An organization may want to store their vouch file org-wide in something like a .github repository. We should support the ability for manage and check to point to an out-of-repo vouch file. I'm not 100% sure what this looks like from a flag perspective yet. Check will definitely be easier than manage.
These changes are only for the GitHub integration, since the library functions only operate on local files and that's fine.
Activity
3
mitchellh8mo agore.
design-needed, Is the point to keep it (the external vouch file) contained (i.e. ensure from w/i same user/org), or flexible (i.e. if you cancurlit you can use it)?
Up to the user, I don't care. There could be reasons they want it private (maybe law, maybe their own personal shame, etc. lol). It isn't my job to judge. This is a policy framework and they put together their own policies. I'm personally not a fan of private block lists of any form but I don't think we can really block it while building this without making a policy opinion and I'm really against the idea of making policy opinions in this repo. As the README notes, "why/how/what" is up to the project that integrates, not us.
0xdsqr8mo agoI’m new to nu (ha), and this repos proved to be fun to read. My general thoughts were this, if you want to pin ball? Happy to give it a shot, if design suffices.
Check (gh-check-pr). --vouched-repo flag. If set, fetch the vouch file from that repo's Contents API instead of the PR's repo. I think this should be as simple as a single API change.
Manage. The Nu script already writes to a local file with save -f, and the action's second step does git add/commit/push. We could?
- Clone
--vouched-repointo a temp dir before the Nu step runs - Point
--vouched-fileat the file in that checkout - Commit/push to the external repo instead of the current one
I think this may also require a pat or app token? And, yes I do realize the contributing guide says I should “ Open an issue describing what you want to change and why.”, but this seems like it might be a valid path. Maybe I’ll open an issue for that 🙃.
re.
design-needed, Is the point to keep it (the external vouch file) contained (i.e. ensure from w/i same user/org), or flexible (i.e. if you cancurlit you can use it)?