RUM-10224: GitHub app migration for PAT by aleksandr-gringauz · Pull Request #2726 · DataDog/dd-sdk-android

aleksandr-gringauz · 2025-06-13T10:13:25Z

What does this PR do?

Migrate from a classical PAT to GitHub app installation token for using GitHub api to create PRs in datadog-android, shopist-android, dd-sdk-android-gradle-plugin.

I tested that it works (although I had to modify gitlab-ci.yaml a bit, these changes are not in the pr):

https://github.com/DataDog/datadog-android/pull/7366
Update Datadog SDK to version 3.12.0 dd-sdk-android-gradle-plugin#382
For shopist I couldn't test, because there we use SNAPSHOT version and our current job (without my changes) actually doesn't do anything.

Here is the app we now use.

RFC link.

Motivation

What inspired you to submit this pull request?

Additional Notes

Anything else we should know when reviewing?

Review checklist (to be filled by reviewers)

Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
Make sure you discussed the feature or bugfix with the maintaining team in an Issue
Make sure each commit and the PR mention the Issue number (cf the CONTRIBUTING doc)

aleksandr-gringauz · 2025-06-13T10:31:43Z

+jwt_token="${header_payload}"."${signature}"
+
+# Fetch installation token
+installation_token=$(curl \


copied this from the docs

aleksandr-gringauz · 2025-06-13T10:32:11Z

+# Copyright 2016-Present Datadog, Inc.
+#
+
+set -o pipefail


copied from the docs

aleksandr-gringauz · 2025-06-13T10:32:54Z

    - 'MESSAGE_TEXT=":status_alert: $CI_PROJECT_NAME $CI_COMMIT_TAG publish pipeline <$BUILD_URL|$COMMIT_MESSAGE> failed."'
    - postmessage "#mobile-sdk-ops" "$MESSAGE_TEXT"

+notify:prepare-github-token:


Created a separate job that creates the installation token so that other jobs can reuse it.

what is the benefit of doing this in a dedicated job and passing secret in env variable to another job (what is discouraged it seems, so we need to put access field) instead of simply doing these steps in every job where installation token is needed?

These steps can be put to the .snippets section and then referenced.

The point is just not to do something multiple times if it can be done only once.

In order to obtain the installation token you need to use github rest api https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app#generating-an-installation-access-token. Now we do it once and reuse the token.

I don't know the specific ratelimit of the endpoint, the docs don't give a direct answer for the one I am using https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api?apiVersion=2022-11-28. Maybe this, but not sure.

For now we use it only during release process. I tried obtaining multiple tokens one after another, it worked.

So ratelimit for now will not be a problem.

If you have concern about security, I can do it the way you suggest.

aleksandr-gringauz · 2025-06-13T10:34:19Z

+    - echo "GITHUB_TOKEN=$(bash ./create_github_installation_token.sh)" >> github.env
+  artifacts:
+    reports:
+      dotenv: github.env


read these docs about the dotenv feature

basically we put environment variables in a special file and they are passed to dependent jobs

aleksandr-gringauz · 2025-06-13T10:36:56Z

+  artifacts:
+    reports:
+      dotenv: github.env
+    access: none


Read:

this

this

I hope this is enough security.

aleksandr-gringauz · 2025-06-13T10:41:45Z

+    - export GITHUB_APP_CLIENT_ID=$(aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.gh_app_client_id --with-decryption --query "Parameter.Value" --out text)
+    - export GITHUB_APP_INSTALLATION_ID=$(aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.gh_app_installation_id --with-decryption --query "Parameter.Value" --out text)


client_id and installation_id aren't actually considered secrets https://datadoghq.atlassian.net/wiki/spaces/ITENG/pages/1014726683/Creating+a+new+Github+App+for+API+Access (see info at the bottom)

but I still decided to put them in aws ssm

codecov-commenter · 2025-06-13T10:43:49Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.83%. Comparing base (04534ae) to head (2632f5f).
⚠️ Report is 1992 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #2726      +/-   ##
===========================================
+ Coverage    69.74%   69.83%   +0.08%     
===========================================
  Files          824      824              
  Lines        30774    30774              
  Branches      5173     5173              
===========================================
+ Hits         21463    21489      +26     
+ Misses        7846     7828      -18     
+ Partials      1465     1457       -8

see 38 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

aleksandr-gringauz · 2025-06-13T10:48:43Z

 def git_clone_repository(repo_name: str, gh_token: str, temp_dir_path: str) -> Tuple[Repo, str]:
    print("Cloning repository " + repo_name)
-    url = "https://" + gh_token + ":x-oauth-basic@github.com/DataDog/" + repo_name
+    url = "https://x-access-token:" + gh_token + "@github.com/DataDog/" + repo_name


copied from the docs

0xnm · 2025-06-13T11:44:17Z

    - 'MESSAGE_TEXT=":status_alert: $CI_PROJECT_NAME $CI_COMMIT_TAG publish pipeline <$BUILD_URL|$COMMIT_MESSAGE> failed."'
    - postmessage "#mobile-sdk-ops" "$MESSAGE_TEXT"

+notify:prepare-github-token:


what is the benefit of doing this in a dedicated job and passing secret in env variable to another job (what is discouraged it seems, so we need to put access field) instead of simply doing these steps in every job where installation token is needed?

These steps can be put to the .snippets section and then referenced.

0xnm · 2025-06-13T11:45:43Z

+  stage: notify
+  when: on_success
+  script:
+    - aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.gh_app_private_key --with-decryption --query "Parameter.Value" --out text >> ./gh_private_key.pem


is it safer to pipe it to the create_github_installation_token.sh instead of creating a file? or it doesn't matter since the runner is destroyed after?

now I pipe the key to create_github_installation_token and then without creating a file straight to openssl link

0xnm

nice!

having another pair of eyes for this PR will be beneficial, given it is handling credentials topic

aleksandr-gringauz force-pushed the aleksandr-gringauz/RUM-10224/github-app-migration-for-pat branch from 9a3acdd to d04bc1c Compare June 13, 2025 10:18

aleksandr-gringauz commented Jun 13, 2025

View reviewed changes

aleksandr-gringauz marked this pull request as ready for review June 13, 2025 10:47

aleksandr-gringauz requested review from a team as code owners June 13, 2025 10:47

aleksandr-gringauz commented Jun 13, 2025

View reviewed changes

0xnm reviewed Jun 13, 2025

View reviewed changes

aleksandr-gringauz added 2 commits June 13, 2025 17:57

RUM-10224: GitHub app migration for PAT

2d2acd4

RUM-10224: pr fixes

2632f5f

aleksandr-gringauz force-pushed the aleksandr-gringauz/RUM-10224/github-app-migration-for-pat branch from 5039790 to 2632f5f Compare June 13, 2025 15:57

aleksandr-gringauz mentioned this pull request Jun 16, 2025

RUM-10224: Introduce check release pipeline #2731

Merged

3 tasks

0xnm approved these changes Jun 16, 2025

View reviewed changes

xgouchet approved these changes Jun 17, 2025

View reviewed changes

aleksandr-gringauz merged commit d5cf727 into develop Jun 17, 2025
25 checks passed

aleksandr-gringauz deleted the aleksandr-gringauz/RUM-10224/github-app-migration-for-pat branch June 17, 2025 08:09

aleksandr-gringauz mentioned this pull request Jun 17, 2025

RUM-10225: Add GitHub app secrets to Vault DataDog/dd-sdk-ios#2342

Merged

4 tasks

		- export GITHUB_APP_CLIENT_ID=$(aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.gh_app_client_id --with-decryption --query "Parameter.Value" --out text)
		- export GITHUB_APP_INSTALLATION_ID=$(aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.gh_app_installation_id --with-decryption --query "Parameter.Value" --out text)

Uh oh!

Conversation

aleksandr-gringauz commented Jun 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Additional Notes

Review checklist (to be filled by reviewers)

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aleksandr-gringauz Jun 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aleksandr-gringauz Jun 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov-commenter commented Jun 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

0xnm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

aleksandr-gringauz commented Jun 13, 2025 •

edited

Loading

aleksandr-gringauz Jun 13, 2025 •

edited

Loading

aleksandr-gringauz Jun 13, 2025 •

edited

Loading

codecov-commenter commented Jun 13, 2025 •

edited

Loading