fix(github): scope App token to triggering repo

Reissue a scoped token in SetClient when no extra scope config is
present. The initial token is created before RepositoryIDs are
populated, so it has access to all repos in the installation. After
ScopeTokenToListOfRepos returns empty, fall back to GetAppToken
which now uses the populated RepositoryIDs.

Signed-off-by: Akshay Pant <akpant@redhat.com>

Author: theakshaypant

pkg/provider/github/github.go

@@ -363,6 +363,17 @@ func (v *Provider) SetClient(ctx context.Context, run *params.Run, event *info.E
 		// If Global and Repo level configurations are not provided then lets not override the provider token.
 		if token != "" {
 			event.Provider.Token = token
+		} else if len(v.RepositoryIDs) > 0 {
+			// We need to keep the token unscoped until ScopeTokenToListOfRepos so that CreateToken can
+			// look up the extra repos from the configmap.
+			// Token is scoped to only the calling repo if no additional scoping repos are configured
+			// so that no unwanted remote tasks are executed.
+			ns := info.GetNS(ctx)
+			scopedToken, err := v.GetAppToken(ctx, run.Clients.Kube, event.Provider.URL, event.InstallationID, ns)
+			if err != nil {
+				return fmt.Errorf("failed to scope token to triggering repository: %w", err)
+			}
+			event.Provider.Token = scopedToken
 		}
 	}
 

pkg/provider/github/parse_payload.go

@@ -131,18 +131,29 @@ type Payload struct {
 	Installation struct {
 		ID *int64 `json:"id"`
 	} `json:"installation"`
+	Repository struct {
+		ID *int64 `json:"id"`
+	} `json:"repository"`
 }
 
-func getInstallationIDFromPayload(payload string) (int64, error) {
+func getInstallationAndRepoIDFromPayload(payload string) (int64, int64, error) {
 	var data Payload
 	err := json.Unmarshal([]byte(payload), &data)
 	if err != nil {
-		return -1, err
+		return -1, -1, err
 	}
+
+	var installationID int64 = -1
+	var repoID int64 = -1
 	if data.Installation.ID != nil {
-		return *data.Installation.ID, nil
+		installationID = *data.Installation.ID
+	}
+
+	if data.Repository.ID != nil {
+		repoID = *data.Repository.ID
 	}
-	return -1, nil
+
+	return installationID, repoID, nil
 }
 
 // ParsePayload will parse the payload and return the event
@@ -177,7 +188,7 @@ func (v *Provider) ParsePayload(ctx context.Context, run *params.Run, request *h
 		return nil, err
 	}
 
-	installationIDFrompayload, err := getInstallationIDFromPayload(payload)
+	installationIDFrompayload, repoIDFromPayload, err := getInstallationAndRepoIDFromPayload(payload)
 	if err != nil {
 		return nil, err
 	}
@@ -189,6 +200,10 @@ func (v *Provider) ParsePayload(ctx context.Context, run *params.Run, request *h
 		}
 	}
 
+	if repoIDFromPayload > 0 {
+		v.RepositoryIDs = []int64{repoIDFromPayload}
+	}
+
 	eventInt, err := github.ParseWebHook(event.EventType, []byte(payload))
 	if err != nil {
 		return nil, err
@@ -537,6 +552,7 @@ func (v *Provider) handleReRequestEvent(ctx context.Context, event *github.Check
 		// fine because you can't do a rereq without being a github owner?
 		runevent.Sender = event.GetSender().GetLogin()
 		v.userType = event.GetSender().GetType()
+		v.RepositoryIDs = []int64{event.GetRepo().GetID()}
 		return runevent, nil
 	}
 	runevent.PullRequestNumber = event.GetCheckRun().GetCheckSuite().PullRequests[0].GetNumber()
@@ -584,6 +600,7 @@ func (v *Provider) handleCheckSuites(ctx context.Context, event *github.CheckSui
 		// fine because you can't do a rereq without being a github owner?
 		runevent.Sender = event.GetSender().GetLogin()
 		v.userType = event.GetSender().GetType()
+		v.RepositoryIDs = []int64{event.GetRepo().GetID()}
 		return runevent, nil
 	}
 	runevent.PullRequestNumber = event.GetCheckSuite().PullRequests[0].GetNumber()
@@ -699,6 +716,7 @@ func (v *Provider) handleCommitCommentEvent(ctx context.Context, event *github.C
 	runevent.BaseURL = runevent.HeadURL
 	runevent.TriggerTarget = triggertype.Push
 	v.userType = event.GetSender().GetType()
+	v.RepositoryIDs = []int64{event.GetRepo().GetID()}
 
 	repo, err := MatchEventURLRepo(ctx, v.Run, runevent, "")
 	if err != nil {