gh secret {set,list,remove} #2529

vilmibm · 2020-12-02T00:27:17Z

partially addresses #441

This PR implements gh secret list, gh secret create, and gh secret remove. They support repository secrets by default and organization secrets using the --org flag.

NB: Updating secrets

gh secret set can be used to update secrets. However, this PR merely supports "recreating" the secret: you need to specify a body and visibility and the full repo list for org secrets. I'm putting off adding a more nuanced secret update as a follow up PR since I'm still not convinced we shouldn't have a separate update subcommand.

NB Interactive set

Here's a demo of a working interactive set. I'd like feedback on whether this is useful and worth adding tests/polish for. The code is in 441-secrets-survey.

mislav · 2020-12-04T16:04:02Z

Awesome that this is happening! 👏

Given the size of the PR, I'm doing gh secret update and gh secret delete as follow-up work.

Since our API doesn't have different endpoints for creating vs. updating a secret (it's both done via the same PUT endpoint), would we consider having both as the same command, e.g. gh secret set MY_SECRET? Then followup work for this would not be needed.

vilmibm · 2020-12-04T17:49:51Z

@mislav i'm open to that, when i initially laid out the commands i didn't realize it was just the same endpoint.

vilmibm · 2020-12-04T19:46:25Z

@mislav reusing set for repository secrets is easy enough but for organization secrets one might want to add or remove repositories from a secret with selected visibility. I'd like to think through the UX for that, since it probably means something like:

$ gh secret set a_secret --org --add -r"addedRepo"
# => addedRepo is added to list of repositories allowed to use secret

$ gh secret set a_secret --org --remove -r"removedRepo"
# => removedRepo is removed from list of repositories allowed to use secret

$ gh secret set a_secret --org -r"repo1,repo2"
# => list of allowed repos is set to repo1, repo2

(inspired by usermod -a -G group1)

I'm concerned that's a lot of usage for one command; separate create and update mean we can split out the --add/--remove flags. What do you think?

cc @ampinsk in case you have any opinions

mislav · 2020-12-07T13:02:13Z

but for organization secrets one might want to add or remove repositories from a secret with selected visibility.

I see! That's a very good point. It looks like org secrets also have a single PUT endpoint for create & update operations, but I can see how, in the interest of better usability and increased security, we might want to capture editing the list of repositories as a separate command.

@vilmibm Do you know if it's possible do edit the list of repositories for a secret without also editing its encrypted_value, i.e. just editing its visibility by keeping the current value the same?

pkg/cmd/secret/set/set.go

vilmibm · 2020-12-09T01:20:30Z

current status:

Need to add secret name validation (since it's fairly restricted); will do in this PR
Need to add support for --adding and --removeing repositories from existing org secret; followup PR
Need support for removing secrets; will add to this PR
Spiking out a "wizard" version of secret creation, will be done tomorrow for feedback; will open separate PR (branch is 441-secrets-survey )

vilmibm · 2020-12-09T23:19:33Z

@mislav

Do you know if it's possible do edit the list of repositories for a secret without also editing its encrypted_value, i.e. just editing its visibility by keeping the current value the same?

yes, there are endpoints for just adding/removing/setting the list of repositories for a given org secret without needing to change its value.

mislav

This looks fantastic ✨

The only small gripes I have with the set command is its handling of the values in the -b flag, including filename handling. If possible, I'd like us to talk those over and make adjustments for flexibility and consistency with other commands before shipping. Thank you!

pkg/cmd/secret/list/list.go

pkg/cmd/secret/shared/shared.go

pkg/cmd/secret/set/set.go

pkg/cmd/secret/list/list_test.go

pkg/cmd/secret/set/set.go

also fill in missing test cases >_>

vilmibm · 2020-12-10T23:15:21Z

@mislav @samcoe

This is ready for re-review, though as per

I'd like us to talk those over and make adjustments for flexibility and consistency with other commands before shipping.

I'm curious what y'all think I should be doing there. I see a few options:

keep what is here now. this has the edge cases that a secret can't be taken starting with @
don't support filename input at all, just accept STDIN. Users can redirect a file as needed.
support a flag (like -f) that takes a filename to read a secret from

I vote for the middle option.

Additionally, I'd also like to support accepting a no-echo paste when STDIN is empty and -b isn't specified.

samcoe · 2020-12-11T15:32:34Z

@vilmibm I am 👍 on the second option.

Additionally, I'd also like to support accepting a no-echo paste when STDIN is empty and -b isn't specified.

This may be a stupid question but could you elaborate on what this would look like? Or maybe an example command invocation illustrating what you mean.

vilmibm · 2020-12-11T22:15:15Z

@samcoe something like this:

$ gh secret set a_secret
Paste secret and submit with ctrl+d:

it's functionally the same as doing gh secret set a_secret -b'@-' but the prompt gives the user a hint that it's waiting for input (and how to terminate the input). it's how passwd accepts a new password for a user, for example.

mislav · 2020-12-14T17:22:44Z

it's functionally the same as doing gh secret set a_secret -b'@-' but the prompt gives the user a hint that it's waiting for input (and how to terminate the input).

I'd be super down with this! Bonus points if the input gets printed as *** as the person types, so that the user has some UI feedback that their input is being received. However, if that's nontrivial to do, then a simple noecho could do the job. 💯

vilmibm · 2020-12-14T18:50:30Z

Filename support is out and I'm caught up on all feedback.

I'm saving better secret update experience for org secrets + interactivity for follow-up PRs.

mislav

This all looks and works great! 💯

mislav · 2020-12-15T15:59:24Z

pkg/cmd/secret/set/http.go

+
+	err := client.GraphQL(host, query, nil, &graphqlResult)
+
+	gqlErr, isGqlErr := err.(*api.GraphQLErrorResponse)


Nit: to support wrapped errors, using errors.As() in a conditional might be a better bet here.

mislav · 2020-12-15T16:01:35Z

pkg/cmd/secret/set/set.go

+			$ gh secret set FROM_FLAG  -b"some literal value"
+			$ gh secret set FROM_ENV  -b"${ENV_VALUE}"
+			$ gh secret set FROM_FILE < file.json
+			$ gh secret set ORG_SECRET -bval --org=anOrg --visibility=all
+			$ gh secret set ORG_SECRET -bval --org=anOrg --repos="repo1,repo2,repo3"


These examples are :chef-kiss: ✨

mislav · 2020-12-15T16:03:42Z

pkg/cmd/secret/set/set.go

+	return nil
+}
+
+func validSecretName(name string) error {


Nit: I think we could have gotten away without client-side validation. These rules may change in the future on the platform, and instead of syncing the logic here, we could have allowed any value and let the server decide whether to accept them.

neovivun approved these changes Dec 2, 2020

View reviewed changes

vilmibm changed the title ~~[WIP] gh secret~~ [WIP] secret list/create Dec 3, 2020

implement gh secret create and gh secret list

5309a20

vilmibm force-pushed the 441-secrets branch from 0f8617e to 5309a20 Compare December 5, 2020 00:47

vilmibm changed the title ~~[WIP] secret list/create~~ gh secret create, gh secret list Dec 5, 2020

vilmibm requested review from ampinsk, mislav and samcoe December 5, 2020 00:58

vilmibm marked this pull request as ready for review December 5, 2020 00:58

rename create->set

40c4007

doodlesbykumbi reviewed Dec 8, 2020

View reviewed changes

pkg/cmd/secret/set/set.go Show resolved Hide resolved

billygriffin changed the title ~~gh secret create, gh secret list~~ gh secret set, gh secret list Dec 9, 2020

validate secret name

486aa81

vilmibm changed the title ~~gh secret set, gh secret list~~ gh secret {set,list,remove} Dec 10, 2020

vilmibm added 2 commits December 9, 2020 17:37

add removing secrets

dbff17e

print success messages

2248565

vilmibm force-pushed the 441-secrets branch from bec0fa3 to 2248565 Compare December 10, 2020 01:37

mislav suggested changes Dec 10, 2020

View reviewed changes

This comment was marked as spam.

Sign in to view

samcoe reviewed Dec 10, 2020

View reviewed changes

pkg/cmd/secret/list/list_test.go Outdated Show resolved Hide resolved

pkg/cmd/secret/set/set.go Outdated Show resolved Hide resolved

samcoe reviewed Dec 10, 2020

View reviewed changes

pkg/cmd/secret/set/set.go Outdated Show resolved Hide resolved

vilmibm added 2 commits December 10, 2020 12:36

remove implied org functionality from secret list

c036e66

remove implied org functionality from secret remove

1675bd9

also fill in missing test cases >_>

vilmibm added 5 commits December 10, 2020 13:22

remove implied org functionality from secret set

4e8a680

no space in usage placeholder

408d5c6

show number of selected repositories in secret list

2e6639f

more explicit success message

e1e838c

use type for Visibility

3306351

automatically set vis when just -r passed

a5a043c

mosoemos approved these changes Dec 14, 2020

View reviewed changes

do not process filename arguments

352cde0

vilmibm requested a review from mislav December 14, 2020 18:50

melyalex approved these changes Dec 14, 2020

View reviewed changes

mislav approved these changes Dec 15, 2020

View reviewed changes

vilmibm merged commit 3b1e526 into trunk Dec 15, 2020

mislav deleted the 441-secrets branch December 16, 2020 12:37

This comment was marked as spam.

Sign in to view

This was referenced Aug 2, 2021

Clarify documentation for setting secret value from a file #4038

Closed

Fix unmarshalling GraphQL error type #4087

Merged


		err := client.GraphQL(host, query, nil, &graphqlResult)

		gqlErr, isGqlErr := err.(*api.GraphQLErrorResponse)

gh secret {set,list,remove} #2529

gh secret {set,list,remove} #2529

Uh oh!

Conversation

vilmibm commented Dec 2, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

NB: Updating secrets

NB Interactive set

Uh oh!

mislav commented Dec 4, 2020

Uh oh!

vilmibm commented Dec 4, 2020

Uh oh!

vilmibm commented Dec 4, 2020

Uh oh!

mislav commented Dec 7, 2020

Uh oh!

Uh oh!

vilmibm commented Dec 9, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vilmibm commented Dec 9, 2020

Uh oh!

mislav left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as spam.

This comment was marked as spam.

Uh oh!

Uh oh!

Uh oh!

vilmibm commented Dec 10, 2020

Uh oh!

samcoe commented Dec 11, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vilmibm commented Dec 11, 2020

Uh oh!

mislav commented Dec 14, 2020

Uh oh!

vilmibm commented Dec 14, 2020

Uh oh!

mislav left a comment

Choose a reason for hiding this comment

Uh oh!

mislav Dec 15, 2020

Choose a reason for hiding this comment

Uh oh!

mislav Dec 15, 2020

Choose a reason for hiding this comment

Uh oh!

mislav Dec 15, 2020

Choose a reason for hiding this comment

Uh oh!

This comment was marked as spam.

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

vilmibm commented Dec 2, 2020 •

edited

Loading

vilmibm commented Dec 9, 2020 •

edited

Loading

samcoe commented Dec 11, 2020 •

edited

Loading