fix(budget): make the billing permission opt-in so it degrades instead of dying - #131
Merged
Merged
Conversation
…d of dying Requesting "Organization plan" unconditionally made things worse, not better. create-github-app-token does not degrade when asked for a permission the installation does not hold -- it fails the job. So the watchdog stopped at token minting, before it could report anything, which is strictly worse than running and saying it cannot read billing. The permission is now behind app-has-billing-permission, default false. Set it true only once the App has actually been granted the permission. Until then supply BUDGET_TOKEN, which now takes precedence over an App token that is known not to be able to read billing. Token precedence is therefore: App-with-billing, then BUDGET_TOKEN, then plain App token, then github.token -- most-capable first, so the watchdog uses whatever access it actually has rather than the first thing it finds. Refs #126
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
My previous fix made it worse
#130 requested
permission-organization-plan: readunconditionally. The result:create-github-app-tokendoes not degrade when asked for a permission the installation does not hold — it fails the job. So the watchdog now stopped at token minting, before it could report anything at all. That is strictly worse than running and saying it cannot read billing.Fix
The permission is behind a new
app-has-billing-permissioninput, default false. Set it true only once the App has actually been granted "Organization plan" (read).Token precedence is now most-capable-first:
BUDGET_TOKENdeliberately outranks the plain App token, because that token is known not to be able to read billing.What you need to do to make this actually work
One of:
app-has-billing-permission: trueon the caller. Best end state — no PAT to rotate.BUDGET_TOKENsecret with org billing read access. Works immediately, no App changes.Until one of those happens the watchdog will run, fail loud, and tell you exactly this — which is the correct behaviour, but it is not yet watching anything.
The reusable workflow's own arithmetic was verified against live billing data across all three threshold branches in #128; what is unresolved is purely access.