Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Investigate to integrate jest-github-reporter #808

Open
pradel opened this issue Sep 19, 2019 · 1 comment
Open

Investigate to integrate jest-github-reporter #808

pradel opened this issue Sep 19, 2019 · 1 comment

Comments

@pradel
Copy link
Member

pradel commented Sep 19, 2019

https://github.com/hipstersmoothie/jest-github-reporter

@ozsay
Copy link
Contributor

ozsay commented Sep 19, 2019

Thanks for opening this issue :)

In order to integrate it into the repo, there is a preparation to make. This app is needed to be installed into the repo.

However, there is a warning with that method. They share the private key used in the checks API.
Taken from their source code:

/**
 * Before you say anything I *know* this is horribly insecure.
 *
 * If we were not to to this then every user would have to create
 * their own GitHub App and manage the APP_ID and PRIVATE_KEY through
 * env vars.
 *
 * How could this go wrong? Well this PRIVATE_KEY only creates jwt
 * tokens that work on people who have installed the Jest Results
 * App. If an attacker got ahold of the token they could only read repo
 * metadata and read/write checks. So the attack surface is really only
 * messing with a users checks, which is not too risky.
 */

We can avoid using this method by creating our own github app as stated here. But it will be beneficial only if we can securely handle env vars in circleci (or github actions).

That being said, I don't mind doing the code changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants