How to authenticate with a Github App to create V2 projects, through the new graphql API?

[mfigares]

Select Topic Area

Question

Body

I feel like I'm missing something so silly that when someone points it out I'll feel dumb, but I'll ask anyway.

The thing that I'm trying to do is just "creating a projectV2 with a github App, through the graphql API, to a predefined repo, in a user's account that has already installed the App". I can do it with a personal access token (classic), but I didn't find an analogous auth method in the app.

This is the mutation that I'm applying to my own repo (I'll share the exact same graphql mutation without the personal access token)

 mutation{
   createProjectV2(input: {
     title:"V2 project related to test repo"
     ownerId:"MDQ6VXNlcjgwNTM2MDY2"
     repositoryId:"R_kgDOI5E_Zg"
   }){
     __typename
     projectV2{
       title
       id
       creator {
         login
         __typename
         resourcePath
       }
     }
   }
 }

It should be the same mutation if I was authenticating it as an App? If that's the case, where are those credentials in my App?
If it wasn't the same mutation and I needed to add other/different arguments to the mutation, which params should I add? Can someone give me advice on this?

Thanks in advance to any replier 😄

[mfigares]

Ok... I think I got right the jwt auth, but still... What I accomplished was to get a valid bearer token to be able to send a valid mutation to the server, but the thing is I still got an error message that says type: FORBIDDEN and message: "Resource not accessible by integration" (even though I gave literally every permission possible to my github app)

That part I don't think I'll be able to figure out by myself, but it must be possible, if github is deprecating the classic projects, right?

I'll leave a brief script that I made in node to generate the jwt, in case it helps someone 😅

const jwt = require('jsonwebtoken');
const fs = require('fs');
require('dotenv').config(); // add the environment vars in a .env file

const JWT_SECRET =
  process.env.PRIVATE_KEY || fs.readFileSync(process.env.PRIVATE_KEY_PATH);
const signJWT = () =>
  jwt.sign(
    {
      iat: Math.round(Date.now() / 1000 - 60), // issued at time, 60 seconds in the past to allow for clock drift
      exp: Math.round(Date.now() / 1000 + 10 * 60), // JWT expiration time (10 minute maximum)
      iss: process.env.APP_ID, // GitHub App's identifier
    },
    JWT_SECRET,
    { algorithm: 'RS256' },
  );

console.log(signJWT());

[berkeli]

Were you able to find a solution for this? I've been at it for a few days now and documentation is super unclear

[CallMeGreg]

@mfigares @berkeli This was a tricky nuance indeed! The docs were updated today to expand on it. TL;DR: add the repository Contents permission to the GitHub App so that the project can be linked to the repo.

[smallstepman]

The mention of Contents permission is nowhere to be found in the doc, and adding Contents permission to my GH App didn’t fix the issue. Do you know if something has changed @CallMeGreg ?

[CallMeGreg]

Hey @smallstepman it does look like the docs have changed and the reference to Contents was removed. I'd suggest opening a support ticket here: https://support.github.com/contact

[unformatt]

Documentation in regards to GraphQL API permissions and Github Apps is non-existent AFAICT; It's just trial and error. I only see docs about OAuth Apps scopes. I've enabled every Repository, Organization, and Account permission in my Github app, re-authorized my user with the app and still can't read V2 projects:

query {
    viewer {
        id
        login
        projectsV2 (first: 100) {
              nodes {
                id
                title
              }
        }
    }
}

Response -> {u'errors': [{u'path': [u'viewer', u'projectsV2', u'nodes', 0], u'message': u'Resource not accessible by integration', u'type': u'FORBIDDEN', u'extensions': {u'saml_failure': False}

[smallstepman]

yup, that's exactly what I did (all permissions), and got the same results Resource not accessible by integration
ended up using personal PAT for all ProjectV2 mutations for now

[unformatt]

GitHub support confirmed that GitHub Apps cannot access user-level V2 Projects (!!). The only way is to use a PAT or authorize through a GitHub OAuth App. Pretty impractical for myself as an app creator with users that have already authorized through my GitHub App. Besides being a strange UX, just feels totally sketchy to ask my users to enter a PAT into my app. The other bad-UX option is to additionally ask them to authorize through a newly-created OAuth app in which I need to tediously explain to them why they have to auth twice.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬