Granting access to github-bot server to github bot admins

[joyeecheung]

Today the github bot stopped working possibly because the access token of the bot got revoked. It is not able to access the GitHub v3 API right now. To fix that we'll need to generate a new token and configure it on the server, but the server is in the infra group so we'll need someone from infra to do that, but no one from infra is around.

I propose we add a new SSH key to the github-bot server and make it accessible to all github bot admins. The server is not used for release or any critical service so it should be safe to do so.

[Trott]

@rvagg

[richardlau]

@nodejs/collaborators AIUI until this is fixed the status of CI runs is not being reported to the PR's so you will need to manually check the status of the runs instead of relying on the PR's check status.

[refack]

Two security related questions that came to mind.

1. Who revoked the token (you could check in https://github.com/settings/security)
2. Is the bot's account behind 2FA?

[joyeecheung]

@refack The token was destroyed at 2018-06-16 05:42:15 +0800 by someone from Asker, Akershus, Norway (Safari on OS X 10.13.5). The bot account is behind 2FA.

[joyeecheung]

Hmm, wait, looks like it's not deleted, but leaked and deleted automatically by github? I matched the action with the login to identify #1353 (comment), but I noticed the action is named:

oauth_authorization.destroy: Personal access token (Bot Node.js infra deploy) deleted automatically (found in a public repository)

I googled the message and it looks like a security feature of github.

[phillipj]

.. by someone from Asker, Akershus, Norway

That's my location.

I logged into the bot account yesterday to accept #1341. I've recently got a new phone, so I had to setup Authy to be able to log in to the bot's account, I used the 2FA credentials found in the secrets repo. I didn't change the 2FA settings GitHub's side.

Could that be related? 🤷‍♀️

[ryzokuken]

I hope it was somehow triggered by @phillipj trying to log in from a new device and revoked the token as a security measure and the credentials of the bot weren't somehow leaked into the open...

[refack]

I hope it was somehow triggered by phillipj trying to log in from a new device and revoked the token as a security measure and the credentials of the bot weren't somehow leaked into the open...

That's what's nice about tokens, they can be revoked, then they are useless.

[joyeecheung]

@ryzokuken I don't think that's related, otherwise the other token for docker-node should be revoked as well. The action oauth_authorization.destroy has token_scan as explanation and explicitly says found in a public repository. It seems GitHub has a security measure to scan public repos for tokens and automatically revoke the ones leaked. The login from Norway should be irrelevant, it just happened to be on that day when GitHub found the token.

[ryzokuken]

@refack we can all sleep a bit better now that it's revoked, true, but still the reason how it was leaked in the first place remains.

[joyeecheung]

@phillipj Can you check the email inbox of the bot and see if there are any notifications from github about the token scan?

[phillipj]

@joyeecheung great suggestion, I didn't think of that.

I found a recent email to that points to this specific commit: https://github.com/maclover7/github-bot/blob/6a1f749e78fbf182d4a764e54758b5c4cbdad339/testteam.js