[CI] Migrate bots to use Authorization HTTP Header

[hramos]

Tracking issue raised by GitHub's API regarding our CI bots script (bots/code-analysis-bot.js):

On February 12th, 2020 at 21:09 (UTC) your personal access token (public_repo) using octokit.js/16.43.1 Node.js/12.15.0 (Linux 4.15; x64) was used as part of a query parameter to access an endpoint through the GitHub API.

Please use the Authorization HTTP header instead, as using the access_token query parameter is deprecated and will be removed July 1st, 2020.

Depending on your API usage, we'll be sending you this email reminder once every 3 days for each token and User-Agent used in API calls made on your behalf.
Just one URL that was accessed with a token and User-Agent combination will be listed in the email reminder, not all.

Visit https://developer.github.com/changes/2019-11-05-deprecated-passwords-and-authorizations-api/#authenticating-using-query-parameters for more information.

The access token is publicly available in .circleci/config.yml.

[ykabusalah]

Can I tackle this?

[fabOnReact]

maybe this was solved with #28050 as I can not reproduce. I monitored https request with mitmproxy

nodejs code

const {Octokit} = require('@octokit/rest');
const octokit = new Octokit({
  auth: process.env.GITHUB_TOKEN,
});
octokit.pulls.get({owner: 'facebook', repo: 'react-native', pull_number: '28651'})

The token is not passed on the url, but in the authorization header.
After quickly reviewing the code, I could not find any code logic not using the octokit instance to perform github request like https://api.github.com/user?access_token=token_string

I have to review the circleci/config.yml jobs.

[wambu-i]

Hello!

Can I take this as my first issue?
Thanks.

[daschaa]

I'm proposing to update the user agent and octokit version to see if this issue is still occuring in the tracker. What do you think 🧐
#32891

[cortinico]

I'm proposing to update the user agent and octokit version to see if this issue is still occuring in the tracker. What do you think 🧐
#32891

Is this needed? As @fabriziobertoglio1987 mentioned I believe this is already solved:

maybe this was solved with #28050 as I can not reproduce

So i think we can just close this issue

[daschaa]

@cortinico No it is not needed, but imho it is good if we change the user agent of the octokit request. 🤔

1.) It is recommended in the octokit documentation (I have linked it in the PR).
2.) We can identify if the problem is solved by checking if the tracker has the specific (new) user agent mentioned.

So I see it as kind of flag that shows the current version of the code analysis bot.

What's your opinion on that @cortinico ? 😊

And yeah, I agree that we can close the issue 💯

[cortinico]

Fixed by #32891