Running Octoherd scripts in the browser

[robvanderleek]

I've create https://repomeister.com, a tool to run Octoherd scripts in the browser.

It's on the GitHub Marketplace and free to use for all personal repositories and public organization repositories. The current version is an "Octoherd" rewrite (I used custom action code before). The code is still hot from the oven so there might be some 🐛 here and there.

Very interested in all your feedback/questions/feature requests! Also tell me if you don't like it or you would never use such a tool.

[gr2m]

This is super cool!

https://github.com/marketplace/repo-meister givest me a 404, I guess it's not approved yet?

It seems that you created an OAuth App? Why not a GitHub App? it would give more control with the installs, with granular per-repository access.

The current version is an "Octoherd" rewrite

what did you need to rewrite?

Very interested in all your feedback/questions/feature requests! Also tell me if you don't like it or you would never use such a tool.

I wanted to create a browser-based runners since the beginning of @octoherd, so that is super cool to see! Do you plan to open source the project? No pressure, just curious.

Besides running the scripts, it would also be nice to provide visualizations for the output logs. Our idea is that in future a script could define a list of "tasks" that it does (such as "check if starred", "star", "unstar") and then log out each time the task is performed. That way the runner can log out a summary at the end. The web runner could show all of the logs with options to filter theme out by level, or using some kind of syntax such as jq. The scripts could even define "reports" which would be a list of filters with their names, such as "total stars/unstars", "total per account", etc

Anyway, there is no lack of ideas 🤣

[robvanderleek]

https://github.com/marketplace/repo-meister givest me a 404, I guess it's not approved yet?
It seems that you created an OAuth App? Why not a GitHub App? it would give more control with the installs, with granular per-repository access.

Oops, I see the Marketplace listing is not published yet.
I created an OAuth App because this is primarily an interactive web app and that seemed the most logical choice to me. Also, the backend is in Java and the OAuth support comes from SpringBoot. Not sure how much work it is to implement the GitHub App flow.

Is the coarse OAuth permission scheme holding you back from installing the tool? I'm thinking about rewriting it to a GitHub App before publishing it (for real) on the Marketplace.

The current version is an "Octoherd" rewrite

what did you need to rewrite?

In the first version all the "actions" were implemented in Java. Then I started thinking about a Python framework to facilitate 3rd party actions and then I bumped into Octoherd 😄 Now all actions are public Octoherd scripts.

I wanted to create a browser-based runners since the beginning of @octoherd, so that is super cool to see! Do you plan to open source the project? No pressure, just curious.

Yes, planning to open source and setup a paid Marketplace plan for private organization repositories. I have some experience with that from developing https://github.com/robvanderleek/create-issue-branch

Besides running the scripts, it would also be nice to provide visualizations for the output logs. Our idea is that in future a script could define a list of "tasks" that it does (such as "check if starred", "star", "unstar") and then log out each time the task is performed. That way the runner can log out a summary at the end. The web runner could show all of the logs with options to filter theme out by level, or using some kind of syntax such as jq. The scripts could even define "reports" which would be a list of filters with their names, such as "total stars/unstars", "total per account", etc

Currently the tool runs an Octoherd script in isolation for a single repo. It shows the console output of that run. You can select multiple repos to run scripts for a larger portfolio in one go.

I spent some time investigating if GitHub Actions could be used to run the scripts (so the scripts run in an isolated environment under the user/org GH account). Unfortunately GH Actions does not really support one-off type of workflows and the GH token in Actions has a very limited scope (it can't be used to admin repo settings).

Anyway, there is no lack of ideas 🤣

Thanks a lot for all the feedback so far 👍

[gr2m]

Not sure how much work it is to implement the GitHub App flow.

GitHub apps also have an OAuth flow. The OAuth flow creates what GitHub is calling "user-to-server Tokens". With these tokens, the app can act on behalf of the authorized user. The advantage to OAuth Apps is that the access is limited to the repositories the app is installed on.

Is the coarse OAuth permission scheme holding you back from installing the tool?

Yes. The OAuth permission would give account-wide read/write access to both public and private repositories, I cannot grant the app these permissions, unfortunately.

Yes, planning to open source and setup a paid Marketplace plan for private organization repositories

sounds like a very good plan :) I will keep you posted should we start working on a website for octoherd, I'm sure there will be an overlap, but I'm also sure there will be plenty of added value your app could provide to distinguish itself.

I spent some time investigating if GitHub Actions could be used to run the scripts (so the scripts run in an isolated environment under the user/org GH account). Unfortunately GH Actions does not really support one-off type of workflows and the GH token in Actions has a very limited scope (it can't be used to admin repo settings).

Actions can pretty do pretty much anything, it all depends on the token is give it. I use GitHub App credentials a lot in Actions to get around the limit of secrets.GITHUB_TOKEN. For example, see https://github.com/gr2m/release-notifier-action

I do want to create an Octoherd action as well at some point, but don't have any plans to work on it anytime soon, it's not a priority.

[robvanderleek]

Not sure how much work it is to implement the GitHub App flow.

GitHub apps also have an OAuth flow. The OAuth flow creates what GitHub is calling "user-to-server Tokens". With these tokens, the app can act on behalf of the authorized user. The advantage to OAuth Apps is that the access is limited to the repositories the app is installed on.

I've rewritten the app from an OAuth integration to a GitHub App: https://repomeister.com/

Due to the diverse nature of Octoherd scripts (they can be used to automate many different things 🤖) I'm still struggling a bit with the permission configuration:
Scripts that modify a repository use the "installation access token" from the App. For repositories I've enabled read-write permissions for Actions, Administration, Checks, Content,, Issues, Pull Requests, Projects and Workflows (and I'm not sure if this list is sufficient for future scripts).
Some scripts modify non-repository things, such as user or organization settings. Those scripts use the "user-to-server tokens".

Is the coarse OAuth permission scheme holding you back from installing the tool?

Yes. The OAuth permission would give account-wide read/write access to both public and private repositories, I cannot grant the app these permissions, unfortunately.

Could you give the GitHub App a try? Of course I understand if you are not interested in beta-testing or simply too busy.

I spent some time investigating if GitHub Actions could be used to run the scripts (so the scripts run in an isolated environment under the user/org GH account). Unfortunately GH Actions does not really support one-off type of workflows and the GH token in Actions has a very limited scope (it can't be used to admin repo settings).

Actions can pretty do pretty much anything, it all depends on the token is give it. I use GitHub App credentials a lot in Actions to get around the limit of secrets.GITHUB_TOKEN. For example, see https://github.com/gr2m/release-notifier-action

I do want to create an Octoherd action as well at some point, but don't have any plans to work on it anytime soon, it's not a priority.

Actions have the benefit that the Octoherd script runs in a safe environment under full control of the user/org. However, I also want to keep a low-complexity user experience. The current workflow is 1. Choose script, 2. Choose repo, 3. Run. Creating an Action workflow or having the user set a PAT is something I would like to avoid (but maybe these steps can be automated, just not sure how).

[oscard0m]

Hey @robvanderleek !

Sorry for arriving late to this discussion. First of all, congratulations and thanks for all the work you have done with this. I love it!

I would like to help you if you think I can add value here. What would you like me to try? Please, let me know :)

---

I will take a look into https://github.com/robvanderleek/create-issue-branch too 😎

[robvanderleek]

Hi @oscard0m 👋

Currently repomeister.com implements the first iteration of a workflow (Choose script, Choose repo, Run) that sounds straightforward to me (n = 1) but I really wonder what both script users and script maintainers think of it.
Since you're also a script maintainer please share your unfiltered feedback if this would be a platform you'd consider using for sharing scripts 🙂

Some things I currently struggle with:

• Will users trust this platform running scripts on their repos?
• GitHub App permission configuration: due to the diverse nature of Octoherd scripts the App needs a lot of read/write permissions
• Should Octoherd scripts run as Actions? (but then how? I want to keep the UX simple)
• Script maintainers can add new scripts in this repo, what do you think of that?

You can also create issues for specific problems you bump into.

Thanks for helping out! Also, feel free to ask questions about the direction of the project (open-sourcing, marketplace, etc.) here or contact me directly (links in bio).

[oscard0m]

Hey @robvanderleek! I had the chance to play a little bit on repomeister.com. I used the Star or unstar script. It worked perfectly!

I see a lot of potential on the platform. Monetizing for private organization repositories is a very interesting model.

Here are my thoughts on your questions:

Will users trust this platform to run scripts on their repos?

In my case, I trust Octoherd scripts because:

1. I can see the code of Octoherd's cli
2. I can see the code of the Octoherd scripts I run.
3. It runs in my terminal so tokens are not exposed to a third-party web/backend I don't control.

With a non-open source web/backend requiring users to authenticate, I'm not sure what will be the adoption. Especially if we take into consideration RepoMeister requires lots of permissions as you pointed out. I think you (we?) should brainstorm a way to make permissions more granular. Maybe with OAuth App using Device Flow?

GitHub App permission configuration: due to the diverse nature of Octoherd scripts the App needs a lot of reading/write permissions

As a user, it would be nice if:

• Requested permissions are per script, this way I know each script how "intrusive" it is and I decide if I want to authenticate to run it or not.
• I can associate a token or a collection of tokens per script (similar to environment variables). This way I can always control the expiry date for each of them, delete them, etc.

Should Octoherd scripts run as Actions? (but then how? I want to keep the UX simple)

I don't know how to do this. Let's open a discussion in Octoherd to talk about it!

Script maintainers can add new scripts in this repo, what do you think of that?

I think it's a good start.

At some point, it could be interesting to auto-maintain this. Octoherd suggests script creators create their scripts under a repo with the label octoherd-script. I think a cron GitHub Action could keep track of this and open the corresponding PR's maintaining octoherd scripts:

• Update an existing script with new parameters
• Remove a non-existing script
• Add a new script

[robvanderleek]

Hi @oscard0m 👋

Sorry for the delay, had a couple of offline days 🏖️
Thanks so much for your time and feedback, please find my follow-ups below.

Will users trust this platform to run scripts on their repos?

With a non-open source web/backend requiring users to authenticate, I'm not sure what will be the adoption. Especially if we take into consideration RepoMeister requires lots of permissions as you pointed out. I think you (we?) should brainstorm a way to make permissions more granular. Maybe with OAuth App using Device Flow?

I'm planning to open source RepoMeister at some point but I don't like the app to require so many permissions either.
As I currently understand Device Flow is mainly for CLI tools? Do you suggest using Device Flow for a more granular authentication mechanism? Based on feedback from @gr2m I switched from an OAuth App to a GitHub App (so at least the repos RepoMeister has access to can be limited) but still a lot of permissions are required in one go. I haven't figured out how to gradually ask for more permissions if needed.

GitHub App permission configuration: due to the diverse nature of Octoherd scripts the App needs a lot of reading/write permissions

• Requested permissions are per script, this way I know each script how "intrusive" it is and I decide if I want to authenticate to run it or not.
• I can associate a token or a collection of tokens per script (similar to environment variables). This way I can always control the expiry date for each of them, delete them, etc.

Regarding permissions per script: I like it a lot, but how? If possible I'd like to stay away from API tokens as I don't want to store them in the platform and want to keep the UX straightforward.

Should Octoherd scripts run as Actions? (but then how? I want to keep the UX simple)

I don't know how to do this. Let's open a discussion in Octoherd to talk about it!

Done! #32

Script maintainers can add new scripts in this repo, what do you think of that?

At some point, it could be interesting to auto-maintain this. Octoherd suggests script creators create their scripts under a repo with the label octoherd-script. I think a cron GitHub Action could keep track of this and open the corresponding PR's maintaining octoherd scripts:

Agree, I think this overlaps with this issue in the awesome Octoherd scripts repo, let's see where that leads 😄

KR, Rob

[oscard0m]

Hi @oscard0m 👋

Sorry for the delay, had a couple of offline days 🏖️ Thanks so much for your time and feedback, please find my follow-ups below.

offline days are great, no need to say sorry :)

I'm planning to open source RepoMeister at some point

👏🏽 🥳

but I don't like the app to require so many permissions either. As I currently understand Device Flow is mainly for CLI tools?

If I'm not wrong, the user needs to insert a code manually: https://docs.github.com/en/developers/apps/building-oauth-apps/authorizing-oauth-apps#step-2-prompt-the-user-to-enter-the-user-code-in-a-browser

Octoherd works like that when you don't provide any token.

Do you suggest using Device Flow for a more granular authentication mechanism?

The cool thing about this is that it's something temporal so each execution will require a new authentication. It's good for security reasons but annoying to users having to authenticate with a device all the time. Maybe offering both options?

Based on feedback from @gr2m I switched from an OAuth App to a GitHub App (so at least the repos RepoMeister has access to can be limited) but still a lot of permissions are required in one go. I haven't figured out how to gradually ask for more permissions if needed.

Since the same app is used to run different scripts (and each script will have its own subset of permissions), I don't know how we could do this).

Regarding permissions per script: I like it a lot, but how? If possible I'd like to stay away from API tokens as I don't want to store them in the platform and want to keep the UX straightforward.

I'm not sure how we could do this 😞