Repository navigation
Shared credentials #441
Description
As part of work on wiby, I'll need to use a bot account - I do not want to add my personal token to the repo secrets, because there is no way to restrict tokens to a subset of repos.
wiby needs push (only push, not merge) access to the dependent repos (or their forks) to be able to kick off the tests (i.e. the test repos under the wiby-test org). We'll also be able to use that token to kick off the integration tests.
I figure that I should probably not be the only one with access to that bot account - but that leaves us with a problem of sharing credentials.
Any opinions on how to best do this? Would folks trust sops enough to keep the encrypted secrets in a repo? Possibly even a public one? I keep my PGP key on a Yubikey, not sure what everyone else does.
If we can make some decisions here, we can maybe also document some practices for others?
Activity
ljharb commentedon Jan 4, 2021
Seems reasonable to make a bot account in the pkgjs org, and make a token for it?
credentials can be stored in node’s 1Password, and won’t likely be needed anyways beyond initial setup.
mhdawson commentedon Jan 4, 2021
The build wg uses dotgpg to protect secrets but a private repo is used as well.
wesleytodd commentedon Jan 15, 2021
There is an OpenJS Foundation lastpass account as well I think. This would be a great service for the foundation to offer IMO. I seem to remember hearing that another password app had free premium accounts for OSS projects, but I don't remember the name.
mhdawson commentedon Jan 18, 2021
@brianwarner is this something we can use the Foundation lastpass account for?
travi commentedon Jan 19, 2021
this may have been the one that youre thinking of, since 1Password is one of the more popular managers: https://github.com/1Password/1password-teams-open-source
brianwarner commentedon Jan 19, 2021
Yes definitely, find me on slack and we can coordinate on escrowing the credentials. We have LastPass Enterprise, and I can share creds out to anyone who uses the free version.
dominykas commentedon Jan 27, 2021
Are there org level bot accounts available in GH? I thought they only have real user accounts? Which means that it's not just the password that needs to be shared, but it also needs to be associated with an email...
That said, I created the @wiby-bot account (strictly speaking, in violation of GH rules, as they only allow one bot account per person, and I already have one) to unblock myself and we can sort out the details later.
The account is necessary to be able to generate PATs. Adding access in new repos would usually require new tokens (as we shouldn't be keeping them backed up and they're not readable once saved as secrets), which means logging in again, while not frequent, will be necessary.
mhdawson commentedon Feb 9, 2021
For email we can PR into https://github.com/nodejs/email/blob/master/iojs.org/aliases.json a new alias called:
package-maintenance-admin-members for an email.
bjohansebas commentedon Jul 26, 2025
For posterity, the credentials are currently in the Node.js 1Password.