Skip to content

Re-add functionality to sync GitHub apps#2255

Open
Kobzol wants to merge 8 commits intorust-lang:mainfrom
Kobzol:install-apps
Open

Re-add functionality to sync GitHub apps#2255
Kobzol wants to merge 8 commits intorust-lang:mainfrom
Kobzol:install-apps

Conversation

@Kobzol
Copy link
Copy Markdown
Member

@Kobzol Kobzol commented Feb 16, 2026

This essentially reverts rust-lang/sync-team#128, plus adapts to code to changes that happened in the meantime.

This is one of the most complicated (and frankly stupid) APIs I had to deal with... It almost seems like they designed each related endpoint to return slightly different data, and require different tokens/permissions/authentication type in order to get all the information that we need.

The following environment variables have to be configured for the dry-run workflow:

  • ENTERPRISE_NAME: just rust-lang
  • ENTERPRISE_APP_ID: app ID of sync-team-app-read (2885328)
  • ENTERPRISE_APP_INSTALLATION_ID: installation ID of sync-team-app-read in the rust-lang enterprise (110701681)
  • ENTERPRISE_APP_SECRET_KEY: secret key of the GH app (not gonna paste that in here :) )

Fixes: #1915

@github-actions
Copy link
Copy Markdown

Dry-run check results

[WARN  sync_team] sync-team is running in dry mode, no changes will be applied.
[INFO  sync_team] synchronizing crates-io
[INFO  sync_team] synchronizing github
[INFO  sync_team] 💻 Repo Diffs:
    📝 Editing repo 'rust-lang/bors':
      Rulesets:
          Ruleset for main
            No changes

@marcoieni
Copy link
Copy Markdown
Member

To recap, we are still using a PAT to deploy, but we are using a GitHub App for the dry run.

I will give read access to the following resources to the sync-team-app github app:

image

@marcoieni marcoieni self-assigned this Feb 16, 2026
@jieyouxu jieyouxu added needs-infra-admin-review This change requires one of the `infra-admins` to review. S-waiting-on-review Status: waiting on review from a team/WG/PG lead, an infra-admin, and/or a team-repo-admin. labels Feb 16, 2026
@marcoieni marcoieni mentioned this pull request Feb 16, 2026
@marcoieni
Copy link
Copy Markdown
Member

marcoieni commented Feb 16, 2026

From the dry run it looks like we are about to remove all apps:
#2257 (comment)

Maybe it's because the token doesn't have enough permission even after enabling those other fields?

@rustbot

This comment has been minimized.

@Kobzol Kobzol marked this pull request as ready for review April 3, 2026 07:21
@marcoieni
Copy link
Copy Markdown
Member

maybe if you update the branch the dry run will run? 🤔

@marcoieni
Copy link
Copy Markdown
Member

But first, can you edit the github actions workflows to add the environments and secrets you mentioned? After, I will set them 👍

@Kobzol
Copy link
Copy Markdown
Member Author

Kobzol commented Apr 3, 2026

The dry run executed, but it failed, because the environment variables weren't set.

@marcoieni
Copy link
Copy Markdown
Member

I think stuff like ENTERPRISE_NAME: rust-lang can be set from the workflow file directly, no? 🤔

@marcoieni
Copy link
Copy Markdown
Member

I set the secret ENTERPRISE_APP_SECRET_KEY. 👍

@marcoieni
Copy link
Copy Markdown
Member

Testing this PR in #2379

@marcoieni
Copy link
Copy Markdown
Member

In #2379 I got the error

Cannot get organization installation for bors-rs of the enterprise app

You should filter orgs that are not part of the rust enterprise.

@marcoieni
Copy link
Copy Markdown
Member

or maybe #2381 is the fix for this 🤔

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs-infra-admin-review This change requires one of the `infra-admins` to review. S-waiting-on-review Status: waiting on review from a team/WG/PG lead, an infra-admin, and/or a team-repo-admin.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Try to install GitHub apps from this repo again

4 participants