Automate creating PR in repos

[varunsh-coder]

This is being piloted manually.

• Find a good match - based on topic, number of stars, if there are recent commits
• Get scorecard score
• Create fork
• Call this API to fix the workflow
• Create PR
• Continue to improve the message

[varunsh-coder]

@Devils-Knight please prioritize this.

[Devils-Knight]

@varunsh-coder to achieve automation for creating pr in repos, we can use a workflow that gets triggers when an issue is added with a specified label (example: automation).
The contents of this issue can we added in json or yml format, containing various details like:

• Topic
• Min number of stars of the repo
• Number of PR to be created

Then these details will be utilized by the workflow to create PR and the details of the PR will be added in a single comment containing various details like:

• List of good matches whose PR got added along with the url of the PR.
• List of good matches whose PR not got added because of this KnownIssue-4: Action is not in the knowledge base error.

The list of the PR that got added will also be added in another issue containing all the PR created till date, so to keep a track of added PRs.

[varunsh-coder]

lets pause this for now

[varunsh-coder]

@arjundashrath please add template here.

[arjundashrath]

GitHub asks users to define workflow permissions, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ and https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token for securing GitHub workflows against supply-chain attacks.

[Mention scorecards] scorecards also treats this as a high-risk issue. 

This repository has a Scorecards score of 4.5/10 with 10 being the most secure. The `Token-Permissions` category has a score of 0/10.

This file was fixed automatically using the open-source tool https://github.com/step-security/secure-workflows. If you like the change, and merge it, please consider starring the repo. 

[varunsh-coder]

@arjundashrath please pause PRs and let us discuss the text before proceeding.

[arjundashrath]

GitHub asks users to define workflow permissions, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ and https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token for securing GitHub workflows against supply-chain attacks.

The Open Source Security Foundation (OpenSSF) [Scorecards](https://github.com/ossf/scorecard) also treats not setting token permissions as a high-risk issue. 

This repository has a Scorecards score of 4.5/10 with 10 being the most secure. The `Token-Permissions` category has a score of 0/10.

This file was fixed automatically using the open-source tool https://github.com/step-security/secure-workflows. If you like the changes and merge them, please consider starring the repo. If you have feedback, please create an issue. 

[Devils-Knight]

Devils-Knight/Automate-PR#4 , this issue was added with necessary details,
Which triggered this (https://github.com/Devils-Knight/Automate-PR/runs/5528469257?check_suite_focus=true) workflow

That find this (https://github.com/briandfoy/mycpan-indexer) repo suitable acc. to the details provided.

Than it created a fork of this repo, created a permission branch and commit changes with added permissions here (https://github.com/Devils-Knight/mycpan-indexer/commit/c5e5c2842bdc7e0c2b492bfaae39b9fd7143de3a)

And finally it added a comment to that issue about the details of this repo, view here(Devils-Knight/Automate-PR#4 (comment))