daemonsy / hubot-heroku

A hubot library that exposes heroku commands, with focus of letting non privileged developers deploy but not run dangerous commands

hubot-heroku

A hubot library that exposes heroku commands via Heroku's Platform API, with focus of letting non privileged developers carry out tasks around deployments, but not run dangerous commands or get access to the data.

Background

Under Heroku's permission model, giving someone access to push/promote to production means giving full access to the data as well. This is generally not a good practice and for certain companies, it might be non-compliant.

Our team wanted to let every engineer do deployments without giving production access. We started this by using atmos/hubot-deploy and atmos/heaven, but that didn't the ability to run migrations, set config variables etc. hubot-heroku was made with this consideration in mind.

Considerations

• It's an opionated helper to get things done on Heroku, not an API client
• Only use Heroku's Platform API, no direct running of commands in Bash
• Test coverage for commands, especially if we're implementing
• Certain commands (such as migrate) only work for Rails now =(
• Actual deployment is not the focus of this robot

By the way, I'm also actively looking for co-contributors!

What about actual deployments?

Deployment usually involves some form of CI process. Hence it is best suited for a robust solution like Github deployments, where you can set required CI contexts etc.

This robot is focused on letting you run auxiliary commands around the heroku system, so developers don't have to be given production access to independently manage deployments.

Auth

You can restrict command usage to specific roles using the hubot-auth package. Role names take the form heroku-<app>.

To enable auth:

1. npm install hubot-auth --save
2. Add hubot-auth to external-scripts.json (e.g. ["hubot-auth", "some-other-plugin"])
3. Set HUBOT_HEROKU_USE_AUTH to true.
4. Assign roles: hubot <user> has heroku-<app> role

Security

You can set config variables using this. Hence the Heroku API key used should not have access to your hubot instance on Heroku. For example:

hubot heroku config:set my-hubot HUBOT_ADMIN=dr_evil
# Muhaha, now I'm to use hubot's other commands to take over the world

You can also avoid this if you are using auth as described above, in which case you can ensure only admins have the role necessary to set config variables on the hubot instance.

Installation

1. npm install hubot-heroku --save
2. Add hubot-heroku to external-scripts.json (e.g. ["hubot-heroku", "some-other-plugin"])
3. Before deployment, set HUBOT_HEROKU_API_KEY to a heroku account's API key. This user must have access to the apps you want to use this script on.
4. The full list of commands can be obtained using hubot help. The commands usually follow hubot heroku

The API key can be obtained here.

Usage

Use hubot help to look for the commands. They are all prefixed by heroku. (e.g. hubot heroku restart my-app) Some commands (hubot help will be a better source of truth):

• hubot heroku list apps <app name filter> - Lists all apps or filtered by the name
• hubot heroku info <app> - Returns useful information about the app
• hubot heroku dynos <app> - Lists all dynos and their status
• hubot heroku releases <app> - Latest 10 releases
• hubot heroku rollback <app> - Rollback to a release
• hubot heroku restart <app> <dyno> - Restarts the specified app or dyno/s (e.g. worker or web.2)
• hubot heroku migrate <app> - Runs migrations. Remember to restart the app =)
• hubot heroku config <app> - Get config keys for the app. Values not given for security
• hubot heroku config:set <app> <KEY=value> - Set KEY to value. Case sensitive and overrides present key
• hubot heroku config:unset <app> <KEY> - Unsets KEY, does not throw error if key is not present
• hubot heroku ps:scale <app> <type>=<size>(:<quantity>) - Scales dyno quantity up or down

For example, hubot heroku config:set API_KEY=12345

Troubleshooting

If you get hubot errors, this might help:

• 400 - Bad request. Hit me with an issue
• 401 - Most likely the API key is incorrect or missing
• 402 - According to Heroku, you need to pay them
• 403 - You don't have access to that app. Perhaps it's a typo on the app name?
• 404 - No such API. Hit me with an issue.
• 405+ - Hit me with an issue

Reference the API documentation for more information. Search for "Error Responses".

Tests

• Mocha
• Chai for BDD expect syntax

Run tests by running npm test

Debugging

Get Node Inspector working

npm install -g node-inspector
node-inspector --no-preload --web-port 8123

Get hubot to run with debugging on

# In your hubot folder
npm link /path/to/hubot-heroku
coffee --nodejs --debug node_modules/.bin/hubot

Visit http://127.0.0.1:8123/debug?port=5858 and use debugger statements to pause execution.

Contributing

PRs and Issues greatly welcomed. Please read Contributing for more information.

hubot-heroku's Issues

heroku list

I'm getting my team into using slack for managing our heroku instances and we are pushing up and removing instances every day. Something that is sorely missing form this is the functionality to list all of the apps accessible by the authorized account.

I would be happy to add some tests for this and implement it but I wanted to let my intentions be known before I embarked on implementing it.

Unable to set config with dashes in value

me: hubot heroku config:set demo-betterup-co SOME_KEY=pub-somevalue
hubot: Setting config SOME_KEY => pub

Probably related to #7

Add Heroku Status command

There is currently a heroku-status hubot script at https://github.com/github/hubot-scripts/blob/master/src/scripts/heroku-status.coffee . However, if my understanding of how the hubot eco-system has changed is correct, additional pull requests into hubot-scripts is no longer the preferred method. I think pulling that same functionality into this script would make sense, especially for verifying if Heroku is functioning correctly. It would not need any of the API auth, as the status endpoint is public.

I would be more than willing to submit a PR for this, but I wanted to see if you felt this project could use that functionality before I forked and added the code!

Authorization to run commands

Currently anyone with access to the the hubot instance can run heroku commands.

I imagine that might make people feel uncomfortable and we might want a base layer of permissions.

Either everyone has full access to heroku commands or only people given a special role using hubot.

Migrate doesn't work with new dyno types

Running migrate on an app using the new dyno types fails:

luke: Telling Heroku to migrate app
luke: Shucks. An error occurred. 422 - No such size as 1X. Available dyno sizes are Free, Hobby, Standard-1X, Standard-2X and Performance.```

Add `run` command functionality

Hey there,

Based on this line from the README:

"Only use Heroku's Platform API, no direct running of commands in Bash"

Would adding behavior to run rake tasks fall under this? For example using hubot to kick off a heroku run rake blah. If that would work, I'd be interested in making a PR for it.

Add ps:scale command

My organization is moving to hubot from a custom bot platform, but the one thing standing in our way is the ability to scale an app's dynos up and down in response to changing operational conditions.

I've implemented this feature and will open a pull request shortly. Please let me know what you think. Thanks!

Add promote as a command

Heroku pipelines is pretty awesome and the promote command helps to enable using it.

Inclusion of hubot-auth causes error

If hubot-auth is declared in package.json, hubot-heroku will not load it as a nested dependency. This causes the script to fail when loading index.coffee as it's expecting the nested dependency to exist.

Update Hubot

Time has passed and first things first, how has hubot changed?

Add promote command

Promoting is quite an important part of the pipeline process, currently the library doesn't support it at all

Config setting is broken for strings with periods

hubot heroku config:set shark-production HOST=example.com
Hubot: @damon: Setting config HOST => example

lolwut

config:set command doesn't match up characters

When using the config:set command with a value that contains a hash and an array, such as:

hubot heroku config:set my_app HUBOT_GITHUB_REPOS_MAP={"web":["frontend","web"],"android":["android"],"ios":["ios"],"platform":["web"]}

The regex in scripts/heroku-commands.js#L235 doesn't match up on the last 3 characters, resulting in a broken config setting.

But if I wrap it up in double quotes:

hubot heroku config:set my_app HUBOT_GITHUB_REPOS_MAP="{"web":["frontend","web"],"android":["android"],"ios":["ios"],"platform":["web"]}"

Its OK, since the matches on \b.

I'm not sure what the best way to fix this is. The easiest is just to drop the \b from the regex but I'm not entirely sure why it was added in the first place (I'm assuming it was to catch some edge case).