Adding a new GitHub CI app integration¶
Create a new GitHub app¶
Click the
New GitHub App
button in the lsst-sqre org Developer Settings apps page.Name it
mobu CI (env URL or id if the URL is too long)
.Make sure the
Active
checkbox is checked in theWebhook
section.Enter
https://env URL/mobu/github/ci/webhook
in the Webhook URL input.Generate a strong password to use as the webhook secret.
Store this in the
SQuaRE
vault in theLSST IT
1Password account in anServer
item namedmobu (env URL)
in apassword
field namedmobu-github-ci-app-webhook-secret
.Get this into the Phalanx secret store for that env under the key:
github-ci-app-webhook-secret
(this process is different for different envs).Enter this secret in the Webhook secret (optional) box in the GitHub App config.
Select Checks access category in the Repository Permissions section.
in the dropdown of theSelect Contents access category in the Repository Permissions section.
in the dropdown of theCheck the Check suite and Check run checkboxes in the Subscribe to events section.
Select the Any account radio button in the Where can this GitHub App be installed? section.
Click the Create GitHub App button.
Find the App ID (an integer) in the About section. Get this into the Phalanx secret store for that env under the key:
github-ci-app-id
(this process is different for different envs).Click the Generate a private key button in the Private keys section.
Store this private key in the same
mobu (env URL)
item in atext
key calledgithub-mobu-ci-app-private-key
.Get this into the Phalanx secret store for that env under the key:
github-ci-app-private-key
(this process is different for different envs).
Install the app for a repo¶
Go to new app’s homepage (something like apps/mobu-refresh-usdfdev).
Click the Install button.
Select the Only select repositories radio button.
Select the repo in the dropdown.
Click Install.
Add Phalanx configuration¶
In applications/mobu/values-env.yaml
, add a config.githubCiApp
value:
config:
github:
acceptedGithubOrgs:
- lsst-sqre
users:
- username: "bot-mobu-ci-user-1"
uidnumber: 123
gidnumber: 456
- username: "bot-mobu-ci-user-2"
uidnumber: 789
gidnumber: 876
scopes:
- "exec:notebook"
- "exec:portal"
- "read:image"
- "read:tap"
All items are required.
accepted_github_orgs
A list of GitHub organizations from which this instance of Mobu will accept webhook requests. Webhook requests from any orgs not in this list will get a
403
response.users
Follows the same rules as the
users
list in a flock autostart config. The usernames must all start withbot-mobu
. In envs with Firestore integration, you only need to specifyusername
. In envs without it, you need to ensure that users are manually provisioned, and then you need all three ofusername
,uidnumber
, andgidnumber
.scopes
A list of Gafaelfawr scopes to grant to the users running in the monkeys started from GitHub CI checks.