Packagist: Github integration should move away from services

[stof]

Github has officially marked the github services feature as deprecated: https://developer.github.com/changes/2018-04-25-github-services-deprecation/

As of October 2018, it will be impossible to enable it for new repos.
As of January 2019, it will stop working for all repos.

The migration needs to be performed before that time.

[franzliedke]

Out of interest: What is planned here? Will Packagist integrate as a GitHub app?

[stof]

Well, it should probably use a Github app, yeah. But I cannot speak for the actual maintainers.

[Seldaek]

Yes definitely a GitHub app, it's what we have for packagist.com already, but it'll take a few months probably until we get to it. On the other hand it should hopefully simplify the setup of packages in the future so that's good.

[franzliedke]

@Seldaek Is there any way that the community can contribute part of that feature? Any outline?

[Jean85]

Any news here? We're 3 months away from the deadline... Can we at least write down how to use the generic webhook as a substitute?

[odan]

How to migrate my packages to webhooks?

I just found this infos:

URL: https://packagist.org/api/update-package?username=USERNAME&apiToken=API_TOKEN

Content-Type: application/json

Secret: json {"repository":{"url":"PACKAGIST_PACKAGE_URL"}}

Event to trigger the webhook: Push

[stof]

The deprecated service was sending only the push event.

but it would make sense to send also the Branch or tag creation and Branch or tag deletion ones

[Jean85]

Maybe the push event is fired in those cases too? Because otherwise the deprecated service wouldn't have worked up until now...

[WyriHaximus]

The push webhook event: Any Git push to a Repository, including editing tags or branches. Commits via API actions that update references are also counted. This is the default event.

[odan]

Isn't Pushes too much? Wouldn't Releases be enough for packagist?

[jvasseur]

@odan packagist needs to be updated on every push to a branch to keep dev-* aliases up to date.

[Jean85]

Also, any change to composer.json is relevant, aliases are defined there.

[francoispluchino]

The use of the push event is required to update the commit id of branches. However, with this event, you have all the required actions such as adding a tag or branch, or deleting a tag or branch.

So add events Branch or tag creation and Branch or tag deletion is useless, but most importantly, Packagist will receive 2 events for one action (1 event for Push, and 1 event for Branch or tag creation or Branch or tag deletion).

For the Releases event, it is triggered when a release note is published, so, if you create a new tag, without a release note, this event is not dispatched.

So, it is better to keep only the Push event.

[Seldaek]

Please log out and log in again via GitHub to trigger the migration for your account. I'll give it a few weeks/months and then towards the end of the year we probably have to notify anyone that hasn't migrated yet so packages don't stop updating.

[Seldaek]

Also https://packagist.org/about#how-to-update-packages was updated with more detailed instructions for GitHub Hook.

[ankurk91]

Should we delete any webhook that was manually created for packgist?

[Seldaek]

Yes if you set up a web hook by hand please delete it. If you just used the packagist service as we advised to do before then the migration will take care of deleting it when creating the new web hook.

[Jean85]

@Seldaek what should we do for Packagist accounts not linked to a GitHub one? I have this issue with the PHP-FIG (fig) account, which doesn't have a backing GitHub account, since it's not personal but it's an org. I've already authorized the app but I can't force a new update to make the migration happen.

What can I do?

[Seldaek]

@Jean85 I am not sure what's best in that case.. either we allow manually configuring web hooks, or we'd need a dummy "org" account on github with admin permissions so that it can be connected to the packagist account and do the hook setup. Anyone sees another option?

[Jean85]

I do not see an "unlink" option on Packagist, so the dummy account would be "forever"... Not ideal

[Seldaek]

Well by dummy account I don't necessarily mean it should be temporary. There is already a fig account on packagist that's permanent. If it had a github account equivalent with admin permissions that'd solve it. Just need to share credentials to it which isn't super ideal.

[stof]

@Jean85 AFAICT, the PSR packages also have other maintainers than the fig account (or at least some of them, I admit I haven't checked them all). The webhook migration can be performed using any of the packagist maintainers also having admin access on github (it requires a user with admin access on github anyway to setup webhooks)

[Jean85]

There are a few (2) packages that have only fig as a maintainer.

If I add myself to those (I have admin access), since I have already done the migration, does the migration get triggered again?

[Seldaek]

See the about page there's a link to trigger the hook creation again

On Wed, 5 Sep 2018, 18:09 Alessandro Lai [e-mail] wrote:

There are a few (2) packages that have only fig as a maintainer.

If I add myself to those (I have admin access), since I have already done
the migration, does the migration get triggered again?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/composer/packagist/issues/907#issuecomment-418788455,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AALNfmvSZL1HGaY6HTk9CjQxRc7tBBOKks5uX_cvgaJpZM4Txewm
.

[Jean85]

@Seldaek I've (temporarely) added myself and it worked, thanks! I'll remove myself ASAP then :+1:

[magicsunday]

Please update https://packagist.org/about#how-to-update-packages to point out, that you should logout at packagist and relog in with your github account to update the webhooks. I was getting mad, cause it was not working until I got the idea to logout and login.

[Seldaek]

@magicsunday fixed now

[kwebble]

Currently when logging in to Packagist with a Github account it requests admin rights for webhooks and services:

Is it possible to integrate without giving Packagist such high access rights?

[stof]

@Seldaek is this permission needed to set the github app webhook, or only to remove the existing legacy service during the migration ?

[Seldaek]

There are two scopes we could request..

admin:repo_hook | Grants read, write, ping, and delete access to hooks in public or private repositories.
-- | --
write:repo_hook | Grants read, write, and ping access to hooks in public or private repositories.

I picked the first because yes it allows us to clean up the old service, and to be honest the threat model for users isn't much worse than the regular write one anyway. Either way we get write access to hooks and that's where the damage/danger lies, but also the convenience..

[stof]

@Seldaek if we forget the cleanup of old services, do we even need this scope at all ? Aren't github apps getting their own dedicated webhook automatically, without needing to add a webhook on the repo ?

[stof]

hmm, it looks like Packagist actually migrated to an OAuth app, not to a Github App. So the scope is indeed necessary.

[Seldaek]

We didn't really migrate, the GitHub login was always done via that oauth
app. I only added scopes so we could do what's needed.

[crisu83]

Unlinking and relinking my account to GitHub seem to have fixed the auto-update issue for all of my 65 repositories. 👍

[ghost]

What's the secret for the payload URL https://packagist.org/api/github? Packagist seems to use that one (as my repos have been migrated to that webhook), but I've found NO documentation for that endpoint.

[Seldaek]

@CharlotteDunois the secret is.. secret. Either use the method at https://packagist.org/about#how-to-update-packages (GitHub Hook) to let packagist set it up automatically, or you can add a hook yourself following the Manual hook setup instructions. The request body that github sends is compatible.

[voku]

I played the last hour with the auto-setup (github login - logout - reconnect - sync - delete the webhook - repeat ...) but this is not working for all my repositories, what I doing wrong?

-> here a example repo: https://packagist.org/packages/voku/bounce-mail-handler

-> with this message on packagist: "Legacy Auto-Update, Needs Attention"

-> with this response on github: {"status":"error","message":"Invalid credentials"}

PS: composer.phar diagnose shows no errors

[Seldaek]

@voku do you see the hook configured on the settings of https://github.com/voku/PHPMailer-BMH/ ?

[voku]

@Seldaek sorry for the late response ... yep I see the webhook, but I also see the error 403 -> {"status":"error","message":"Invalid credentials"} ... any idea?

[janpecha]

@Seldaek I have same problem with https://packagist.org/packages/inteve/simple-image-storage.