Unrelated GitHub user listed as contributor on files changed by "Travis CI User"

When Travis CI pushes commits to a GitHub repository, e.g. for the gh-pages branch, the user chilanti is listed as a contributor when viewing a file blob on the website.

See for example https://github.com/tidyverse/tidyverse/blob/gh-pages/index.html and click the 1 contributor link near the top.
The popup lists only chilanti, while every other place (blame, history, etc.) shows only Travis CI User.

I’m not sure if this is a bug with Travis CI or with GitHub itself.

> git log remotes/origin/gh-pages
commit 805c3ce2fedb42dbb1a402ea74cfdd27f69085a9
Author: Travis CI User <travis@example.org>
Date:   Sat Jun 29 15:55:19 2019 +0000

    Built site for tidyverse:

commit 14195957d33674dc37044a96883c77b0fe528a0b
Author: Travis CI User <travis@example.org>
Date:   Sat Jun 29 12:15:37 2019 +0000

    Built site for tidyverse:


commit 0594e6230a737e0649d2a2d253a9a0d56092fa79
Author: Hadley Wickham <h.wickham@gmail.com>
Date:   Sat Jan 5 09:06:49 2019 -0600

    first commit

Not sure what this log shows; could you elaborate?

Hadley Wickham is not the user chilanti, if that’s what you mean.
I just picked the tidyverse repo, because it was the first one I thought of, but the same thing happened on a repo of my own, that only Travis CI had committed to — this still showed the user chilanti on the contributors popup on the website.

Yes, that’s what I meant. https://github.com/tidyverse/tidyverse/commit/0594e6230a737e0649d2a2d253a9a0d56092fa79 shows that they indeed aren’t.

Then you should ask that at Github support channels. I don’t see anything related to that user in Git log or anything related to tidyverse in that user’s all-time activity. So this does look like a Github glitch.

You are using this utility to deploy to the gh-pages branch:

I advise you to investigate what it does. It is not Travis CI or GitHub that’s setting up the git commit and push.

1 Like

No. This has nothing to do with pkgdown itself, as it also happens if you manually set up a Travis CI build that pushes to Github.

I’ll try this, thanks.

This is curious. Where can I see this?

Can’t confirm. (corresponding build)

But notice that it’s not Travis CI User committing on that repo, but traviscibot.

It might be that it’s only when pushing manually from Travis that it happens, and that traviscibot is correctly configured when using the pages provider; see for example this repo which is generated from another repo (corresponding build).

Looking at https://github.com/janusvm/test-template/blob/8f12c0527d92645ea6a24010c291ad6b1cb262ce/deploy.sh#L16

git push requires authentication. If it doesn’t fail and doesn’t ask for username/password then there must be saved credentials… somewhere.

Yea, on that repo, I’m using a personal access token (encrypted in .travis.yml). Perhaps the github id Travis CI User is always used for such commits?

I suspect that it’s not your personal access token but you rather got it from somewhere. In any case, GitHub support should say what exactly is happening.

You might also have another token in your Travis repo settings, it would override the one in the file.

You can also get a brand new GitHub token as per https://docs.travis-ci.com/user/deployment/pages/#setting-the-github-token

That depends on what you mean by it being mine; I generated it in my account settings on Github and then manually encrypted it with the Travis CLI tool. I don’t have another token set in the Travis settings (the build log even says it gets it from the config).

I would hope so, but they still haven’t responded to my email :^(

Use their contact form at https://github.com/contact

Semi-related, the R package has a github token in their package code, and it adds comments to PRs when the lintr is invoked in Travis CI.

I wouldnt be surprised if other R packages were doing the same, possibly even doing the same trick to hide the token from GitHub’s token prevention mechanisms.