[almighty] Almighty Build Service and Private repositories

[Aslak Knutsen]

Out current target is OpenShift Build Pipeline that is running in our
environment under our control, so I think we can consider that a 1.
Party(?).

But the question still stands when we come down to 3. Party integrations.

-aslak-

On Fri, Oct 28, 2016 at 10:32 AM, Tomas Nozicka <tnozicka at redhat.com> wrote:

> > Does upload of key not imply you have granted Almighty system account
> > 100% access to
> > your GitHub settings ?
> I would assume Almighty have privileges to do so, through scoped OAuth
> probably (so not the whole account), or we can instruct user that this
> is the public key, please set it as a deploy key for repository and
> here is a doc about how you do it.
>
> Point was that this is done by Almighty Build Service and the
> (possibly) 3rd party provider gets only the private key with read-only
> permissions for specific repository, not an access to whole github.
>
> >
> > That might be a permission we only want to ask for temporarily if GitHub
> > even
> > allow such access.
> Sure, if possible.
> There is probably a scope for this (bellow) call, hopefully under
> repository management.
>   https://developer.github.com/v3/repos/keys/#add-a-new-deploy-key
>
> >
> > /max
> > http://about.me/maxandersen
>
> _______________________________________________
> almighty-public mailing list
> almighty-public at redhat.com
> https://www.redhat.com/mailman/listinfo/almighty-public
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/almighty-public/attachments/20161028/0b6e2234/attachment.htm>