Allow specific users setup to deploy PR on their forks.

[Carreau]

OK, I'm going to try to explain this one. It's hard to explain though, maybe easier to do.

Let's say user send PR-XYZ (branch fix-typo) to canonical/repo
Travis cannot deploy PR-XYZ cause security.
Though if user have travis evable on their fork, then travis could in theory deploy fix-typo built docs to https://user.github.io/repo/fix-typo. Right ? Simple way is to modify travis.yml and doctr config but that's bad for the PR.

Proposal:

• Travis allow through the API to set configuration variable.
• use above API to set a number of predefined variable that basically do the same as configuring doctr but take precedence when set.
• provide a doctr enable-fork to automatically provide building on fork.

It would still have to be opt-in on a per user basis that would have to make that on their fork, but I think that might be useful.

[asmeurer]

From the looks of that API, it doesn't let you do encrypted configuration variables (maybe I missed it).

Assuming that's the case, I don't think it can work. In one place or another, you have to have something be encrypted with the Travis public key, so that no one can see it except for Travis itself. Right now, we do a double encryption: we encrypt the ssh key, to doctr_deploy_key.enc. The key used to encrypt this file is then itself encrypted with the Travis public key, and used as an environment variable. This lets the environment variable not be enormous (the other option would be to encrypt the public key as the environment variable, which I think could work in theory, assuming there aren't size restrictions on environment variables).

However, maybe this is still doable. We don't want users to commit their fork's encrypted ssh keys to the main repo, but they could perhaps commit them to a special branch of their fork. doctr would then checkout that branch when looking for the key. That way, it doesn't have to be merged into the main repo.

By the way, Travis does have a feature that would make this whole thing a lot easier, which is the ability to upload ssh keys directly. Unfortunately, it is only available for private repositories. I've made a feature request for them to add it for all repos here travis-ci/travis-ci#7420.

[Carreau]

From the looks of that API, it doesn't let you do encrypted configuration variables (maybe I missed it).

I've found it. There are some bugs with the GitHub integration though it seem.

However, maybe this is still doable. We don't want users to commit their fork's encrypted ssh keys to the main repo, but they could perhaps commit them to a special branch of their fork. doctr would then checkout that branch when looking for the key. That way, it doesn't have to be merged into the main repo.

It seem like there is not limits, with the current experiment I ran, its just a bit painful to setup for now, and I'll need to rollup my custom base64 encoding wrapper as you need to not join the values of the ssh key with whitespace or newlines.

$ echo $DOCTR_USER_DEPLOY | wc
      1       1    4333

[asmeurer]

Is the feature undocumented or did I just miss the documentation?

[Carreau]

Well it's there in their docs. It's not complete though the example to add/set are missing.

[asmeurer]

But that doesn't mention secure env vars. Does it just detect those automatically?

[Carreau]

Ah! It does, just set public False in the json blob.

…

On Mar 20, 2017 11:45 AM, "Aaron Meurer" ***@***.***> wrote: But that doesn't mention secure env vars. Does it just detect those automatically? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#166 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAUezwiIxqEps0RKb3Qf103mvDE_MM0Aks5rnsk9gaJpZM4Mcvt-> .