Slide 1

Slide 1 text

Integrations Keavy McMinn // Engineer b keavy

Slide 2

Slide 2 text

“Who opens PRs?”

Slide 3

Slide 3 text

repo GET /repos/:owner/:repo/pulls

Slide 4

Slide 4 text

repo Grants read/write access to code, commit statuses, repository invitations, collaborators, and deployment statuses

Slide 5

Slide 5 text

repo Grants read/write access to code, commit statuses, repository invitations, collaborators, and deployment statuses for public and private repositories

Slide 6

Slide 6 text

repo Grants read/write access to code, commit statuses, repository invitations, collaborators, and deployment statuses for public and private repositories and organizations.

Slide 7

Slide 7 text

No content

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

┌────┐ ┌─────────────────┐ ┌────────┐ │User│ │ Integrator │ │ GitHub │ └──┬─┘ └────────┬────────┘ └────┬───┘ │ │ │ │ User visits Integrator site │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ │ Authorize Integrator with OAuth │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ Integrator receives and stores │ │ OAuth access token for user │ │ │ ⾢ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ │ │ │ │ │ │ List accessible orgs for user │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ List accessible repos for user │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ Display list of repos to user │ │ │ ⾢ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ │ │ │ │ │ │ User selects repos to build │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ Set up hooks, create keys for │ selected repos │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ │ │

Slide 10

Slide 10 text

No content

Slide 11

Slide 11 text

No content

Slide 12

Slide 12 text

No content

Slide 13

Slide 13 text

Uh. Where’s CI?

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

“We need this level of access because GitHub…”

Slide 16

Slide 16 text

“Type a quote here.”

Slide 17

Slide 17 text

I’ve got 99 problems, and they’re all OAuth

Slide 18

Slide 18 text

Scopes

Slide 19

Slide 19 text

Outside-in flow

Slide 20

Slide 20 text

Install flow efficiency

Slide 21

Slide 21 text

No Connection between an org and a service

Slide 22

Slide 22 text

Multiple accounts

Slide 23

Slide 23 text

Multiple accounts

Slide 24

Slide 24 text

No content

Slide 25

Slide 25 text

No content

Slide 26

Slide 26 text

“If we were building integrations from scratch, knowing what we know now... what would we do differently?” b jasonrudolph

Slide 27

Slide 27 text

No content

Slide 28

Slide 28 text

Integrations Early Access

Slide 29

Slide 29 text

No content

Slide 30

Slide 30 text

Users

Slide 31

Slide 31 text

No content

Slide 32

Slide 32 text

No content

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

No content

Slide 35

Slide 35 text

No content

Slide 36

Slide 36 text

Integrator

Slide 37

Slide 37 text

No content

Slide 38

Slide 38 text

No content

Slide 39

Slide 39 text

No content

Slide 40

Slide 40 text

No content

Slide 41

Slide 41 text

No content

Slide 42

Slide 42 text

No content

Slide 43

Slide 43 text

No content

Slide 44

Slide 44 text

Thorny areas

Slide 45

Slide 45 text

Checking permissions

Slide 46

Slide 46 text

Checking permissions

Slide 47

Slide 47 text

Checking permissions

Slide 48

Slide 48 text

Checking permissions

Slide 49

Slide 49 text

# A user with push access to commit status role :status_writer do |context| ... user && repo.pushable_by?(user) end Checking permissions

Slide 50

Slide 50 text

# A user with push access to commit status role :status_writer do |context| ... user && (repo.pushable_by?(user) || repo.statuses.writeable_by?(user)) end Checking permissions

Slide 51

Slide 51 text

# A user with push access to commit status role :status_writer do |context| ... user && repo.resources.statuses.writeable_by?(user) end Checking permissions

Slide 52

Slide 52 text

Identity flow

Slide 53

Slide 53 text

" # $ Identity flow

Slide 54

Slide 54 text

Identity flow " # $

Slide 55

Slide 55 text

OAuth Possible solutions:

Slide 56

Slide 56 text

Possible solutions: Single Sign-On

Slide 57

Slide 57 text

OAuth-like flow

Slide 58

Slide 58 text

No content

Slide 59

Slide 59 text

Led by UX

Slide 60

Slide 60 text

No content

Slide 61

Slide 61 text

No content

Slide 62

Slide 62 text

No content

Slide 63

Slide 63 text

Trust

Slide 64

Slide 64 text

No content

Slide 65

Slide 65 text

No content

Slide 66

Slide 66 text

Alternatives now

Slide 67

Slide 67 text

repo Grants read/write access to code, commit statuses, repository invitations, collaborators, and deployment statuses for public and private repositories and organizations.

Slide 68

Slide 68 text

No content

Slide 69

Slide 69 text

No content

Slide 70

Slide 70 text

┌────┐ ┌─────────────────┐ ┌────────┐ │User│ │ Integrator │ │ GitHub │ └──┬─┘ └────────┬────────┘ └────┬───┘ │ │ │ │ User visits Integrator site │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ │ Authorize Integrator with OAuth │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ Integrator receives and stores │ │ OAuth access token for user │ │ │ ⾢ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ │ │ │ │ │ │ List accessible orgs for user │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ List accessible repos for user │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ Display list of repos to user │ │ │ ⾢ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ │ │ │ │ │ │ User selects repos to build │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │ │ Set up hooks, create keys for │ selected repos │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ▶ │ │ │

Slide 71

Slide 71 text

┌────┐ ┌─────────────────┐ ┌────────┐ │User│ │ Integrator │ │ GitHub │ └──┬─┘ └────────┬────────┘ └────┬───┘ │ │ │ │ User visits integration page │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┼ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─▶ │ │ User installs integration on selected repos │ │ │ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─▶ │ │ │ Integrator receives webhook event │ │ of new installation │ │ │ ⾢ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ │ │ │ │ │ │ │

Slide 72

Slide 72 text

No content

Slide 73

Slide 73 text

Octokit::Client.new( :access_token => installation_access_token )

Slide 74

Slide 74 text

Take action independently of a specific user Allow users to install on an organization Allow users to install on a per repository basis Want granular permissions When to use an Integration?

Slide 75

Slide 75 text

Code Scanners Continuous Integration Continuous Deployment Issue Management Anything else you can dream up! What might you use an integration for?

Slide 76

Slide 76 text

Take action only as a specific user Full access is desired Using GitHub as an identity provider When to use an OAuth application?

Slide 77

Slide 77 text

Installations Early Access

Slide 78

Slide 78 text

Learn more developer.github.com platform.github.community % &

Slide 79

Slide 79 text

b keavy b jch b tarebyte b jmilas b kdaigle b pifafu b cmwinters b tclem b jasonrudolph b jdpace b pengwynn b ptoomey3 b janester

Slide 80

Slide 80 text

Thank you