Add the ability to pass the credentialsId in the publishChecks step

[v1v]

Feature Request

Add the credentialsId argument to the publishChecks step (https://github.com/jenkinsci/checks-api-plugin#pipeline-usage). Then, it will be possible to use this feature explicitly in Jenkins jobs without changing the Job definition.

Why

IIUC, the only way to use this particular step is only when the GitHub App has been enabled in the Job level since GitHub checks are enabled on a GH App but no service accounts.

Further details

https://plugins.jenkins.io/pipeline-githubnotify-step/ enables to set a credentialsId instead using the one in the Job definition.

[KalleOlaviNiemitalo]

@v1v, do you mean you'd register a GitHub App and add a GitHub App credential to Jenkins, but make the job in Jenkins use a different credential for accessing the repository? According to Getting started with the Checks API, "Write permission for the Checks API is only available to GitHub Apps", so I don't think GitHub would let the publishChecks step use the same credentials as with Pipeline GitHub Notify Step.

[v1v]

@v1v, do you mean you'd register a GitHub App and add a GitHub App credential to Jenkins, but make the job in Jenkins use a different credential for accessing the repository?

Exactly. Support an explicit GitHub App credentialsId in Jenkins for the step in addition to the existing functionality with the implicit credentials in the Job as it's is now

[KalleOlaviNiemitalo]

Alternatively or additionally, a credentialsId parameter could be added to withChecks. That would let steps like junit publish checks with a credential that is not defined in the job. Passing this information through would require changes in dependent plugins, but the API could be designed so as to allow more contextual information to be added in the future (#74 (comment)).

Perhaps a directive in options could work too, if you don't need multiple Checks API credentials during the same run and can hardcode the credential ID or choose it before any steps have run.

[XiongKezhi]

A credentialsId parameter can be added to the publishChecks step. However, I'm still confused why would you do that.

Here is a scenario that I could imagine: you have to use a non-GitHub-App credential when configuring the project (maybe due to some legacy problems), but you still want to publish checks for your builds.

But I wonder why couldn't replace the old credentials with GitHub App credentials directly, shouldn't the GitHub App credentials contain the most permissions of a repo. Or the previous credentials is something not related to GitHub? Can you tell me more about your use case?

[v1v]

Thanks for open discussion here, let me clarify the use case.

1. CI as a Service, everything related to the Jenkins CI (configuration, workers) is managed by an infra team.
2. Jenkins Job creation with JobDSL/JJB is managed by the engineering team.
3. Shared library to centralise common features between pipelines is managed by the engineering team.
4. A few dozens of GitHub repositories aka, Multibranch Pipelines.

All the GitHub interactions have been delegated through a GitHub service account:

1. Multibranch Pipeline configurations
2. GitHub status checks with https://plugins.jenkins.io/pipeline-githubnotify-step/
3. GitHub comments created with https://plugins.jenkins.io/pipeline-github/. It does not support GitHub APP credentials.

I could simply apply a GitHub APP credentials to all the MBPs with a JobDSL/JJB but I'd rather prefer to take this transition in small steps, for such, I'd like to move away from the https://plugins.jenkins.io/pipeline-githubnotify-step/ and use this plugin to notify the status with GitHub checks without a major change in the existing configuration.

This will allow me to provide a nice user experience without any major changes and move slowly to a the ideal world for using the GitHub App credentials instead.

[timja]

You can still disable the build status notification with this plugin.

What's the reason you don't want to change the pipeline auth to using the GitHub app?
What major changes do you forsee?

[v1v]

What's the reason you don't want to change the pipeline auth to using the GitHub app?

I could do it, but I'm not the system owner and I rather prefer to keep any changes easy to rollback in needed. Maybe I'm too thoughtful...

In any case, thanks and please feel free to close this issue if this request was a corner case use case :)

[chris-kiick-sp]

I have a use case for this feature. A repo with a submodule, defined as git@github.com:org/repo.git cannot use the github app credentials, as those require http protocol. Basically anything that requires using ssh will fail with github app creds. It would be helpful to specify separate credentials for the checks which use http and the repo and submodule clone which need ssh.

I have tried messing with "insteadOf" in the .gitconfig to translate between protocols, but couldn't get it to work.