rails-bot not accessible via api

[billybonks]

It seems like Shopify org owns a rails bot that is doing automatic tagging of pull requests sadly this means that that information cannot be accessed when using API on pull_request.timelineitems

this is the second node

While I understand Shopify should do that on their repos for security, it's crazy to bleed that into an open-source project like Rais.

Mostly, what I want from this discussion is

1. Is my assumptions correct about the bot ownership
2. is this a known thing
3. Does the community care?

[matthewd]

If you're getting that response from an API request against the Rails org, could you please describe/show the request you're making?

[billybonks]

query

query (
  $owner: String!
  $name: String!
  $number: Int!
  $cursor: String
  $page_size: Int!
) {
  repository(name: $name, owner: $owner) {
    pullRequest(number: $number) {
      timelineItems(first: $page_size, after: $cursor) {
        totalCount
        edges {
          node {
            ... on Node {
              __typename
              id
            }
          }
        }
      }
    }
  }
}

variables

{"name":"rails", "owner":"rails", "page_size":100, "number":47160}

response

{"data"=>
    {"repository"=>
      {"pullRequest"=>
        {"timelineItems"=>
          {"totalCount"=>13,
           "edges"=>
            [{"node"=>{"__typename"=>"PullRequestCommit", "id"=>"PURC_lADNIULOSLGT6toAKDIxMmU5NzIzYmM1M2Y5NzA0ZmI5YjM4ZmUyOTJkMDhhMDg5MDliMzE"}},
             {"node"=>{"__typename"=>"LabeledEvent", "id"=>"LE_lADNIULOXPzi0s8AAAAB8zNv-w"}},
             nil,
             {"node"=>{"__typename"=>"ReviewRequestedEvent", "id"=>"RRE_lADNIULOXPzi0s8AAAAB8zYZzg"}},
             {"node"=>{"__typename"=>"ReviewRequestedEvent", "id"=>"RRE_lADNIULOXPzi0s8AAAAB8zYb6A"}},
             {"node"=>{"__typename"=>"PullRequestReview", "id"=>"PRR_kwDNIULOS-HVHQ"}},
             {"node"=>{"__typename"=>"IssueComment", "id"=>"IC_kwDNIULOVBpbow"}},
             {"node"=>{"__typename"=>"CrossReferencedEvent", "id"=>"CRE_kwDNIULOSyzuVw"}},
             {"node"=>{"__typename"=>"IssueComment", "id"=>"IC_kwDNIULOVUKP1Q"}},
             {"node"=>{"__typename"=>"IssueComment", "id"=>"IC_kwDNIULOWDvBxA"}},
             {"node"=>{"__typename"=>"ClosedEvent", "id"=>"CE_lADNIULOXPzi0s8AAAACDc41fQ"}},
             {"node"=>{"__typename"=>"HeadRefDeletedEvent", "id"=>"HRDE_lADNIULOXPzi0s8AAAACDc43uA"}},
             {"node"=>{"__typename"=>"CrossReferencedEvent", "id"=>"CRE_kwDNIULOTPDXJQ"}}]}}}},
   "errors"=>
    [{"type"=>"FORBIDDEN",
      "path"=>["repository", "pullRequest", "timelineItems", "edges", 2],
      "extensions"=>{"saml_failure"=>false},
      "locations"=>[{"line"=>6, "column"=>9}],
      "message"=>"Although you appear to have the correct authorization credentials, the `Shopify` organization has an IP allow list enabled, and your IP address is not permitted to access this resource."}]}>

[billybonks]

Sorry, I realised I counted wrong; instead of starting from 0, I started from 1 :). it is the cross reference that is causing the issue which makes more sense.

Though I notice that the documentation talks about private resources and not public ones https://docs.github.com/en/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-allowed-ip-addresses-for-your-organization#about-allowed-ip-addresses.

but that's a conversation for a different place :)