Use the bot to ban/unban users

[williamkapke]

A ban.json file to be added to the moderation repo (migrate existing list) in this format:

{
  //userid-username: [ start - end, ... ]
  "1234-ghost": [ "2016-12-14 to 2017-12-14" ],
  "100934-foobarbaz": [ "2015-01-28 to 2016-01-28" ]
}

<sup>* the goal of this file is to have an extremely simple format even though it causes extra parsing for the bot
* username is there just for human convenience</sup>
To automate lifting bans; the bot will sync the file with the Org's bans once a day.

Workflow to ban a user:

• A member of the org creates a PR to the bans.json file. This can just be a proposal for a ban and a thread to discuss.
• Once X number of collaborators approve the PR, the bot merges it. (X to be determined by policy)
• When the bot gets a notification that this file has been changed (for any reason), it will sync the Org's bans with the list - adding any new bans or lifting any removed/expired bans.

[Fishrock123]

This requires Owner permissions IIRC.

[targos]

I can't find a reference to user blocking in the GitHub API docs. Are you sure it's possible?

[williamkapke]

This requires Owner permissions IIRC.

... which the bot is supposed to have at this point. Does it not?

[williamkapke]

@targos oooohhh... good point. Maybe this ISN'T possible :(

[Fishrock123]

... which the bot is supposed to have at this point. Does it not?

No, the discussion was to approve that for a separate, restricted bot, no?

[williamkapke]

@Fishrock123 It was completed here: #72 (comment)
... I guess that issue could be closed

[Fishrock123]

Oh right, it turns out there are specific permissions for that. We'd have to find out if the block list is accessible by the API.

[bnoordhuis]

Handing admin rights, even if scoped, to a script that runs unsupervised for most of the day gives me the willies. What are the failure modes for hostile attacks, software bugs and bad input?

[phillipj]

FYI I sent a question to GitHub Support whether or not it's possible to block users via their API.

[phillipj]

Hi, Phillip,

You're not missing anything -- the ability to block users is not exposed via the API currently. It's something we're considering for the future, but I can't promise when it will happen.

Thanks for expressing interest in this, and if there's anything else you'd like to see improved -- please let us know.

Cheers,
Ivan

In other words, not much the bot can do ATM.

[williamkapke]

@phillipj GAH! What a major snag to this plan! Thanks a million for asking them.

[phillipj]

Closing this for now as it seems we're out of luck until GitHub exposes ban/unban via their API.

[phillipj]

Re-opening this as I just got a follow up email from GitHub staff. They have added support for block/unblocking users:

• https://developer.github.com/v3/orgs/blocking/
• https://developer.github.com/v3/users/blocking/

And a webhook which might come in handy:

• https://developer.github.com/v3/activity/events/types/#orgblockevent

[MylesBorins]

🎉

[phillipj]

@williamkapke is this something your newly created https://github.com/williamkapke/orgbot could handle?

[williamkapke]

indeed it does!

[phillipj]

Oooh nice, lets close this (again) in favor of the new rockstar in town: https://github.com/williamkapke/orgbot

[williamkapke]

heh, well that "rockstar" isn't getting a very positive reception (yet?):
nodejs/community-committee#22

We'll just need to wait and see if anyone changes their mind I guess.

[phillipj]

Thanks for the reference, an interesting discussion I wasn't aware of.