Setup github action to aggregate info for account-recovery requests#4389
Open
Setup github action to aggregate info for account-recovery requests#4389
Conversation
added 9 commits
July 11, 2024 21:22
djwooten
commented
Jul 13, 2024
| def get_packages_by_user(username: str) -> list: | ||
| """Parse html to get a list of packages for a given PyPI user. | ||
|
|
||
| The pypi api does not provide a way to get a list of packages for a user, hence crawling the html. |
Author
There was a problem hiding this comment.
Unless I'm wrong there is no api I can use to directly query a pypi user to determine the packages they maintain. Manually parsing the html to find it is not the most stable solution, but is working for now.
Comment on lines
+162
to
+168
| # Count how many packages are not owned or administered by the user | ||
| num_unverified = len([row for row in package_ownership if row[2] > ORG_ADMIN]) | ||
|
|
||
| if num_unverified == 0: | ||
| label = "fasttrack" | ||
| else: | ||
| label = "" |
Author
There was a problem hiding this comment.
I don't know what your policy would call for here. This code considers repos to be owned by the user if they are directly owned, or if they belong to an organization that the github user is an admin for.
Comment on lines
+44
to
+48
| BOT_NOTICE = ( | ||
| "### NOTE\n\n" | ||
| "_This action was performed automatically by a bot and **does not guarantee account recovery**. Account recovery" | ||
| " requires manual approval processing by the PyPI team._" | ||
| ) |
Author
There was a problem hiding this comment.
I think a notice like this is important so that people understand that the github action isn't actually able to recover anybody's account for them.
|
(excellent idea @djwooten!) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I recently opened an issue to recover my pypi account, but I understand that there are very limited resources to deal with a large volume of support requests.
I wanted to help by setting up a github action that can aggregate relevant info from public sources for account-recovery issues.
Specifically - my account only maintains one package synergy, and the source code repository for that package is owned by my github account: https://github.com/djwooten/synergy. It seems to me that requests like this could be easy to triage, since it's clear that I'm the owner for all of the packages my PyPI account manages.
So I set up an action that
b) Also, if the github user does own all of the repositories for packages maintained by the pypi user, it adds an additional label
fasttrack.You can see an example of this working in an issue on my fork.
I ran the code on all 462 current open issues with the
account-recoverytag:A few example tables are
Issue 4386
pypi_user: cgote
gh_user: gotec
This would get the
fasttracklabel since all ofcgote's packages point to repos owned bygotec, who issued the support request.Issue 3117
pypi_user: KohnoseLami
github_user: KohnoseLami
which shows that the github user owns the repo for Twitter-Frontend-API, and is a member of the organization where the source code for PayPayPay is hosted. This wouldn't count amongst the 88 showing direct ownership, since they are only a member of that org, not an admin of it.
Issue 4359
pypi_user: lcampagn
gh_user: campagnola
The last two package URLs cannot be associated to the github user
campagnola.Issue 4321
pypi_user: evindunn
gh_user: evindunn
This user actually does have a github repo at https://github.com/evindunn/jinplate, but because it is not specified at the PyPI package for
jinplate, it doesn't count as being owned.