GitHub Community, 17 Aug 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: GitHub Apps to the Rescue!

Description

English language stream with live French translation.
French audio feed: https://github.co/french

Hosted by GitHub’s own Martins Ewere https://www.linkedin.com/in/martins-ae/ and Community co-host and GitHub Star Ruth Ikegah https://stars.github.com/profiles/ruth-ikegah.

Guest speaker: Oluwaseun Ayodeji

A

You I love you, I love your github hats.

A

Welcome welcome welcome everyone. uh My name is martins and I have ruth here with me um the um august edition of our meetup. I will do this every month and I think we'll be doing this for over a year since the pandemic and we're still going strong so definitely welcome. um Today we have a lot of goodies for you, um but before we go just want to do a quick introduction, you might have already met me before, but if not um I'm an account executive here at github.

A

um You know I dabble into investing uh over five years ago. I'm still, I still invest in real estate stocks and uh cryptocurrencies. um So that's pretty much it. If you want to connect with me, uh you can join me on linkedin or twitter. um That's um I don't do a lot of social media, but that's that's where I uh you can connect with me so ruth. Why don't you introduce yourself.

B

Sorry, I also need this: okay hi. Everybody welcome to another gift of virtual meet up, so I'm rudy kager, I'm from nigeria and I'm a technical content manager at animals. Where I do technical writing and I'm a guitar start. So you can see the star there and I'm also an open source advocate. I love getting people involved in open source and you can find me at ikea garu's. I do a lot of tutorials.

B

A

Yeah, that's that's good! That's so great.

B

For you today, by the way.

A

How was your, how was your week, what did you? What did you work on this week? The week is just starting.

B

It's crazy right. I've been doing a lot of uh thought leadership, content at work, so yeah and I've also been seeing a series I've been trying to blend in work and watching movies with facebook. Oh.

A

I'm interested.

B

I'm seeing his series on netflix uh I'm just thinking one episode every day. How about you how's your week been.

A

Yeah, it's been pretty, it's been pretty hectic. uh We just started a new uh fiscal year, get up so there's a lot of meetings, lots of conferences and it's it's a little bit overwhelming sometimes, but I mean it's, it's all good, it's it's tech, so things move quickly, so you have to you have to be open to that.

A

So uh you know. Let us know in in youtube like how you guys are doing in your countries what countries you're from- and um you know, uh also what you guys are up to what projects you're working on. Are you trying to get into tech? Are you just getting started in tech? You know. Just let us know um you know, what's your what's your overall journey um in life and uh we can, we can continue to uh figure out how to support you, and another thing is the overall.

A

I I just saw a message from charlotte.

A

Yeah she gave a really good talk a couple of months ago, so I don't know we'll have to get sharon back at some point.

A

Yeah, so definitely let us know um say hello to us on youtube. I would like to hear from the people that have been regulars here for these meetups, um hopefully in the future, we'll be able to have like a live, live meetup where we actually meet people, but the issue is like africa is so huge like. Where would we have that?

A

B

Think nigeria will be the first one.

A

Yeah, it's it's a huge continent. I think we'll probably like do something in west africa. I don't know, I don't know how it's gonna play out, but um yeah definitely settling guys and um we're just here to support you we're here to support uh the uh open source community people that are trying to get into tech and just make sure that uh you know we we give them a little bit of guidance as you as you move into technology.

A

So that's pretty much it for that. um Really. You want us to go into the agenda now.

B

Yeah sure we can, we can, you know, let them know like what what we have today.

A

Okay, all right, so you might, you might going through what we have today.

B

Yeah sure so, um like we said, we have like a whole lot for you today. We have like a very, very interesting topic, one which I really want to learn about yeah. So um so we will run through github news in like some minutes, and then we have a special guest, sami kiru right and our speaker today. That's not a speaker by the way, um but our speaker, today's dg um he's going to be like taking us through how to use github, apps and you're not getting through github apps.

B

Like I said, I really want to learn how to do that yeah and then we have like a networking session. These also the fun parts to where we you know, network through zoom. You know we discuss like challenges. The speakers also like join us during this networking session and the interesting part is like. We played kahoot's games and you stand chance like win. um You know something. You win um some swag from github, so also after the after the talk is not the end of it.

B

We also have like a networking session where you know you can interact with speakers and you know, share your views and challenges and best practices in tech space. So that's like a pack of the agenda, what we have for you today so yeah. So, uh let's, let's start off with that bit of news.

A

B

You have like something like a drum roll yeah.

A

I wish I could like figure that out.

B

A

I, like some background music like gear music.

B

A

All right, uh you want to take the first one.

B

Yeah sure so um um has like a new sorry give me a second okay. So um we talked about as long as like a new research um project like to you know, understand like the social sector, right um how how much impact you know from you can. You know, participate in this research, so I think the link is up there right, yeah there, so you can participate in. Would love is, like um you know, participate in this research to fill out survey and share your experience with like social impact wherever you are in africa, nigeria.

B

You know kenya, egypt, wherever you're joining in from you can. You know, participate in this survey and let us know like contacts you may have experience. You may have like social impact. So we need your help to move this um project forward so yeah. So you can use the link to assess um solving so yeah. We can also.

C

B

That, in the youtube chat, you know, link in youtube chat soon, better.

A

Perfect, so definitely sign up for that you can. We can hear from you uh as much as possible. So um I know most of you um would have. We've talked about this a few times, but github has done a lot um in the in the devops dev setup space, one resource that I would like to point you guys to is resources.com sorry, resources.

A

devops you'll find an article there. Actually I think you have the article open here.

A

um You will find an article here that talks about some of the recommendations around devops. um You know um you know how to build a devops culture. You know, devops is an intersection of culture uh tooling, and you know change in um developer uh processes.

A

So definitely um definitely take a look at um how to improve your collaboration. Let's say you have a team of two engineers or, with you know, four engineers. Definitely I take a look at that link, resources.com devops, um to learn more um about some of the tools you can employ. Some of the um you know examples of how other people have done, uh devops, either companies or for their projects, and um you know, learn all the different pieces that you would need to be more.

A

um You know, efficient and, and the open of devops is to make people as efficient and as productive in their development processes as possible. So uh definitely take a look at that link to learn more and um the one of the things I would like to point out is you know as far as devops is concerned, you want to, uh you know, have cl access to the cloud um you want to have good security in your practices.

A

You want to make sure that your teammates, you guys, are collaborating properly and you know make sure that all of those pieces uh in your practices, your development practices as you um as you ship code or what you contribute to open source um technologies, um so check this out. And um hopefully you learn a few things from there.

B

Okay, great sure, um apologies. If you had hear like any noise, I have some construction going around me. So apologies you're going to hear any noise, um so um github code spaces um has moved back to you know um before I think it was last year, codespaces was launched right and then you know it was in the was beta assets and I had I think I had access.

B

Then I had access to um volunteering for um grace hopper conference, where we, you know, use code spaces to um help these participants, new participants in open source, get started, and I'm really so excited about. You know having you know: github moving this um code spaces.

B

This feature to you know engineering themes, so um codespace is now available for, like um siemens, enterprise cloud plans on github.com, so basically codespaces allow you like um run um different dev environments without on the cloud without having to do it on your local system, which is like really really good, for you know open source contributions, but for now it's like available to team on enterprise cloud plans, so um you can get there with code spaces, and you know you can read more on the code spaces page on a top docs so to learn how to you know, use that.

A

Perfect yeah. I would just like to share this link here here. This is the code spaces.

B

A

So it's it's pretty cool. You can have a very powerful machine.

B

Yeah and remember contributions like you see: oh yeah,.

D

B

Need to fix one very little thing, because something not really technical, not like. I write c sharp or anything, but it was not some technical. So I I didn't have to like go through the whole stress of building, so many packages or something.

D

Packages and making sure.

A

You have the right pieces, so this is definitely very very key for engineers.

A

So that's great um and one other thing that I wanted to mention is um you know the the ability for people to run git of actions right from termina. This is something that I I tried to learn when I was uh learning how to code a little bit, so you can run your github actions workflow from get up a cli.

A

I think I have the link of get up cli somewhere. Let me see if I can find that this github cli was launched some time ago.

A

So you can basically, um you know, run a lot of github uh centric um actions or events uh through the command line. So you know how you have seminar on, like you know your apple device or um some other devices. Maybe windows windows has a different um terminal.

A

um This is specifically made by github and you can use this for github actions um and um some of the other. uh You know um workflows that you're thinking of you know, building you want to build an app you want to. um You want to contribute um through the terminal.

A

Instead of using a ui interface, you can just use github um cli, so, for instance, for example, when you're writing a commit message in the cli, you can commit using multiple m options and there's a link here that you can use uh github dot, co, slash commits you can commit messages right from the github cli, so definitely check out this link. It's cli, you can download it for your mac. You can also install it for windows, cli.github.com, so check that out.

A

If you haven't already use out, I know we have we're having so many ships I get up like. I can hardly keep up with what we are doing.

A

So it's it's a lot sometimes, but that's one more thing you can check out and all of it all of github technologies are always free for open source. So, if you're doing open source development definitely check that out um all right.

B

Yeah sure so, um github um campus expert applications are open. You know for transcending your applications. We are looking for like the um next generation of community student leaders. While I was in school, I really wasn't the tech person, so I really. I really admire all these kind of applications. You know so, um if you're um in your local school, you can, you know, apply to be top campus expert and the applications close by the end of this month, august 29th.

B

So um if you're um interested in this and a compost expert would at least be like 18 years of age, you know you might be using like to talk for like six months, and you should also be like in the formal um educational institution right, so um the applications close by the end of this month, which is to just two weeks I think, a week, the weekends of days now yeah. So you are interested in this and you know leading you know a github small kit of community in your cookout school.

B

Please apply to be a campus expat and also the link is up here and it should also be shared in youtube chat. So yeah.

A

Yeah- and this is this- is so important. This is one of the ways you can start to make your mark um exactly software community. I think this is something that something got it started while he was in college like he was very involved in all this open source community. He was like a campus expert, and you know today he's like director of um developer community at his company. So definitely a way for you to start getting your your feet wet with you know. You know technology and you know interact with companies into our github.

A

All the companies, like many many tech companies have like campus related and the rest of the the larger organizations so definitely take advantage of all of these opportunities and get upstars. So you know we have a get up star here, ruth. So, um basically, if you don't know what kind of stars are um gear up, stars are expert and technical leaders who passionately share their knowledge online and in person with communities in which they live and work, so nominations are always open at stars.gear.com.

A

So you know it all ties together right if you're, if you're, if you're in campus, if you're still a student um and you you're interested in tech, definitely um make sure you are applying at github.com, try to become a campus expert and that can lead you into contributing to a specific, open source project on github, and you know who knows you can be nominated to become a github star because of your work, uh because if you, if you're trying to get into tech like your github presence, is like your resume uh for for you to get into a technology company.

A

So if you, if you go through this process, you and you become a get up start um you you're, opening more opportunities for yourself in africa and even all around the world. So um let's, let's um go to stars.github.com and I take a look at you know what it takes and you know continue to expand uh your impact.

B

Exactly like um touch upon impact there, you know you basically don't don't be an expert expert. So don't let experts scare you away right. So um it's more of like the impact. You know your impact in the community and brings the impact like quality impact. It's not like how big and how large it is or then like look forward to like quality. You know giving a quality impact in the community and, like martin said, if you're in school, starting from you know, github campus experts program.

B

It's like a very good way to get started and if you're not in school, you know um participating like open source organizations open source projects. You know give you that experience and give you that leverage like impact on the community right. So you can nominate your favorite persons. You know that have also been. You know that you have seen that have created, impacts in you know, developer community. You can nominate them at kickoff, stars and yeah. So that's all the news we have. We have got yeah yeah.

A

All right, so um we have a special guest here and um ruth you want to introduce uh muhammad samuel, hero.

B

Yeah sure so uh we have um a special guest today, um best known as a wow yeah.

A

I professor one.

B

Yeah, I I think this is like the first or second time, I'm saying his name. So ours is a software engineer like he has an interest for web and has a lot of passion for the community like this. A lot of passion like a lot so he's been leading like developer communities over six years and he's part of like the google developer relations team in sub-saharan africa. Where he's you know, focused on supporting the um gdg student club program and you know thank you so much um a while.

B

I'm not going to call you someone, but thanks so much about for you know, honoring our invitation, yeah.

A

Our take it away.

C

Hey, thank you very much. Everyone just a moment.

C

Yeah, okay, hi everyone. um Sorry I didn't know I was speaking early, so I wasn't. I was actually here just to join everyone to attend this question, um like you can see on the screen, you're invited right. um I came here just to speak about the inclusions challenge program. um It's it's usually a competition we have annually.

C

We started in 2019 where we invite students, um just like martin and root mentioned so when, when you're in school, um contributing to open source will be really really important for you in the long run as you try to break into detect industry.

C

um So we try to we're trying to bridge a gap between theoretical computer science concepts, what you learn in school and what is needed in the industry, and I think one other thing that uh one thing that'll really help you is what you've been able to build over time.

C

So if you got um even though we're providing resources for people try to upskill yourself, you also need to be able to uh build stuff show what you've been able to do, and it's all about building stuff like calculators and stuff like this. Yes, these are good things to practice. To do lists and stuff like this yeah um yeah good things to practice, but what is much more important is building solutions and solutions to like real life problem.

C

So we started the solutions challenge program in 2019 to try to bring you um to try to make students right, build solutions to local problems. We're not trying to see build solutions for cancer uh does like something out of the way, but builds local solution to something that affects your community. So we started 2019 and we had a solution that ended up being the best solution. uh Fortunately it was a solution from africa, from a team in uganda and in 2020 uh we zero was selecting 10 people to lead to to.

C

um We realize just selecting one solution doesn't really work right, they're, really really awesome solutions, people build two different solutions, so we decided okay, how about we select top ten, so it selected 10 last year, um and since this is a this is an event that is together at africans. uh So we have two dlcs from africa right, one from ghana, another dlc from um university in zimbabwe, midland state, university and university of education in in kumasi.

C

uh They built different applications. One was to do plagiarism check. The other one was to solve to report emergencies to a relevant authorities in around around the location where the person is reporting. So this year um we started the solutions challenge as usual in january, and we shortlisted the top 50 in march.

C

At the end of march, shuttle is in the top 50 and then we've been um giving them the opportunity to meet people who are more technical than them, give them mentorship and get them to improve on their solution, so they've improved on their solution and then we're at this point whereby uh we have we've selected the top ten and in this top 10 solutions uh or solutions.

C

um We want to give them the opportunity to present to you like, like the global audience, anyone everyone, whoever is interested in looking at the solutions that are built by students. So this is solutions by students to solve local problems in their different locations, and it's happening next week. Basically august 26th, um we have we're having the top 10 winners come and showcase their products show you what they build and also run you through the technologies. They decided to use so it's yes, one of the requirements for them to use one google technology.

C

Another requirement is the product. The project is supposed to be open source right, so it's still uh so that people can be able to see so they're coming to tell us, okay, what technologies they use, not because it's like it's not like okay, you're restricted to build with google technologies. No, we just expect you to at least okay use at least one google technology, but build whatever tool works for you all right, um so they're, coming to showcase.

C

What they build is the technologies they use as well as tell you uh as well as answer you answer any question there you possibly have so the event is going to be streamed straight from um the google developers youtube handle and the uh link is at um you. Could just google search solutions, challenge I'll share the link with martin and martin will probably add it to um to one of the banners in this session. So I hope to see you there.

C

um If you have like you can check out the solutions challenge website for details about the solutions, you can have a great overview of what the solutions are and then probably prepare questions beforehand and then once they're done with their demo, we take.

C

We take questions from the judges as well as from the audience. So I hope I see you next week, martin over to you.

A

Thank you so much uh our that's that's great. I will definitely uh look for that link and share it with the.

A

It's really it's really key for, like I spent like some days just thinking about like what I can do, what solutions I can build for, like um nigeria or africa in general, so it's it's, definitely something that I I intend to attend and see what um students are building like. Maybe I can get some ideas from there. Maybe we can collaborate, so it's it's really good that um I was leading that um initiative to build real solutions for african issues. You know.

B

A

That's that's really awesome um I'll look for the link and I will share that hello, diwali abati.

B

Yeah, I think we should have at the adiwali comeback once again.

A

Yeah, I really I do. I had a pretty pretty good.

A

We should definitely have him back at some point all right. So that's great! Thank you! So much awa, um our next uh speaker, um it's one of our our friends here at getup, uh it's my colleague here I get up um it's uh ulua iud.

A

Is a technical support engineer here at github uh every day you know our engineers here. Have he interacts a lot with developers and you know he loves to have people be a better version of themselves.

A

um Currently is, as I mentioned before, he's a support as part of the getup support team and he's working with developers every day as they interact with github outside of outside of work. He he loves sport, agriculture. I can control uh sure we need to talk about that, because that's something that I'm interested in eventually.

A

So, let's talk about that. uh He likes politics as well, so uh shell will be talking about github apps and how you can use github apps um as much as possible rescue yourself or get a labs so show over to you.

E

Hi everyone um thanks for the introduction, martins and um thanks as well. um You guys have been an amazing host okay. um So today, basically, I would like to talk about um github apps to the rescue, uh but just briefly uh just a few things about me. uh Let me share my screen, maybe to start with.

E

E

Okay, so um yeah I'll be talking about github apps to the rescue. Basically, and um before I go into that, I am a developer support technical support engineer at github, like martin is rightly mentioned. I work with the ecosystem wings of github support. So basically what we do in ecosystem is um we help or we support developers that actually interact with our apis um developers, that probably works with apps, github apps or apps tasks um integrations basically, so there are times whereby, let's say, for example, you are using things like travis c application.

E

You are using sarcosia applications. You are using jenkins integrations with github. You are using slack integrations with github you're using microsoft teams, integration with keto. um There are times whereby you have issues trying to set them up, or there are times wherever you are just trying to make them work as a machine with your code. um So what I do at with github support currently uh is the ecosystem parts, uh which involves all what I've just mentioned.

E

um So just like martin said that yeah I follow sports, I'm manchester united fund and uh after you won on saturday, a good way to start the league right. So um I also follow agriculture. I have a farm basically um and uh currently have like a banana plantation kind of. I also move closely with politics I like to discuss both international and local politics, so um so objective of the objective of today's um topic, basically, is all of these uh I'll be talking about.

E

But what is part which is personal sex talking? um What is what do we call what tokens and what are github tokens? uh There are times where people tend to mistake all of these, or there are times whereby we have some people. We don't know what over token really means. We have people who don't know what github apps to convenient means.

E

um So the essence of this topic- or this conversation today is just to enlighten us about um all of these and I'm briefly again we'll talk about setting up github apps we've just gone through a short demo on how you could set up github apps and then we'll talk about github app token. Those are the tokens generated from github apps. What you could use them for and um what kind of permissions you could give them. um What are the necessary permissions?

E

You could give them and what are the tasks of this quest you could make with those permissions you've given them. um We also look at webhooks. um Okay, when you make those requests. What kind of how does the web of payload looks like he gets um then yeah. So basically, those are all what we'll be talking about today and I will try as much as possible to um be very um to be very explicit and and just walk through all of the steps, slowly so yeah.

E

um Basically um one of the things people get to um have some github one of the things apps on github allows you to do this. It allows you automate and improve your workflow basically, so um there are times whereby people use tokens personalized tokens and they are these. Are they are there that disadvantage of using personas is talking basically because at times, if it gets exposed?

E

uh Maybe um for some reasons um you someone probably handled your system or stuff like that, and um you have access to your personal access token a lot of stuff they can access on your github repository using your personal sex token. So uh it's very important that you use a token. That is that kind of permission you've granted. The token is just enough for the purpose for which you've created the token. So um we all know how uh most of us probably would know how personal assets token works. You know how to probably create them.

E

I I will just quickly run through my github repository just to show you where and how you could create a personal access token. So uh if you have a page like this, for example, you could just go to your settings from your settings. You go to developer on developer, set settings, you go to your personal sex token, and then you could create a token generator token. So yeah, you could generate your token, so I could just give any name to my token, so I'm not creating anyone.

E

um Recently, we give top release a feature whereby um your token could expire. So I think that's also a way by which github wants to help you um keep your um access to github itself save. um So there are times wherever people create talking and they absolutely forget about it. So if I'm creating a token personalized talking today, I can just decide to say: okay. I just want this token to last for seven days. So when I'm done with all I have to do, then the token expires after seven days.

E

So um um these are all schools, for example. The token you want to create, for example, should just only access repositories. uh You could just click on the repositories and the likes, so it's very important personal assist tokens uh are very important recently because we just dedicated um authentication via command line. If you are using your password um now, if you want to also access, um if you are trying to connect to github by command line, you need to use your token instead of the password. I think that happened on the third cent yeah.

E

If I got that correctly yeah. So that's that about past nurses tokens. um um So now we go go to our tokens. Basically, what are poor tokens? All tokens? Are the tokens generated from both apps? So um I, if you, um if you experienced it if you've, noticed this before there are some applications you want to access and then it will tell you login with github.

E

So, for example, I want to access, um let's say: azure app services, for example, or I want to access azure devops and in the process of trying to log into your devops. It tells me log in with keto, in the process of logining with github. That process is called process workflow, whereby um you are logging in to github, with an external identity like from an external provider rather than logging into github from an external provider. So during those process the token is also generated for you. Those kind of tokens are the tokens we call.

E

Those kind of tokens are the tokens we call. Okay, sorry like just trying to zoom in on my screen. So those are those tokens that tokens will call uh what's tokens. Basically, so uh we're not going to debit much into all tokens today, because that's really not the focus, but then one thing about oauth tokens is that it has the same permission as the user themselves.

E

It has the same permission as the user so and it has access to all the organization the user has access to, except those organizations that has blocked third party organizations, there's something we call thought part access restrictions.

E

um I wouldn't try to go for much into that because yeah, it's not really within the scope of this conversation today, um so I've shared some links on okay. I could just um open some of the links I I had on the slide there abouts. How old looks like um just to zoom in so everyone sees so basically, these are how what flows looks like um for old app objects. One thing you can do about that is that you can decide to say: okay, these are the permissions.

E

I want to give my application, so if the user is trying to authorize that cloud application or trying to log in on that particular application, the user is, the application, is requesting certain permission from the user or, if it's let's say, for example, or able to read your repositories or ability to read your emails. The application has access to those permissions.

E

So I would go um into the main topic for today, which is github apps token.

E

So uh why is github apps looking very important and um why is github apps talking coming to the rescue and, of course, when you look at the world rescue, it means that um there's been a punishment somewhere or there's been a suffering somewhere. Let me use the word or there's been a discomfort somewhere using a glass stop and then something is coming in to help you take away those pain, so um developers generally feel the body in like okay.

E

Why would I have to um give full permission to a particular application of giving full permission to all my resources give permission to all my resources for a particular application, just because I want to use uh use them so one of the things github apps will let you do basically that it gives granular permissions like okay. If it's just one repository, I want to access um using the token generated from the github apps token. I can specify that okay, yes, I'm just! I just want to have access to this one repository.

E

If it's two repositories, I can select that if it's all my processes, I can select that so those are some of the importance of github apps taken and we have two different type of github apps taken. Basically, um we have the user to server token and we have the server to server token. I'm going to talk about this uh more um as we proceed uh on this uh in this session. I'm just trying to be to be faster.

E

um So now um this is just like um a table that shows all the difference between all of these tokens. Personal access, token, what acts?

E

Okay, personal access, token, what app access token and github app access token. So for personal access tokens um you could customize your asset scope and permission just like I showed us earlier on where I was creating this I could customize and say: okay, I just want to grant access to people. I can say: okay, I only want to get access to repo and workflow. I can say: okay, I only want to get access to read user uh email stuffs like that and and after I'm done, I generate the token.

E

So what that means is that this is just what the application is, just what the token can do. It can do things that has to do with admin. The token cannot delete a repository, because I didn't give the permission to delete a repository.

E

So um the other is for all app access. Token, just like I mentioned there is no, you don't have control over the scope. So if the user building the old app access token has requested for certain permissions, those are all the permissions that you have to request during the process of authorizing the application.

E

So for both for github app access token, they have granular access, scope and permission. You can decide to say okay, these are what I want this application to do. Okay, I only want this application to have access to this permissions. There are times whereby um it will now begin about.

E

My probably increase of my probably widening the permission for that git of you might decide to ignore those permissions, um while working as supporter about instances whereby, let's say, for example, um jira decided to update or probably uh had his particular feature to to the jiva integration, and then they get an automatic email telling them. Okay, you need to increase.

E

You need to allow some of this permission one of the business right into that, basically because um there might be need for um there is a new feature, for example, and maybe the future requires that the advanced workflow permission, so an automatic email is going to be sent to any of those users that has installed the jbl integration or the jr git of app. So we have questions like. Oh, I don't want to give this permission. So if you don't want to give this permission, some of the things I do are supporting. I try.

E

I try to explain the reason why you have this permission and um and it's okay, if you don't want to accept those permissions, but these are some of the things you can do with github app installation because for old app it's likely to have a choice. The movements you are regenerating the token every permission that has been requested by the user is what the app is going to have access to, so uh asset scope is bound by user permission.

E

That is the second point I have here for old app, that's also true, but for github app. That's not true um self expires. Yes, that's what I showed out there that time for pastner sex token, where you could decide to say okay, I want this seven days. I won't be starting this um for auto uh for old app as well. It can expire um for github app installation as well. It can also expire um generated via api. You cannot generate a personal assist token by api. We have a lot of developers writing and ads.

E

Oh, I want to be able to generate personal access token by api. Currently, this is not possible uh um and for all apps. Yes, you can do that by api for github app access, token, which will be doing today. Yes, you'll, be able to do that by api as well can be revoked on demand for personal access token.

E

We can do that for old apps, looking yes and uh for github app app installation access token. Yes, so do you require installation for personal access? Token? No! You don't require to install make any installation if you want to drive. If you want to create a personal assess token, uh but for what app application you don't need as well for you to do that for all, but what app access token, but for key top app, you need to do an installation um relatively high api date.

E

Limits for personal assistant deviate limit is just 5, 000 requests per power for for old, absolute, yes, the baseline is 500, but then uh there are some calculations that goes to it, that you can end up being 2 500 requests per hour and um same as work with github apps. Talking like okay, the more you have many repositories in your organization, the more you have the number of users in your organizations.

E

The number of api requests you could make to that organization would increase. So that's what that is saying: uh impersonation, yes, for personal assets, talking uh for whatever old, app access. Token! Yes and forget about access token! Yes, so um quickly! Let me move to the next slide, uh which is just like okay, on what we've been saying.

E

um This is just all of them in the picture. So why do I need personalized talking? Why to hide it? What happens is talking, and why do you hide in the github app?

E

So if you're making in the plan or or if the desire is that you want to make an api request, you want to make use of the api you want to make calls to github api, and you want to ask yourself, then you don't really need a github, but if you want to act as the app itself, then that's where github apps comes into play, um so um uh personal assistant are more, are more used to script that are not complex, but if you are looking at developing a complex script, your code is very complex, that uh it's recommended that you use an app token.

E

So um these are just a schematic. All of this can be gotten from the documentation because yeah I interact with the documentation almost every day. So it's so easy for me to take some of this content from there um so um quickly we'll be going into the demo topper just setting up github apps, it's so easy to set up, and uh I'm just going to walk us through all of your steps like okay, how you could set up github apps. Basically, okay, so uh I will get onto that right away.

E

So the first thing you need to do: okay, let me log into my organization. I want to set this up in my organization. I go to my settings page in my organizations.

E

Then I scroll down to developer settings uh on developer settings page you get to see different, get see old apps, you get to see github apps and you get to see publisher verification, the publisher verification. Basically it's when you're trying to publish an application to marketplace.

E

When you go to github marketplace, you see a lot of applications already. That would even help do whatever you want to so. um But in this case we are building our own github apps and we want to generate talking. We want to make a request to github apis using those forward apps.

E

So you click on github apps, here yeah and then you create you, click on create a new hub so for the purpose of this class uh for the focus of this session. Rather I'm just going to name it essay demo, africa little.

E

Right so um for the home page you have you could use. I could use anything, because this is just a test stuff right, um I used should do something. Okay, uh let me just do that I'll hold on on that I go to.

E

um Sweet hi, dot io: this is a channel like creates to track workbook activities, workbook events. So, for example, I have um look it's like a local server whereby any request I make on github. I want to see the request coming to this server if, uh if this, these tracks were payloaded generally, so I can just create this- create a new channel here here and just copy this so I'll be needing this.

E

Okay, just hope you guys all see this, so I'm going back to my app creation session where um there's a parts where I need to add these. My web book url.

E

So my I can hide github.com, yet just pretty much that way, it doesn't have to be.

E

Okay, so sorry and some of the other things I could had, I could have my also the same url here as well.

E

I'll explain why all of this is important as we do detail um later on and um okay, I think that's done, and I'm just going to it's so yeah. So now look at this now um when you scroll to the end of the of the page, you get two options. The first option is you want to install this app. Where can this github have been installed? uh This is just on this account or any account. um This explains the difference between what we say: private github app and public github apps.

E

So if I say I only want to install the app on this account, that means it's a private github. That probably will mean I can't give anyone the access to the hub. I would only be the one to use the hub, and the funny thing about this is that even if you have five different organizations, if you set this- as only on this account, you can install the app windows application as well. You can't install the app on those organizations as well. Sorry about that. So I want to make the app public.

E

I want everybody to be able to access the app and then um there are also some other things you need to look at here. These are all the users permissions. These are repository. Permissions. uh We'll talk a little bit about this um as we progress um in this session, but um there's this part where I just want to show you and it's about metadata.

E

If I don't select metadata view permission, even if I'm installing the application, you would be able to select repositories while installing the application. So it's important for me to select metadata be permission even if, as even for a start yeah. So I can then go back and click on create github, app.

E

Okay, so I'm done creating the github app. um I need to copy out some of this information because they are very important, which is the app id and the client id we're going to need them later. um So I'm just copying I'll be copying them on notepad, so I don't lose track.

E

So the next thing is: oh, this is the public link. So uh if you want to access the application, you could access the application from that link. I'm also going to copy the house. uh He said registration is successful, but I will generate a private key. So I need to create this to generate a private key.

E

Okay, sorry so yeah, so the private key is created already.

E

I would also copy that song. Okay. Okay, let me generate that again.

E

Okay, the private keys created, I'm also going to.

E

I'm also going to copy open that and copy somewhere.

E

E

A

A

E

So the next thing, after creating a private key, is that I have this application already I have it is. I have a repository where I copied um the codes to running the application to generating the code already on github, so I'm just going to copy that here and then um install on my local machine. Basically, so my local machine I'll probably need to increase this, so everyone get to see.

E

Okay, oh, I guess it's too much, alright, so yeah, so um I would open a new file on github just for this class. This demo, rather african metal.

E

You guys this zoom is too much, so let me reach this first and okay.

A

E

Okay, so I'm trying to clone the application to github to my local.

A

Okay, so that's going to navigate to.

E

Okay, so I have the application already.

E

So the next thing I just do here is: uh I create my environment file, dot emv!

E

That's where I'm going to have uh the private key that I copied from github.

E

So, oh yeah, so you recall earlier on that I actually um actually copied out two two um two important details, which is the app id I'm going to replace the app id here.

E

Have id very important so um the other thing again is uh okay, the private key I already defined that in the code. So I'm just going to go back to my environment variable and just set that as well.

E

E

It's also one other thing um which I should not forget to mention it's trying to set up um trying to set up the um web book secret as well, so I'm just going to also define that yeah. But I have not copied that in the code. So I'm just quickly going to go back to the guitar portal.

E

Oh, oh, sorry, okay! So I'm just going to go back to the github portal and try to adjust that.

E

Okay, so what I want to do now is: I want to generate um a web secret right.

E

The moment you get, click on generate a web of security must copy, because if you refresh this page you're going to lose access to it again so um doing that now, so I need to go back to.

E

To my code and then had the secret day, so I haven't done all of these. I think um we are good and then we, this just all of the process in trying to set this up so now, um as a user who is supposed to install the github app, what are the kind of experience you're going to see? um That's what we're going to look at next now, so, okay, I have as a github app, and I have set up my application right and um let's say I haven't talked about. There's another party user.

E

The user wants to install my application in the organization. um They want to generate a token for my own application. So are they going to go about that? So um that's the next step I'm going to share with us now.

E

So I mentioned earlier the link to the link to the hub is this.

E

So this is the page you're going to see okay demo. If you can have it's public, then you want to install the application. When you click on install it gives you the options where you want to install the application. It gives you the option, the different options where you want to install the application.

E

So um what what app will not do is that our tab will just authorize you and it has access to all the organization access to all your resources or your repository, but for github app you get to select okay, I only want the token generated for this particular application.

E

So let's say, for example, I want to do that for this of my application. So I click on this, so you can see here it gave me the option to select all repositories or just a particular repository. I could decide to just select few repositories.

E

So I am choosing these and I can choose. I can choose one more and say um this, so I have given my github apps access to just two reports retreats.

E

So um then, I could decide to install installing this app means that I'm installing the application in this particular organization, which is the teconda github application. So what how do I generate tokens so now that comes to the other part where we start talking about what are.

E

So um we'll start first by generating um what we call server to server token. So, let's go back to our demo. We've completed the first part, which is set not github apps, and that is done. The next part of it is how we could generate user server token and server server token. Basically, so I'm going to go back to our code and.

E

And running the code is spawning the script itself.

E

So when you run this script because the way the way we've configured the code um you're going to generate the gwt, what gwt actually means is json web talking right, you generate the jet or beauty token, and it's from that token, you could use to generate your installation access token so generating the installation. Access token actually means that uh that is the ghs um recently guitar um changed the formats for for authentication tokens.

E

So when it sees things like ghp, it means that it's a gener, uh a person that says token when you sit on something like ghu, that is, that means user to server talking when you say something like ghs. That means server to server token, and I think when you see something like gh overwatch, it's authentication token, and when you see ghr, that means refresh token the meaning of refresh tracking.

E

Basically, is that you could, when you're talking, when your user to server token expires, you could use a refresh token to refresh that again, okay, so um quickly. I need to generate um access token from here. So if you want to generate access token for me, what you need to do is that you need to do that from your json web token.

E

So I'll be copying this with json web token.

E

And then um just.

E

So first, um the first thing I need to do even before generating my personal access token is to be sure to know my installation hiding for every organization I installed this application on. I need to get an id for it.

E

Oh sorry, I was involved just a woman. Please.

E

E

Okay cool so now um I've been able to generate. um This is just like okay. What this particular request means basically, is that I have my json web token and I want to know what installation, what are the information of the installation that json web token is meant for. So that's me calling these scripts and I get to know okay. um This is done on jtag corner organization. That is the organization we actually installed the application on, and uh you could get information about the hub ide.

E

You can get information about the application here and then the uh the target id itself. So these are all information about what that json web token stands for so what I mean basically here is: I need this url, because I need this url to be able to generate my access token. So I'm just going to copy that out.

E

So so the next request I'm going to be making now is to.

E

The base is to generate the access token itself, all of these uh all of this stuff. We have all of these links to getting this done. We have also github documentation the support documentation guide so yeah.

E

This is me generating the github server to server token. You can see it stands with ghs.

E

So we've been able to generate the server to server token. So what are the kind of things you could do with the server to server token? I can know I can call the list of repositories um for this particular installation. I can call the list of um I can make. I can make changes to issues for repositories. I've given access to this installation.

E

I can create labels. I can um there's a whole lot. We can do um with servant server request. We have a documentation as well. That shows us some of the requests we could make while doing the server. Why using the server to server token.

E

Okay, so um the next thing we're just going to do quickly. um I need to register this. I think, I'm way uh beyond time um he's trying to.

E

So I'm going to how to regenerate um the user to server token itself, so we generated the server to server token. You can see it start with ghs. So how do we generate user to server token? So, first before we generate the user to server okay, the first thing we need to do is we need to generate a code for that.

E

So generating the code uh initially, um you could recall earlier on that we had copied the we had copied the um the client id for for the application. So in that client title we copied we're going to use making the request for in generating the code. I think I could quickly get a link to how that can be done.

E

The support the documentation on do we have for that yeah. I think we have that here.

E

Okay, yeah: we have the documentation here.

E

So these are basically this. These are all the the um the requests you could make using the user to server token. We have quite a number of them listed in our public documentation here.

E

So yeah so generating the now that we have now that we have the the client, the the client id we copy that from the github we copy that here and here wrong yeah. We copied that from this place, yeah. So this is the client id we're going to copy that out again.

E

We had that soon.

E

E

So this is the process of creating a user to server token, because we are doing this for the very first time it needs to identify the user. This is the first thing it needs to identify the user who is trying to make the installation, so I can click on authorize the moment. I authorize that if you look at the url here, let me try to expand that.

E

We could see the code that I have here and I need this code for the next request. I'm going to make so I'm going to copy out this code.

E

So I I'm the next request. I'm going to make after copying out this code. Is I'm going to make a call to generate the user to server token itself.

E

So I can reduce it again. I think it's so come to my script.

E

I already have declined secrets here before so I'm going to use this slime secrets.

E

E

So um this is how we could generate the giza to server token. You could see it's looking here, so you could just copy this jesus, our talking house, it start with ghu. So what can you do with this user server token? You can do things like create issues in your repositories. Add labels to issues um delete issues depending on the permissions you've given to the guitar box.

E

It cannot do beyond what you've given access to the app beyond the access you've given to the help, and you could also see a refresh token gate, which is ghr. You can see that's here, so I'm just going to copy this out because we're going to use it next super fun. Some of the um api calls we'll be doing.

E

Okay, so um the first call we'll try to make um for today is trying to make a call to get some reproduces to get the issues.

C

In the repositories.

E

If you could recall, let me come back here.

E

E

If you can remember when we come to when we go to this organization, where this app is installed, um you notice that when you go to your settings, um let me create this page okay and go to your settings, installed, applications and go to install applications, and when you go to demo africa, this application only has access to just two repositories, which are these two repositories.

E

So this is one of those reports we treat so what we want to do now is that we want to get the list of issues in this repositories.

E

That's what the api call we want to make now, using a token that has been that was generated from um using the github app token that was generated from the github app so um quickly. I'm just going to do that right away.

A

E

So here is what my course uh my my call looks like in generating the token and getting the issues list of issues in this organization.

E

So the response from that will only give me the issues in that particular repositories. And if you look at that, um we only found one issue in the organization. One issue in the organization. If we go back to, if we go back to our page.

E

You could also see that we just have just one issue in this organization, so this is me using the github app so now, um how do we deal with things like? Okay? um Are you seeing web books where books events stuffs like that earlier on? You know we created something uh we created this, so this is where you get to see where book event. There are two places. I will show you.

E

um The first is for the app itself when you go to your developer settings and when you go to the github apps, which is the demo the mavic I have when you go to permissions and events.

E

These are where these are, where you could subscribe for events, so if I'm not subscribed, for example, to issues, I won't get uh event about issues. If I don't subscribe to event about um pull requests, for example, I won't get issues about pull requests if I want to subscribe to event. The first thing I need to do is see if those events, the permissions for those events, have been checked so now that I'm dealing with issues, the first thing I need to do is, let's say: give the reader write permissions to issues the next.

E

Oh, if I want to deal with pages as uh pages as well, I click on the, but I'm not dealing with pages today, um let's say, for example, want to give read and write permissions to pro requests. You check that here. um What other things do we need to do? I think that that behold, okay, so giving evidence permissions for images, for example- would deal with things related to.

E

There is a noise. In my background, sorry, let me just quickly deal with that.

E

Sorry about that, there's just some noise in my background, so I had to attend to that. So um these are all of the permissions you could give. So um the other thing you need to know here again is that you need to subscribe for the spanish for those events, so I, if I want to get issues about subscription about event for issues. I click on events.

E

If I want to get for labels, I click on labels as well. If I want to get for pro requests, I click on pro request and when I'm done, I click on save, but it doesn't help you. This is me, as the app owner trying to make changes to my github application, so it is left for an email will be sent to every user that has installed this application in the organization.

E

So if it is an organization, an email will be sent to the openness. If it is personal, um account is going to be sent to the owner of the account.

E

So I don't want to go to my emails, trying to look for them, so I just need to come here and I need to update the permissions I've just done clicking on these now means: okay, an app no, an app owner has made requests for a change for their path for their application.

E

So it is left for me now to accept those new changes that have been made. So I just click on accept new changes.

E

Now that is done, so what can I do with all of this? Now? It now means that I can create issues in those rep in these repositories. It means that I can create proof requests in these repositories. It means that I can read issues in these repositories, just to reproduce repositories so I'll, come into that. Let's test the house.

E

So the first would do is just try to get an issue. Then we create an issue.

E

E

So this is regarding an issue, a particular issue in a repository, not all just a specific issue, which is the one we've created before if you want so what about? If we want to create an issue so now, let's say, for example, I want to create an issue and I also want to add a label to that issue. I've just created.

E

So I can run this request.

E

Let me play this off and then run this request.

E

So that has been done.

E

So I need to go back to my application. The I need to go back to the repository where we are working on, which is this. If I refresh your repository, you can see that we have a new uh issue created so so now the essence or the importance of giza to survive. The kid is that you could see that he's giving it a tag.

E

This is created by demo, africa meetup.

E

Those are the advantages of using github apps, for example, um the signature will be for the application itself, so um that this is us creating uh an issue and then we're adding a little bulk on the issue. um There's another thing we could just quickly try out is creating a label because we're giving the permission for the github we've, given the github update permission to be able to create issues to be able to deal with labels. So let's try and create labels as well.

E

We'll do that quickly as well.

E

E

So yeah we just created um so let's go back to devepro and see again.

E

Okay, it says um demo rescue, that's the name of the label we've created, so let's go if we could find demo rescue on on guitar.

E

So, let's check our levels.

E

Okay, so here is demo rescue which has been, which was created on github as well, so um maybe for the last one we could we could add a label to an already created issue.

E

E

Oh, it says not found so one of the reasons why probably you have answers like this? You see that the token you're using is not correct and yes, the talking we're using is not correct, so it gives us it gives us a fall forever. So when you go to the documentation that you have referenced, you see the list of github errors for each um request you are making. So it gives you an insight as to why the request is failing.

E

So let's try that again, I'm using the corvettes.

E

It could also mean that the token we're using is expired. Actually, so that's one of the reasons why you get a not found error.

E

So if I try that again and I get the same error, then it means it's looking expired. So I'll probably need to generate down that okay, so um github abstracting um doesn't last much it's going to tell you when. So what you could do is um probably just try to create another one using the refresh token. um Just because I want to show how the permission kind of works, so I'm just going to skip that part and go to permissions.

E

Which is the last slide? I have for this course per se for this session. uh I would say so we go to the. There are different ways. You could check your permissions. uh You could check your workbooks. Rather, you could check from the app itself like if I'm the apple. Now I could check from the hub to see. What's going on with, um to see my workbooks delivery, uh you could come here yeah then I go to.

E

Yeah, so all of the events we're creating. I can see that delivery here so for the one that has to deal with label when the label was created. This is the event here. um When you see a response, it means that the server responded saying the request was successful um yeah, so you could go here again and see. uh This is when we open an issue this another one here. This is when we added the label, so these are all of the things you could do or you could see with web books.

E

uh Okay, so the other part you could see again is you could see them yeah. You know I created the server before where I want all my events to be passed so the moment I make any request the payload is sent to this server, which is um this is just like um it's just to catch. My web book delivery for for this, for some of the requests I'm making to these end points, so these are all of that yeah.

E

Okay, so I think um that's pretty much ends this session today, just as a recap um went just trying to the difference. Basically, between um a user token and a server to server token is that for a user token, if, for example, um you install an application in an organization- and you generate a token for the application, a server to server token has access to all these repositories that you've, given access to that particular application for that particular installation.

E

But what it uses to server token will do is that if the user themselves does not have access to those repositories, they won't be able to make requests to those repositories, so the user to server talking is like an intersection.

E

So I create an installation- and I give the installation access to- let's say, for example, taking a procedure one of the members of the organization installed, the application generated the visa to server token, or by default he only has access to just one repository.

E

The user will only be able to make an api request to just that, one repository, so that's just the difference between a user to server token it's about to serve a token.

E

So we've talked about this and I think that ends the session for today. So.

E

Oh someone has come. We have this slide. Yes sure I can share those slides with you um yeah. I think I'm done um goods are you there.

F

I apologize, I think we lost ruth. We might have had some connectivity issues there.

F

Okay, well, thank you so much for showing us everything today and where can we find? This lies from your presentation.

E

Okay, I'm just going to share that. um Can I share that with you and then you'll be sure.

F

Yes, absolutely that will work perfect all right. Well, thank you again for joining us. So much sean and sharing all of your um wonderful insight being a support engineer. I know you definitely know your stuff. So thank you so much. I personally learned a lot all right folks, I think we lost ruth. um We might have some connectivity issues and I know martin's had some connectivity issues himself. So thank you for hanging with us today.

F

uh Remember you can always connect to us uh via twitter. I do have community and then, if you would like to be a presenter in this event, don't forget to join us uh for the call for proposals at github.com for slash cfp and now, if you're, still here, you're an absolute hero and um come to the zoom join us for some networking, um I'm going to attempt to share my screen now. So thank you, sean are you coming to the zoom to answer some questions?

F

Yeah awesome all right! Well, um let me share my screen so that folks can see how where to join us, so we are going to be live on github.com forward, slash africa, capital, a that africa and yeah. We got some games, we got some swag codes and, of course, uh we'll have sean joining us to answer any questions.

F

uh We can share the link to your slides, then yeah yeah all right, see you folks on soon. Thank you again appreciate your patience with us today, as we navigated technical difficulties, but you've been awesome, see you soon.