Running Octoherd scripts using GitHub Actions

[robvanderleek]

Hi all 👋

Together with @oscard0m I'm exploring options to run Octoherd scripts using the GitHub Actions infrastructure.
Benefits of using GitHub Actions for Octoherd scripts that I can think of:

• Transparency, other members of the team can see who ran what, when
• No need for API tokens, Actions receive a secrets.GITHUB_TOKEN
• Scalable and fast, scripts can run in parallel on the scalable Actions infrastructure

So far I came up with a generic workflow file that can be parameterised to run different scripts.
There are quite some quirks with this approach (that I can further detail if necessary) but for now I would really like some unfiltered feedback or suggestions for alternative solutions 🙂

[gr2m]

No need for API tokens, Actions receive a secrets.GITHUB_TOKEN

just note that secrets.GITHUB_TOKEN is scoped to only the current repository, so you won't be able to run it across an org, for example. It's simple enough to work around it though

I would really like some unfiltered feedback or suggestions for alternative solutions 🙂

Great timing :) We just talked about CI in the context of octoherd/cli#66 (/cc @stefanbuck), more specifically about the need for a flag to disable interactive mode for CI environments. Similar to --octoherd-bypass-confirms, but for all interactive questions. I know other CLI apps that have an interactive mode but can also be run headlessly have similar flags

I really like the generic action idea. I wonder if you could pass ${{ toJson(github.event.inputs) }} as a generic way to pass all workflow inputs as an option, then users could define whatever options they need and pass it to the action?

[robvanderleek]

just note that secrets.GITHUB_TOKEN is scoped to only the current repository, so you won't be able to run it across an org, for example. It's simple enough to work around it though

Yes, I find it comforting that the scope is only the current repository in which the workflow runs 🙂 but I understand there are scripts that modify settings outside the repo scope. Perhaps the generic workflow should support an optional PAT and use secrets.GITHUB_TOKEN as a fallback 🤔

I really like the generic action idea. I wonder if you could pass ${{ toJson(github.event.inputs) }} as a generic way to pass all workflow inputs as an option, then users could define whatever options they need and pass it to the action?

Thanks, script and script_options do the trick for now but launching the workflow using the GH CLI is very user-unfriendly.

[stefanbuck]

Another way of handling this use-case could be a combination of GitHub Issue with Issue Forms and GitHub Actions. The Issue Form gives you a structured input, which then can be parsed by the github-issue-parser Action. That way a script run can be triggered by simply filling an issue which then kicks off the GitHub Action. Because such runs are just issues, you can leverage the filter and search functionality of issues and even get notified via the repository notification settings.

[robvanderleek]

Interesting idea!

I'll see if I can create an Issue-driven workflow.

BTW I'm maintaining a GitHub App that is activated through issues or via a "ChatOps" command in issue comments. Currently I'm exploring alternatives for the UX of https://repomeister.com

[robvanderleek]

Hi @stefanbuck / @gr2m 👋

I've created an issue-driven setup for running Octoherd scripts on a repo.

Both the workflow dispatch and issue workflows also support a PAT for extra permissions and use secrets.GITHUB_TOKEN as a fallback.

Thanks for your suggestions, again interested in your feedback of course.

[oscard0m]

Very interesting the approach of triggering options with Issues. I use to run octoherd for a batch of repositories so for the moment this use case does not work for me.

What about a dispatched event that goes to all the repositories of the org? All the repos with an Octoherd GitHub Action would run in their own context 😎