feat(github): allow release-asset writes for image attachments#829
Draft
sentry-junior[bot] wants to merge 2 commits into
Draft
feat(github): allow release-asset writes for image attachments#829sentry-junior[bot] wants to merge 2 commits into
sentry-junior[bot] wants to merge 2 commits into
Conversation
Adds a scoped installation write grant for GitHub Releases (release create and release-asset upload only; release/asset edit, delete, and asset overwrite stay denied by the default fallthrough) so the github-issues and github-code skills can embed images inline via a shared, append-only _attachments release instead of ephemeral Slack file links. Refs #101 Co-Authored-By: immutable dcramer <david@sentry.io>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a scoped installation write grant for GitHub Releases so
github-issuesandgithub-codecan embed images inline (screenshots, diagrams from a Slack thread) via a shared, append-only_attachmentsrelease instead of ephemeral Slack file links.Technique (source: https://gist.github.com/CatalanCabbage/649aae8f9a7b813776b22340b0f07d05): upload the image as a release asset, then reference the stable
github.com/.../releases/download/...URL as![]()markdown — GitHub serves release assets directly, no camo proxy, no third-party host.What changed:
packages/junior-github/src/index.ts: newgithub.releases-writegrant reason, scoped by the target repo's lease scope (same model as issues/PRs). Only release create (POST /repos/{owner}/{repo}/releases) and release-asset upload (POST uploads.github.com/repos/{owner}/{repo}/releases/{id}/assets, numeric release id) are allowed. Release edit/delete and asset delete/overwrite are intentionally left denied by the default fallthrough — the workflow is append-only by policy, not just convention.uploads.github.comadded to the plugin's egress domain list and credential header-transform list (Bearer auth, same asapi.github.com).github-issuesandgithub-codeskills (notpr-writer, per scope) with the procedure and rules (unique filenames, no--clobber, never delete the shared release, match host repo visibility to audience, never pass files directly togh release createsince that also publishes via a denied PATCH).SETUP.mdnote on the new allowlisted scope.Verified:
pnpm test(vitest): 74/74 passing, including new cases for release-create grant, asset-upload grant (viauploads.github.com), denial of non-numeric release ids, denial of release/asset edit/delete, denial of a spoofed non-uploads host, and cross-repo lease-scope isolation (an upload URL for repo B does not inherit repo A's scope).pnpm run lint(oxlint --deny-warnings): clean.pnpm run typecheck(tsc --noEmit): clean.Known limitations documented in the skill doc:
gh release createmust not be passed files directly (that path additionally PATCHes to publish, which stays denied) — create the release first, then upload separately.--clobber/ asset overwrite is not supported.Refs #101
Requested by immutable dcramer via Junior.
--
View Junior Session in Sentry