What might you use an integration for?
76. Take action only as a specific user Full access is desired Using GitHub as an identity provider When to use an OAuth application?
77. Installations Early Access
78. Learn more developer.github.com platform.github.community % &
79. b keavy b jch b tarebyte b jmilas b kdaigle b pifafu b cmwinters b tclem b jasonrudolph b jdpace b pengwynn b ptoomey3 b janester
80. Thank you