Skip to content

add LSIF indexing & uploading to Sourcegraph workflow #341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

add LSIF indexing & uploading to Sourcegraph workflow #341

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions .github/workflows/lsif.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
name: Sourcegraph LSIF
on:
push:
pull_request:
jobs:
lsif:
runs-on: ubuntu-latest
name: "Upload LSIF"
steps:
- uses: actions/checkout@v2
- uses: coursier/cache-action@v6.3
- uses: coursier/setup-action@v1.1.2
with:
jvm: adopt:11
apps: lsif-java
- name: Generate LSIF
run: lsif-java index
- name: Upload LSIF data
uses: sourcegraph/lsif-upload-action@master
with:
endpoint: https://sourcegraph.com
github_token: ${{ secrets.GITHUB_TOKEN }}
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this need any special authorization, e.g. some OAuth app that needs to be registered, or does it work out-of-the-box?

Also are there potential security implications to using the GitHub token (which e.g. also permits write access) here? Maybe it might be a good idea to limit the permissions here to only include those needed.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This value should work by making a new developer access token and adding it to the secrets of your repo/org. You shouldn't need to perform any additional flow after that.

We need repo scope of personal access tokens so that we can read the ones attached to your profile. Here is the point in Sourcegraph server code that actually queries GitHub on your behalf if you'd like to see how it's actually used. I'm not sure if a lower scope would allow us the same permissions (and if so we'd definitely recommend using that instead).

In the future we may also expand our user permissions model so that authenticating directly with the code host will become unnecessary (though I don't have a timeline to give you at this point).

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the note. GitHub Actions allows quite fine-grained scoping for the implicit GITHUB_TOKEN inside Actions (see here and here), which I would prefer to a personal access token. What would be the minimal set of permissions needed here (ideally only some subset of read permissions)?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to these docs, I believe read access on repository-projects would be sufficient.

file: dump.lsif