TriAgentLoop Kanban Bot
A Discord bot that manages a GitHub project board, and checks twice whether you are allowed to touch it.
A bot with write access to someone else's board is a permissions problem in a Discord costume. It checks whether you are allowed when you open the form, and again when it actually writes, because roles can change in between.
Facts
- Signs in to GitHub as an app with short-lived keys, so nobody's personal access token is sitting in a config file
- Checks whether you are allowed when you open the form, and again at the moment it writes
- Pressing submit twice quickly still creates only one issue
- Posts a summary of recent commits to a channel, grouped by type, without needing anything opened up to the internet
- Its first run posts a short summary rather than dumping the whole history of the repository into the channel
- The private key is encrypted where it is stored, using nothing beyond what Node already ships with
Stack
- Node.js
- discord.js
- GitHub Apps
- GraphQL
This lives inside TriAgentLoop, which is why it shares that repository rather than having one of its own.
The part worth pointing at is that the form is filled in from the live project rather than from configuration, and that being allowed to open the form does not mean you are allowed to finish it. The check runs again before the issue is created, because the seconds between opening a form and submitting it are enough for someone’s access to change.