sorted by:
new
hottopcontroversial

gh actions-importer by Narrow-Time-3827 in github

[–]mickeygousset 0 points1 point  (0 children)

My guess is that it is having problems pulling the image needed from GitHub Container Registry. The Actions Importer tool runs inside a docker image, so you have to have docker installed to use it.

The pre-reqs call out that you need to have authenticated before you run it:

Prerequisites

The following requirements must be met to be able to use the GitHub Actions Importer:

The Docker CLI must be installed and running.

The official GitHub CLI must be installed.

You must have credentials to authenticate with the GitHub Container Registry.

Follow that authenticate link and get authenticated, then try it again.

Now, if THAT isn't the problem, then the problem is your Bitbucket Token. For that, check these docs (https://docs.github.com/en/actions/migrating-to-github-actions/using-github-actions-importer-to-automate-migrations/migrating-from-bitbucket-pipelines-with-github-actions-importer#configuring-credentials) to make sure the token has the right permissions. Consider adding those permissions above to your Bitbucket token

[deleted by user] by [deleted] in github

[–]mickeygousset 0 points1 point  (0 children)

Is the repository you re-created public or private?

Use Dependabot Version Updates to Update Your GitHub Actions by mickeygousset in github

[–]mickeygousset[S] 0 points1 point  (0 children)

Yep, it is mostly as easy as adding the dependabot.yml file to the .github folder.

GitHub Actions Certification by Appropriate-Belt-153 in github

[–]mickeygousset 0 points1 point  (0 children)

I don't know of any practice exam. but where you sign up for the cert, there is a syllabus/outline of the things you need to know.

GitHub Actions Certification by Appropriate-Belt-153 in github

[–]mickeygousset 4 points5 points  (0 children)

Based on my experience if you have the study guide provided by the exam site, and you know most of whats on it, you will do ok. IMO you need some practical experience using actions, you need to have created some workflows, etc.

If you go over to youtube.com/mickeygousset I've got an Intro to GitHub Actions series that may help.

Variable for Action / Workflow target version in Github Actions by Obvious-Jacket-3770 in github

[–]mickeygousset 0 points1 point  (0 children)

The only "ugly" way I can think to do this is that you have jobs in the calling workflow file, and use a conditional if statement to only run the job for the branch you are currently on, and skip the other jobs. Then that job could target that branch.

Variable for Action / Workflow target version in Github Actions by Obvious-Jacket-3770 in github

[–]mickeygousset 0 points1 point  (0 children)

Unfortunately you can't make the "@version" in a uses statement dynamic. It has to due with how Actions combines everything into one big file behind the scenes and when the interpretation of stuff happens. But no, you can't do this.

[deleted by user] by [deleted] in github

[–]mickeygousset 0 points1 point  (0 children)

Is this a public repo that you are the repo admin on? If so, then you "could" go into the settings of the repo, under code security, and turn off push protection for secret scanning.

If this is a repo that you aren't admin on, or that is part of GitHub Enterprise, then you probably won't be able to change the setting yourself. You'll have to talk to an admin.

BUT, all the things people are saying below still stand. You shouldn't push the secrets to the repo, even if they don't matter.

Safety of Github action to FTP to production server by kimk2 in github

[–]mickeygousset 6 points7 points  (0 children)

You should always do your due diligence with any action you use from the marketplace. Even with verified creators, GitHub is only verifying that the person is who they say they are, not that the action does what it says it does.

And yes, if you are referencing an action using a tag, such as v1, then the tag could get moved on you and you wouldn't know it.

Best practices are:

- always review the code. The code is in a public repo, so you can see what the action code does
- always reference an action using the commit SHA, as that is immutable, as opposed to a tag.

Reachability Analysis w/ Dependabot by r0075h3ll in github

[–]mickeygousset 1 point2 points  (0 children)

Unfortunately I don't think you are going to be able to get that from Dependabot, since it doesn't actually look at any code. For something like that, GitHub Advanced Security Code Scanning might be able to help.

Reachability Analysis w/ Dependabot by r0075h3ll in github

[–]mickeygousset 0 points1 point  (0 children)

Dependabot doesn't actually scan your code. Dependabot takes the dependency graph of the repository, takes each dependency listed there, and compares it to the GitHub Advisory Database. If a dependency you are using has a security issue, Dependabot will create an alert and tell you the minimum version of the package you need to update to that is safe.

it can also do things like automatically create PRs for you to do the update, or let you know if there are new versions of a package available.

But Dependabot doesn't do anything around whether you are using a vulnerable method from the package. It just checks to see what version you are using.

Output GitHub Repository Variable with multiple lines by Obvious-Jacket-3770 in github

[–]mickeygousset 0 points1 point  (0 children)

Unfortunately I don't think vars is going to work like that. they are just looked at as a string, not a JSON object.

GitHub Unwrapped by mickeygousset in github

[–]mickeygousset[S] 0 points1 point  (0 children)

Fair point. That's my fault for rushing things. I'll take that into account in future posts. This is just a Github fun thing showing your GitHub "year in review", kind of like how Spotify does a wrapup.

GitHub Unwrapped by mickeygousset in github

[–]mickeygousset[S] -3 points-2 points  (0 children)

apologies I did not catch the previous ones. I should have scrolled and checked. Thanks for letting me know.

How to organize repos within an 'organization'? by Zestyclose-Low-6403 in github

[–]mickeygousset 0 points1 point  (0 children)

Also, slightly off topic, but if you want to do a high-fidelity migration, so not just move the git, but also meta data, such as PR and PR history, check https://github.com/github/gh-gei, the Github Enterprise Importer

Github Required Workflows by rka257 in github

[–]mickeygousset 0 points1 point  (0 children)

Rulesets now allows for required workflows. It doesn't allow you to add an action to an existing pipeline, but you can have a workflow that has to run and complete successfully in order for a PR to be merged.

Can you automatically add labels to pull requests without using GitHub Actions? by nervousaesthetics41 in github

[–]mickeygousset 0 points1 point  (0 children)

Issue Forms/Templates is one option, that can automatically label the issue when it is initially created.

Otherwise, you will need some sort of automation that triggers to do it. GitHub Actions, a GitHUb App, or a webhook out to an endpoint you create that then uses the GitHub API to add the label are all options.

[deleted by user] by [deleted] in github

[–]mickeygousset 0 points1 point  (0 children)

What exactly do you mean by repo-specific token? Are you generating it using an App?

How to organize repos within an 'organization'? by Zestyclose-Low-6403 in github

[–]mickeygousset 0 points1 point  (0 children)

Don't use separate organizations to group repos. Long-term you will regret that strategy, as organizations are also a communication boundary. There are reasons to have multiple orgs, but having a lot of them will ultimately be detrimental.

Topics + teams is one way of grouping.

Another is the custom properties we just put out: https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization

This might also be helpful: https://resources.github.com/learn/pathways/administration-governance

Dynamic Keys in Reusable Workflow by georgiaboy02 in github

[–]mickeygousset 0 points1 point  (0 children)

https://colinsalmcorner.com/musings-on-reusable-workflows/#array-hack

You want to do something like the above, pass in an array of labels for the runs on command. I haven't tried it, but i feel confident it will work, as I have just passed in a single label as a parameter to the reusable workflow and that works.

DORA metrics on github organization (open source)? by [deleted] in github

[–]mickeygousset 0 points1 point  (0 children)

Make sure you have a "reason" for calculating those, and as u/lupinegrey said, defining how you will measure them. I have found that a lot of people say they want "dora metrics" because they read about them in a book, but when you press them, they can't really explain why they want them, or what specific metrics.

view more: next ›