Skip to content

Add migration page for GitHub App #12112

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Apr 21, 2025
Merged

Add migration page for GitHub App #12112

merged 9 commits into from
Apr 21, 2025

Conversation

stsewd
Copy link
Member

@stsewd stsewd commented Apr 15, 2025

Can be tested together with readthedocs/ext-theme#570, there is a video there showing the workflow.

What this does is groups all repositories the user has linked to a project, and works over that. The actions the user takes are as follows:

  • Connect its account to our new GH app, we validate that the new account matches the account from the old integration.
  • Install our app into the organization/users that the user has repositories imported from. Users that are part of projects where they don't have access to the repository owner/organization, can omit those, so the proper owner can migrate those, or in the case of organizations, they can request for an admin to approve the installation.
  • Users can migrate their projects to the new GitHub app only if the app is installed in the proper repository, and if they have admin access to the repository.
  • The migration basically consists of removing the old webhooks/ssh keys from the repo as they are no longer needed, and after that changing the remote repository to the one from the GH app.
  • After all that is done, the next step is to revoke access to our old OAuth app, the user must do this, as we can't do that on behalf of the user. This step is recommended but not necessary required (we do make it required in our migration page, so we aren't responsible for lingering accounts).
  • The final step is basically disconnecting the old GH OAuth app from the social accounts of the user, once that is done, we no longer can migrate the project on behalf of the user (or at least the part about removing the ssh key and webhook), connecting the project to the new remote repository can still be done, but users can also do that.

Extracted from #11942

@stsewd
Copy link
Member Author

stsewd commented Apr 15, 2025

This still depends on things from readthedocs/ext-theme#570, but hopefully most of the code would stay the same, so marking it ready for review. We should be able to safely deploy this, as we still require for only admin users to connect their accounts to the new GH app.

@stsewd stsewd marked this pull request as ready for review April 15, 2025 20:02
@stsewd stsewd requested a review from a team as a code owner April 15, 2025 20:02
@stsewd stsewd requested a review from humitos April 15, 2025 20:02

If we didn't find any webhook to delete, we return True.
"""
owner, repo = build_utils.get_github_username_repo(url=project.repo)
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Most of our services work over the repo of the project instead of the remote repository attached to it... so I'm doing that for this, but all things from the GH app always depend on the remote repo.

@stsewd stsewd changed the title Add migration for GitHub App Add migration page for GitHub App Apr 16, 2025
Copy link
Member

@humitos humitos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I took a quick look at this and I think it's 👍🏼 . I didn't review it in-depth, but I think we will need to make some adjustments as we go to cover a few edge cases.

Comment on lines +408 to +416
Notification.objects.add(
message_id=MESSAGE_OAUTH_WEBHOOK_NOT_REMOVED,
attached_to=request.user,
dismissable=True,
format_values={
"repo_full_name": project.remote_repository.full_name,
"project_slug": project.slug,
},
)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This may flood the user with a lot of notifications if we are not able to remove the webhook from their projects.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The same happens with the following notification.

Let's say the user has 10 projects connected and we are not able to remove ssh/webhook. In that case, the user will receive 20 notifications.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, my other idea was to show these in the migration page like a list, but them we will need to maintain another UI and db models

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

but hopefully users won't be experiencing this problem as the other checks should prevent this to happen (like checking if the user is admin of the repo, so the user should be able to delete webhooks and keys)

Comment on lines 438 to 443
f"{settings.PUBLIC_API_URL}/api/v2/webhook/{project.slug}/",
f"{settings.PUBLIC_API_URL}/api/v2/webhook/github/{project.slug}/",
]
if "app." in settings.PUBLIC_API_URL:
hook_targets.append(hook_targets[0].replace("app.", "", 1))
hook_targets.append(hook_targets[1].replace("app.", "", 1))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why we don't hardcode the URLs here instead of doing this magic 😄

Suggested change
f"{settings.PUBLIC_API_URL}/api/v2/webhook/{project.slug}/",
f"{settings.PUBLIC_API_URL}/api/v2/webhook/github/{project.slug}/",
]
if "app." in settings.PUBLIC_API_URL:
hook_targets.append(hook_targets[0].replace("app.", "", 1))
hook_targets.append(hook_targets[1].replace("app.", "", 1))
hook_targets = [
f"https://readthedocs.org/api/v2/webhook/{project.slug}/",
f"https://readthedocs.org//api/v2/webhook/github/{project.slug}/",
f"https://app.readthedocs.org/api/v2/webhook/{project.slug}/",
f"https://app.readthedocs.org/api/v2/webhook/github/{project.slug}/",
]

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The URL is different for .com

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, I guess this can skip checking for "app." and always generate the 4 type of URLs since all of our processes are running with the new dashboard now

stsewd added a commit to readthedocs/ext-theme that referenced this pull request Apr 21, 2025
While this still requires
readthedocs/readthedocs.org#12112, I think it
should be safe to review, as the UI shouldn't change much. ~~I still
need to finishe a couple of things: make all strings translable, and
check for users with multiple GH accounts connected~~.

- Step by step guide to connect your account to the new GH app, and also
to migrate projects.
- Partial support for users with more than one GH account linked (they
just need to repeat the migration twice), we don't have a lot of users
with more than one account connected, so this should be fine.
- Automatically refresh the page once the GH tab has been closed, this
should work for most cases, but it won't work if the user doesn't close
the page, or if the page refreshes before our application was able to
sync the repos. We still show a message about refreshing the page, so.


https://github.com/user-attachments/assets/a836dfaf-4f30-41ca-a84b-8a669c838aef

---------

Co-authored-by: Anthony <[email protected]>
@stsewd stsewd merged commit 95bbf66 into main Apr 21, 2025
5 of 6 checks passed
@stsewd stsewd deleted the add-migration-for-gh-app branch April 21, 2025 17:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants