get that readme working!

[anonydog]

get that readme working!

[thiagoarrais]

I'll start with the proxied repo flow. Here's some pseudo-code* to help identify needed API calls:

main flow

user goes to https://anonydog.org/fork and says they want to fork github repo
`upstream/forked-repo`

anonydog creates a fork of `upstream/forked-repo` at `anonydog/upstream-forked-repo`
using API call A and registers a webhook for receiving notifications using API call B

some time goes by as user works

user opens a pull request to `anonydog/upstream-forked-repo`

anonydog gets notified via webhook

anonydog creates (locally) a branch in `anonydog/upstream-forked-repo` with a name
`8f43110a` (randomly generated), pointing to the tip commit of the proposed pull request
as identified by attribute C

anonydog amends (locally) all commits between the base commit (as identified by attribute
D) and the tip replacing the author field with its name

anonydog publishes (git push) the `8f43110a` branch to github

anonydog opens a pull request from `8f43110a` to the proposed base branch (as identified
by attribute E) using API call F and the pull request description used by the user (as
identified by attribute G)

API call A

Fork upstream repo:

curl -X POST \
    -H "Authorization: token `cat $HOME/tmp/my_super_secret_token`" \
    https://api.github.com/repos/thiagoarrais/ignore-this/forks

docs: https://developer.github.com/v3/repos/forks/#create-a-fork

Rename forked repo (to achieve promised name):

curl -X PATCH \
    -H "Authorization: token `cat $HOME/tmp/my_super_secret_token`" \
    -d '{"name" : "upstream-forked-repo"}' \
    https://api.github.com/repos/arraisbot/ignore-this

docs: https://developer.github.com/v3/repos/#edit

Potential problem with this approach: upstream mantainer receives a fork notification, (which makes deanonymisation a lot easier?)

API call B

curl -X POST \
    -H "Authorization: token `cat $HOME/tmp/my_super_secret_token`" \
    -d '{"name" : "web", "config": {"url" : "https://anonydog.org/_github/prs", "content_type": "json"}, "events": ["pull_request"]}' \
    https://api.github.com/repos/arraisbot/upstream-forked-repo/hooks

docs: https://developer.github.com/v3/repos/hooks/#create-a-hook

attribute C

event["pull_request"]["head"]["sha"]

docs: https://developer.github.com/v3/activity/events/types/#pullrequestevent

attribute D

event["pull_request"]["base"]["sha"]

docs: https://developer.github.com/v3/activity/events/types/#pullrequestevent

attribute E

event["pull_request"]["base"]["ref"]

docs: https://developer.github.com/v3/activity/events/types/#pullrequestevent

API call F

curl -X POST \
    -H "Authorization: token `cat $HOME/tmp/my_super_secret_token`" \
    -d '{"title": "did some stuff!", "body": "and opened this PR via API", "head": "arraisbot:contributor-pr", "base": "master"}' \
    https://api.github.com/repos/thiagoarrais/ignore-this/pulls

result: thiagoarrais/github-sandbox#14

docs: https://developer.github.com/v3/pulls/#create-a-pull-request

attribute G

event["pull_request"]["title"]
event["pull_request"]["body"]

docs: https://developer.github.com/v3/activity/events/types/#pullrequestevent

*: I don't know if I get to call this thing pseudo-code, but whatever...

[thiagoarrais]

OK. I'll settle for a simpler version of the functionality as a first version. There will be no magical coin: the bot will anonymize any pull requests it receives. It neither will relay comments between the original and the fake PRs.

Here's what I'm considering before going live with the alpha/beta:

• better "i did anonymize your pull request" message
• presentable homepage with a big green "i'm ready. let's get started" button