diff --git a/docs/getting-started/which-permissions-does-codacy-need-from-my-account.md b/docs/getting-started/which-permissions-does-codacy-need-from-my-account.md index 8b7f487fe2..d976fcc1f8 100644 --- a/docs/getting-started/which-permissions-does-codacy-need-from-my-account.md +++ b/docs/getting-started/which-permissions-does-codacy-need-from-my-account.md @@ -207,7 +207,7 @@ If you need to use an integration that you have previously revoked, log in again ## Why does Codacy ask for permission to create SSH keys? !!! note - **GitHub only:** Codacy will soon start using [installation access tokens](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app#about-installation-access-tokens) instead of SSH keys to integrate with your GitHub repositories and clone them. SSH keys are currently used as a fallback mechanism when the [Contents permission](#github-cloud) isn't available. + **GitHub only:** Codacy started using [installation access tokens](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app#about-installation-access-tokens) instead of SSH keys to integrate with your GitHub repositories and clone them. SSH keys are currently used as a fallback mechanism when the [Contents permission](#github-cloud) isn't available. For more information, [see the discontinuation notice of SSH keys for GitHub repositories](../release-notes/cloud/cloud-2024-01-15-gh-repository-ssh-keys-discontinuation.md). To ensure Codacy keeps working correctly, make sure an organization owner [approves Codacy GitHub App updated permissions](https://docs.github.com/en/apps/using-github-apps/reviewing-and-modifying-installed-github-apps) on your GitHub organization. diff --git a/docs/release-notes/cloud/cloud-2024-01-15-gh-repository-ssh-keys-discontinuation.md b/docs/release-notes/cloud/cloud-2024-01-15-gh-repository-ssh-keys-discontinuation.md new file mode 100644 index 0000000000..2a203ad82a --- /dev/null +++ b/docs/release-notes/cloud/cloud-2024-01-15-gh-repository-ssh-keys-discontinuation.md @@ -0,0 +1,83 @@ +--- +rss_title: Codacy release notes RSS feed +rss_href: /feed_rss_created.xml +--- + +# Discontinuation of SSH keys for GitHub repositories January 15, 2024 + +!!! info "This release note applies only to GitHub" + +For increased security, Codacy is discontinuing the usage of **repository SSH keys** for Git operations on GitHub in favor of **installation access tokens**. + +This change translates into important security improvements: + +- It limits the access level of the Codacy GitHub App, as it no longer requires [read and write repository permissions for Administration](https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps?apiVersion=2022-11-28#repository-permissions-for-administration). +- Contrary to long-living SSH keys, [installation access tokens](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app#about-installation-access-tokens) expire after one hour and Codacy loses access when the GitHub App is uninstalled. + +To minimize any impact, Codacy is currently discontinuing the usage of repository SSH keys but will keep using them as a fallback mechanism at this first stage. At a later stage, Codacy will [stop using repository SSH keys and delete the keys](#timeline) stored in our systems. + +## Changes on the Codacy GitHub App required permissions {: id="changes-permissions"} + +To use installation access tokens, the Codacy GitHub App now requires [repository read permissions for Contents](https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps?apiVersion=2022-11-28#repository-permissions-for-contents). + +On the other hand, the usage of installation access tokens no longer requires [read and write repository permissions for Administration](https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps?apiVersion=2022-11-28#repository-permissions-for-administration). The Codacy GitHub App still requests this permission during this first stage, while using repository SSH keys as a fallback mechanism. At a later stage, Codacy will [remove the permission from the GitHub App](#timeline). + +## What do you need to do if you have a GitHub organization? {: id="to-do"} + +Make sure an organization owner [approves the updated permissions for the Codacy GitHub App](https://docs.github.com/en/apps/using-github-apps/reviewing-and-modifying-installed-github-apps) on your GitHub organization, if not done yet. + +Codacy has been requesting repository read permissions for **Contents** since September 2023. Organization owners should have received a GitHub notification to review a request for this additional permission: + +![Codacy GitHub App updated permissions request](../images/2023-12-DD-gh-updated-permissions.png) + +If you have any questions or need help, please contact . + +## Removal of repository permissions for Administration and SSH keys {: id="timeline"} + +To ensure the conditions to use installation access tokens on GitHub organizations are met before the removal of repository permissions for Administration and SSH keys, Codacy will execute a phased rollout according to the timeline below: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
DateEventWhat to expect
January 15, 2024Codacy started using installation access tokens to clone and integrate with your repositories +

From this day on, repository SSH keys are used exclusively as a fallback mechanism when the Contents permission is missing.

+

If not done yet, make sure an organization owner approves Codacy GitHub App updated permissions on your GitHub organization.

+
February 12, 2024Brownout of repository permissions for Administration +

On this day, Codacy won't use any fallback mechanism if the Contents permission is missing.

+

This will help you confirm that the updated permissions for the Codacy GitHub App were already approved for your organization.
If on this date your Codacy quality analysis fails or you have problems adding new repositories to Codacy, make sure an organization owner approves the updated permissions for the Codacy GitHub App on your GitHub organization.

+
February 19, 2024Codacy will remove repository permissions for Administration from the Codacy GitHub App and stop using repository SSH keys +

Codacy will start using installation access tokens to clone and integrate with your repositories, with no fallback mechanisms. Also, repository permissions for Administration will be removed from the Codacy GitHub App.

+

If on this day the Codacy GitHub App updated permissions haven't been approved on your GitHub organization yet, your Codacy quality analysis will fail and you'll not be able to add new repositories to Codacy until an organization owner approves the updated permissions.

+
To defineCodacy will no longer store repository SSH keys +

On this day, Codacy will delete all the repository SSH keys stored in our systems.

+

For increased security, you can revoke the keys created by Codacy on your GitHub repository.

+
+ +## See also + +- [Which permissions are required by Codacy GitHub App?](../../getting-started/which-permissions-does-codacy-need-from-my-account.md#github-cloud) diff --git a/docs/release-notes/images/2023-12-DD-gh-updated-permissions.png b/docs/release-notes/images/2023-12-DD-gh-updated-permissions.png new file mode 100644 index 0000000000..c1d978d0ca Binary files /dev/null and b/docs/release-notes/images/2023-12-DD-gh-updated-permissions.png differ diff --git a/docs/release-notes/index.md b/docs/release-notes/index.md index 5629714739..013fb02050 100644 --- a/docs/release-notes/index.md +++ b/docs/release-notes/index.md @@ -16,6 +16,10 @@ For product updates that are in progress or planned [visit the Codacy public roa ## Codacy Cloud release notes {: id="cloud"} +2024 + +- [Discontinuation of SSH keys for GitHub repositories January 15, 2024](cloud/cloud-2024-01-15-gh-repository-ssh-keys-discontinuation.md) + 2023 - [Cloud December 2023](cloud/cloud-2023-12.md) diff --git a/mkdocs.yml b/mkdocs.yml index 9ed8740495..37e2fa449e 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -659,6 +659,8 @@ nav: - Release notes: - release-notes/index.md - Cloud: + - 2024: + - release-notes/cloud/cloud-2024-01-15-gh-repository-ssh-keys-discontinuation.md - 2023: - release-notes/cloud/cloud-2023-12.md - release-notes/cloud/cloud-2023-11.md