Repository: atlassian/changesets
Pull request #444 (2020-08-16 21:13:08)

Changed the way how requests to the GitHub API were authenticated
fixes https://github.com/changesets/action/issues/51

changeset-bot[bot]: ###  🦋  Changeset is good to go

Latest commit: b20584e6f5c90faca8e64701f532290ff5b24e41

**We got this.**

<details><summary>This PR includes changesets to release 2 packages</summary>

  | Name                         | Type  |
| ---------------------------- | ----- |
| @changesets/get-github-info  | Patch |
| @changesets/changelog-github | Patch |

</details>

Not sure what this means? [Click here  to learn what changesets are](https://github.com/changesets/changesets/blob/master/docs/adding-a-changeset.md).

[Click here if you're a maintainer who wants to add another changeset to this PR](https://github.com/atlassian/changesets/new/fix/get-github-info-authorization?filename=.changeset/rich-kangaroos-love.md&value=---%0A%22%40changesets%2Fget-github-info%22%3A%20patch%0A---%0A%0AChanged%20the%20way%20how%20requests%20to%20the%20GitHub%20API%20were%20authenticated%0A)



Patch:
diff --git a/.changeset/tasty-elephants-yawn.md b/.changeset/tasty-elephants-yawn.md
new file mode 100644
index 0000000..b0a7b3e
--- /dev/null
+++ b/.changeset/tasty-elephants-yawn.md
@@ -0,0 +1,6 @@
+---
+"@changesets/get-github-info": patch
+"@changesets/changelog-github": patch
+---
+
+Changed the way how requests to the GitHub API were authenticated - from a query parameter to the `Authorization` header. The previously used method has been deprecated by the GitHub and will stop working in 2021.
diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 0000000..55712c1
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,3 @@
+{
+    "typescript.tsdk": "node_modules/typescript/lib"
+}
\ No newline at end of file
diff --git a/packages/get-github-info/src/index.ts b/packages/get-github-info/src/index.ts
index 1eb0651..7ba081d 100644
--- a/packages/get-github-info/src/index.ts
+++ b/packages/get-github-info/src/index.ts
@@ -2,6 +2,11 @@
 import fetch from "node-fetch";
 import DataLoader from "dataloader";
 
+type RequestData = {
+  commit: string;
+  repo: string;
+};
+
 function makeQuery(repos: any) {
   return `
       query {
@@ -57,13 +62,13 @@ function makeQuery(repos: any) {
 // 2. batching
 // getReleaseLine will be called a large number of times but it'll be called at the same time
 // so instead of doing a bunch of network requests, we can do a single one.
-const GHDataLoader = new DataLoader(async (requests: any[]) => {
+const GHDataLoader = new DataLoader(async (requests: RequestData[]) => {
   if (!process.env.GITHUB_TOKEN) {
     throw new Error(
       "Please create a GitHub personal access token at https://github.com/settings/tokens/new and add it as the GITHUB_TOKEN environment variable"
     );
   }
-  let repos: Record<any, any> = {};
+  let repos: Record<RequestData["repo"], Array<RequestData["commit"]>> = {};
   requests.forEach(({ commit, repo }) => {
     if (repos[repo] === undefined) {
       repos[repo] = [];
@@ -71,13 +76,13 @@ const GHDataLoader = new DataLoader(async (requests: any[]) => {
     repos[repo].push(commit);
   });
 
-  const data = await fetch(
-    `https://api.github.com/graphql?access_token=${process.env.GITHUB_TOKEN}`,
-    {
-      method: "POST",
-      body: JSON.stringify({ query: makeQuery(repos) })
-    }
-  ).then((x: any) => x.json());
+  const data = await fetch("https://api.github.com/graphql", {
+    method: "POST",
+    headers: {
+      Authorization: `Token ${process.env.GITHUB_TOKEN}`
+    },
+    body: JSON.stringify({ query: makeQuery(repos) })
+  }).then((x: any) => x.json());
 
   // this is mainly for the case where there's an authentication problem
   if (!data.data) {
@@ -101,10 +106,9 @@ const GHDataLoader = new DataLoader(async (requests: any[]) => {
   return requests.map(({ repo, commit }) => cleanedData[repo][commit]);
 });
 
-export async function getInfo(request: {
-  commit: string;
-  repo: string;
-}): Promise<{
+export async function getInfo(
+  request: RequestData
+): Promise<{
   user: string | null;
   pull: number | null;
   links: {


Test patch:
diff --git a/packages/get-github-info/src/index.test.ts b/packages/get-github-info/src/index.test.ts
index cf4d28b..21fa750 100644
--- a/packages/get-github-info/src/index.test.ts
+++ b/packages/get-github-info/src/index.test.ts
@@ -4,10 +4,14 @@ import prettier from "prettier";
 
 process.env.GITHUB_TOKEN = "token";
 
-let apiPath = `/graphql?access_token=${process.env.GITHUB_TOKEN}`;
+let apiPath = `/graphql`;
 
 test("associated with multiple PRs with only one merged", async () => {
-  nock("https://api.github.com")
+  nock("https://api.github.com", {
+    reqheaders: {
+      Authorization: `Token ${process.env.GITHUB_TOKEN}`
+    }
+  })
     .post(apiPath, ({ query }) => {
       expect(prettier.format(query, { parser: "graphql" }))
         .toMatchInlineSnapshot(`
@@ -114,7 +118,11 @@ test("associated with multiple PRs with only one merged", async () => {
 });
 
 test("associated with multiple PRs with multiple merged gets the one that was merged first", async () => {
-  nock("https://api.github.com")
+  nock("https://api.github.com", {
+    reqheaders: {
+      Authorization: `Token ${process.env.GITHUB_TOKEN}`
+    }
+  })
     .post(apiPath, ({ query }) => {
       expect(prettier.format(query, { parser: "graphql" }))
         .toMatchInlineSnapshot(`
@@ -221,7 +229,11 @@ test("associated with multiple PRs with multiple merged gets the one that was me
 });
 
 test("gets the author of the associated pull request if it exists rather than the author of the changeset", async () => {
-  nock("https://api.github.com")
+  nock("https://api.github.com", {
+    reqheaders: {
+      Authorization: `Token ${process.env.GITHUB_TOKEN}`
+    }
+  })
     .post(apiPath, ({ query }) => {
       expect(prettier.format(query, { parser: "graphql" }))
         .toMatchInlineSnapshot(`