Branch Protection: die unterschätzte Sicherheitskontrolle in GitHub
Die meisten Sicherheitsdiskussionen drehen sich um Tools: Scanner, Secrets-Vaults, Signaturen. Eine der wirksamsten Kontrollen kostet nichts und ist in jedem GitHub-Repository schon eingebaut. Branch Protection. Sie entscheidet, wer Code in den Hauptzweig bringt und unter welchen Bedingungen. Trotzdem läuft sie in vielen Teams ungenutzt oder halb konfiguriert mit.
Was Branch Protection…
This is my face after creating a pull request for the branch I've been working on for the last month. Today I worked 13 hours and the PR was created at 03.47.
I am tired, I need to shower and my eyes hurt, but today was a good day, today I did my best.
Screwdriver now supports commenting on pull requests through Screwdriver build meta. This feature allows users to add custom data such as coverage results to the Git pull request.
Screwdriver Users
To add a comment to a pull request build, Screwdriver users can configure their screwdriver.yaml with steps as shown below:
jobs: main: steps: - postdeploy: | meta set meta.summary.coverage "Coverage increased by 15%" meta set meta.summary.markdown "this markdown comment is **bold** and *italic*"
These commands will result in a comment in Git that will look something like:
Cluster Admins
In order to enable meta PR comments, you’ll need to create a bot user in Git with a personal access token with the public_repo scope. In Github, create a new user. Follow instructions to create a personal access token, set the scope as public_repo. Copy this token and set it as commentUserToken in your scms settings in your API config yaml.
You need this headless user for commenting since Github requires public_repo scope in order to comment on pull requests (https://github.community/t5/How-to-use-Git-and-GitHub/Why-does-GitHub-API-require-admin-rights-to-leave-a-comment-on-a/td-p/357). For more information about Github scope, see https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps.
Compatibility List
In order to use the new meta PR comments feature, you will need these minimum versions:
API:v0.5.545
Contributors
Thanks to the following people for making this feature possible:
tkyi
Screwdriver is an open-source build automation platform designed for Continuous Delivery. It is built (and used) by Yahoo. Don’t hesitate to reach out if you have questions or would like to contribute: http://docs.screwdriver.cd/about/support.