0

I have a repository which contains deploy keys. I want a workflow job which periodically checks whether any of the deploy keys are reaching their maximum allowed age before they must be rotated. I tried writing a workflow like this, using the GITHUB_TOKEN, but it looks like it doesn't have the necessary privileges. My repository belongs to a GitHub Organization.

name: Check age of repository deploy key

# This workflow is triggered on pushes to the repository.
on:
  push:
  schedule:
    # Runs 06:00 every day
    - cron:  '0 6 */1 * *'

jobs:
  expiry_check:
    env:
      DEPLOY_KEY_METADATA_URL: https://api.github.com/repos/my_org/my_repo/keys
      DEPLOY_KEY_MAX_AGE: 3600*24*365   # 1 year
      

      # This job runs on Linux
    runs-on: ubuntu-latest

    steps:
      # GitHub repository checkout
      - name: GitHub repository checkout
        uses: actions/checkout@v1


      - name: Check if any deploy keys are approaching their expiry data
        run: |
          python3 -c "import requests;import sys;url=sys.argv[1];token=sys.argv[2];r=requests.get(url, headers={'Authorization': f'Bearer {token}'});print(r.text)" $DEPLOY_KEY_METADATA_URL ${{ secrets.GITHUB_TOKEN }}

The response to my API request has this error: {"message":"Resource not accessible by integration","documentation_url":"https://docs.github.com/rest/reference/repos#list-deploy-keys"}

Is there some other solution to this problem, besides personal access tokens and GitHub Apps? The first option is not feasible; business logic can't break when an employee leaves the GitHub Organization. I suppose I could make a GitHub App, but I'd rather avoid that too, if I can. I'm not an admin in my GitHub Organization.

Magnus
  • 589
  • 8
  • 26
  • What type is the {token} (sys.argv[2])? Mabye create another Deploykey to check your deploykeys? They can just check eachother I guess. By the way, why not just curl or use the built-in GitHub Action Octokit client (that is already authenticated!)? https://docs.github.com/en/rest/reference/repos#deploy-keys Octokit: https://github.com/actions/toolkit/tree/main/packages/github – Meiswjn Sep 25 '20 at 07:01
  • I haven't tried the Octokit yet, but my problem isn't that I'm not authenticated - it's that the GITHUB_TOKEN does not have permissions to query a repository's deploy keys. Would Octokit make any difference? About using a deploy key to check deploy keys: is that supported? I haven't found a way to query the GitHub API with anything else than HTTP. – Magnus Sep 28 '20 at 09:05
  • Would creating a `machine user` and using its PAT be a solution for you? For more details on a `machine user` see https://stackoverflow.com/questions/29177623/what-is-a-bot-account-on-github. – riQQ Sep 29 '20 at 22:47
  • From a technical perspective, it would work, but there are business impediments in my corporation related to beaureaucracy, governance and compliance. – Magnus Sep 30 '20 at 12:42

0 Answers0