Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

j-rewerts
Copy link
Member

It appears GitHub requires accounts emails to be verified, which was causing our test suite to fail. I've added a new user that we have better control over. I also decided to use a personal access token, rather than exposing the password.

I'm hoping to switch our dev workflow to be more secure. In the past, we exposed our test user credentials publicly. A secure workflow could be:

  1. External collaborator submits a PR. No tests run.
  2. A project maintainer reviews PR for obvious security issues, or attempts to log environment variables.
  3. If 2. is good, merge PR into branch new branch off of master. This triggers a TravisCI build.
  4. If Travis is good, review just like we did previously.

This is extra work for sure, but it will allow us to have a secure CI user while also accepting community contributions.

@j-rewerts
Copy link
Member Author

The PR tests are from earlier, before I removed them. The push tests passed.

@j-rewerts j-rewerts merged commit 1ba01ed into master Jun 17, 2019
@j-rewerts j-rewerts deleted the fix-tests branch June 17, 2019 20:19
@CodyGramlich
Copy link
Contributor

@j-rewerts Won't contributors want to be able to run the tests and possibly make changes to the tests?

@j-rewerts
Copy link
Member Author

Yeah so this change means contributors will need to request a private access token, or set up their own test account for running the tests with. I'll add something to the readme.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants