fix(github): scope App token to triggering repo

Reissue a scoped token in SetClient when no extra scope config is
present. The initial token is created before RepositoryIDs are
populated, so it has access to all repos in the installation. After
ScopeTokenToListOfRepos returns empty, fall back to GetAppToken
which now uses the populated RepositoryIDs.

Signed-off-by: Akshay Pant <akpant@redhat.com>

Author: theakshaypant

pkg/provider/github/github.go

@@ -353,6 +353,17 @@ func (v *Provider) SetClient(ctx context.Context, run *params.Run, event *info.E
 		// If Global and Repo level configurations are not provided then lets not override the provider token.
 		if token != "" {
 			event.Provider.Token = token
+		} else if len(v.RepositoryIDs) > 0 {
+			// We need to keep the token unscoped until ScopeTokenToListOfRepos so that CreateToken can
+			// look up the extra repos from the configmap.
+			// Token is scoped to only the calling repo if no additional scoping repos are configured
+			// so that no unwanted remote tasks are executed.
+			ns := info.GetNS(ctx)
+			scopedToken, err := v.GetAppToken(ctx, run.Clients.Kube, event.Provider.URL, event.InstallationID, ns)
+			if err != nil {
+				return fmt.Errorf("failed to scope token to triggering repository: %w", err)
+			}
+			event.Provider.Token = scopedToken
 		}
 	}
 

pkg/provider/github/parse_payload.go

@@ -131,6 +131,9 @@ type Payload struct {
 	Installation struct {
 		ID *int64 `json:"id"`
 	} `json:"installation"`
+	Repository struct {
+		ID *int64 `json:"id"`
+	} `json:"repository"`
 }
 
 func getInstallationIDFromPayload(payload string) (int64, error) {
@@ -145,6 +148,18 @@ func getInstallationIDFromPayload(payload string) (int64, error) {
 	return -1, nil
 }
 
+func getRepositoryIDFromPayload(payload string) (int64, error) {
+	var data Payload
+	err := json.Unmarshal([]byte(payload), &data)
+	if err != nil {
+		return -1, err
+	}
+	if data.Repository.ID != nil {
+		return *data.Repository.ID, nil
+	}
+	return -1, nil
+}
+
 // ParsePayload will parse the payload and return the event
 // it generate the github app token targeting the installation id
 // this pieces of code is a bit messy because we need first getting a token to
@@ -189,6 +204,14 @@ func (v *Provider) ParsePayload(ctx context.Context, run *params.Run, request *h
 		}
 	}
 
+	repoIDFromPayload, err := getRepositoryIDFromPayload(payload)
+	if err != nil {
+		return nil, err
+	}
+	if repoIDFromPayload > 0 {
+		v.RepositoryIDs = []int64{repoIDFromPayload}
+	}
+
 	eventInt, err := github.ParseWebHook(event.EventType, []byte(payload))
 	if err != nil {
 		return nil, err
@@ -537,6 +560,7 @@ func (v *Provider) handleReRequestEvent(ctx context.Context, event *github.Check
 		// fine because you can't do a rereq without being a github owner?
 		runevent.Sender = event.GetSender().GetLogin()
 		v.userType = event.GetSender().GetType()
+		v.RepositoryIDs = []int64{event.GetRepo().GetID()}
 		return runevent, nil
 	}
 	runevent.PullRequestNumber = event.GetCheckRun().GetCheckSuite().PullRequests[0].GetNumber()
@@ -584,6 +608,7 @@ func (v *Provider) handleCheckSuites(ctx context.Context, event *github.CheckSui
 		// fine because you can't do a rereq without being a github owner?
 		runevent.Sender = event.GetSender().GetLogin()
 		v.userType = event.GetSender().GetType()
+		v.RepositoryIDs = []int64{event.GetRepo().GetID()}
 		return runevent, nil
 	}
 	runevent.PullRequestNumber = event.GetCheckSuite().PullRequests[0].GetNumber()
@@ -707,6 +732,7 @@ func (v *Provider) handleCommitCommentEvent(ctx context.Context, event *github.C
 	runevent.BaseURL = runevent.HeadURL
 	runevent.TriggerTarget = triggertype.Push
 	v.userType = event.GetSender().GetType()
+	v.RepositoryIDs = []int64{event.GetRepo().GetID()}
 
 	repo, err := MatchEventURLRepo(ctx, v.Run, runevent, "")
 	if err != nil {