Skip to content

Commit 74f1353

Browse files
a-ba-b
authored
Switch from repo secrets to vars [v8] (#2841)
* Switch from repo secrets to vars
1 parent 1240228 commit 74f1353

File tree

2 files changed

+29
-66
lines changed

2 files changed

+29
-66
lines changed

‎.github/workflows/release-build-sign-upload.yml‎

Lines changed: 17 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -44,45 +44,17 @@ permissions:
4444
contents: read
4545

4646
defaults:
47-
# top-level defaults subkeys apply to jobs
48-
# run subkeys apply to all steps within all jobs
4947
run:
5048
shell: bash
5149

5250
jobs:
53-
54-
# test:
55-
# environment: DEV
56-
# runs-on: ubuntu-latest
57-
# steps:
58-
# - name: Setup upterm session
59-
# env:
60-
# AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
61-
# AWS_REGION: ${{ secrets.AWS_REGION }}
62-
# AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
63-
# GIT_RELEASE_TARGET_REPO: ${{ secrets.GIT_RELEASE_TARGET_REPO }}
64-
# GIT_REPO_ACCESS_TOKEN: ${{ secrets.GIT_REPO_ACCESS_TOKEN }}
65-
# SIGNING_KEY_GPG: ${{ secrets.SIGNING_KEY_GPG }}
66-
# SIGNING_KEY_GPG_ID: ${{ secrets.SIGNING_KEY_GPG_ID }}
67-
# SIGNING_KEY_GPG_PASSPHRASE: ${{ secrets.SIGNING_KEY_GPG_PASSPHRASE }}
68-
# SIGNING_KEY_MAC_ID: ${{ secrets.SIGNING_KEY_MAC_ID }}
69-
# SIGNING_KEY_MAC_PASSPHRASE: ${{ secrets.SIGNING_KEY_MAC_PASSPHRASE }}
70-
# SIGNING_KEY_MAC_PFX: ${{ secrets.SIGNING_KEY_MAC_PFX }}
71-
# SIGNING_KEY_WINDOWS_ID: ${{ secrets.SIGNING_KEY_WINDOWS_ID }}
72-
# SIGNING_KEY_WINDOWS_PASSPHRASE: ${{ secrets.SIGNING_KEY_WINDOWS_PASSPHRASE }}
73-
# SIGNING_KEY_WINDOWS_PFX: ${{ secrets.SIGNING_KEY_WINDOWS_PFX }}
74-
# SIGNING_TEST_CA_MAC: ${{ secrets.SIGNING_TEST_CA_MAC }}
75-
# if: always()
76-
# uses: lhotari/action-upterm@v1
77-
# timeout-minutes: 60
78-
7951
setup:
8052
name: Setup
8153
# needs: test
8254
runs-on: ubuntu-latest
8355

8456
outputs:
85-
aws-s3-bucket: "v${{ steps.parse-semver.outputs.version-major }}-cf-cli-releases"
57+
aws-s3-bucket: "v${{ steps.parse-semver.outputs.version-major }}-cf-cli-releases"
8658

8759
version-build: ${{ steps.parse-semver.outputs.version-build }}
8860
version-major: ${{ steps.parse-semver.outputs.version-major }}
@@ -179,7 +151,7 @@ jobs:
179151

180152
- name: Build RedHat Packages
181153
env:
182-
SIGNING_KEY_GPG_ID: ${{ secrets.SIGNING_KEY_GPG_ID }}
154+
SIGNING_KEY_GPG_ID: ${{ vars.SIGNING_KEY_GPG_ID }}
183155
run: |
184156
set -ex
185157
set -o pipefail
@@ -248,7 +220,7 @@ jobs:
248220
249221
- name: Sign RedHat Packages
250222
env:
251-
SIGNING_KEY_GPG_ID: ${{ secrets.SIGNING_KEY_GPG_ID }}
223+
SIGNING_KEY_GPG_ID: ${{ vars.SIGNING_KEY_GPG_ID }}
252224
SIGNING_KEY_GPG_PASSPHRASE: ${{ secrets.SIGNING_KEY_GPG_PASSPHRASE }}
253225
run: |
254226
set -ex
@@ -544,8 +516,7 @@ jobs:
544516
545517
- name: Load macos key
546518
env:
547-
# SIGNING_TEST_CA_MAC: ${{ secrets.SIGNING_TEST_CA_MAC }}
548-
SIGNING_KEY_MAC_ID: ${{ secrets.SIGNING_KEY_MAC_ID }}
519+
SIGNING_KEY_MAC_ID: ${{ vars.SIGNING_KEY_MAC_ID }}
549520
SIGNING_KEY_MAC_PASSPHRASE: ${{ secrets.SIGNING_KEY_MAC_PASSPHRASE }}
550521
SIGNING_KEY_MAC_PFX: ${{ secrets.SIGNING_KEY_MAC_PFX }}
551522

@@ -583,7 +554,7 @@ jobs:
583554
- name: Sign macOS
584555
env:
585556
VERSION_MAJOR: ${{ needs.setup.outputs.version-major }}
586-
SIGNING_KEY_MAC_ID: ${{ secrets.SIGNING_KEY_MAC_ID }}
557+
SIGNING_KEY_MAC_ID: ${{ vars.SIGNING_KEY_MAC_ID }}
587558
SIGNING_KEY_MAC_PASSPHRASE: ${{ secrets.SIGNING_KEY_MAC_PASSPHRASE }}
588559
run: |
589560
@@ -694,8 +665,8 @@ jobs:
694665
- name: Sign Windows binaries
695666
run: |
696667
smctl healthcheck --all
697-
smctl sign --fingerprint ${{ secrets.SIGNING_KEY_WINDOWS_DIGICERT_CERT_FINGERPRINT }} --tool signtool --input out\cf-cli_win32.exe
698-
smctl sign --fingerprint ${{ secrets.SIGNING_KEY_WINDOWS_DIGICERT_CERT_FINGERPRINT }} --tool signtool --input out\cf-cli_winx64.exe
668+
smctl sign --fingerprint ${{ vars.SIGNING_KEY_WINDOWS_DIGICERT_CERT_FINGERPRINT }} --tool signtool --input out\cf-cli_win32.exe
669+
smctl sign --fingerprint ${{ vars.SIGNING_KEY_WINDOWS_DIGICERT_CERT_FINGERPRINT }} --tool signtool --input out\cf-cli_winx64.exe
699670
700671
- name: View binary signatures
701672
run: |
@@ -726,8 +697,8 @@ jobs:
726697
727698
- name: Sign Windows installers
728699
run: |
729-
smctl sign --fingerprint ${{ secrets.SIGNING_KEY_WINDOWS_DIGICERT_CERT_FINGERPRINT }} --tool signtool --input "${env:RUNNER_TEMP}\win32\cf${env:VERSION_MAJOR}_installer.exe"
730-
smctl sign --fingerprint ${{ secrets.SIGNING_KEY_WINDOWS_DIGICERT_CERT_FINGERPRINT }} --tool signtool --input "${env:RUNNER_TEMP}\winx64\cf${env:VERSION_MAJOR}_installer.exe"
700+
smctl sign --fingerprint ${{ vars.SIGNING_KEY_WINDOWS_DIGICERT_CERT_FINGERPRINT }} --tool signtool --input "${env:RUNNER_TEMP}\win32\cf${env:VERSION_MAJOR}_installer.exe"
701+
smctl sign --fingerprint ${{ vars.SIGNING_KEY_WINDOWS_DIGICERT_CERT_FINGERPRINT }} --tool signtool --input "${env:RUNNER_TEMP}\winx64\cf${env:VERSION_MAJOR}_installer.exe"
731702
732703
- name: View installer signature
733704
run: |
@@ -781,8 +752,8 @@ jobs:
781752
actions: read
782753
contents: read
783754
env:
784-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
785-
AWS_REGION: ${{ secrets.AWS_REGION }}
755+
AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
756+
AWS_REGION: ${{ vars.AWS_REGION }}
786757
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
787758
AWS_S3_BUCKET: ${{ needs.setup.outputs.aws-s3-bucket }}
788759
VERSION_BUILD: ${{ needs.setup.outputs.version-build }}
@@ -880,17 +851,13 @@ jobs:
880851
881852
- name: Setup aws to upload installers to CLAW S3 bucket
882853
uses: aws-actions/configure-aws-credentials@v4
883-
env:
884-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
885-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
886-
AWS_S3_ROLE_ARN: ${{ secrets.AWS_S3_ROLE_ARN }}
887854
with:
888-
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
889-
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
890-
aws-region: us-west-1
891-
role-to-assume: ${{ env.AWS_S3_ROLE_ARN }}
855+
aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
856+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
857+
aws-region: ${{ vars.AWS_REGION }}
858+
role-to-assume: ${{ vars.AWS_S3_ROLE_ARN }}
892859
role-skip-session-tagging: true
893-
role-duration-seconds: 1200
860+
role-duration-seconds: 1200
894861

895862
- name: Upload installers to CLAW S3 bucket
896863
run: aws s3 sync upload "s3://v${VERSION_MAJOR}-cf-cli-releases/releases/v${VERSION_BUILD}/"
@@ -928,7 +895,7 @@ jobs:
928895
draft: true
929896
name: "DRAFT v${{ env.VERSION_BUILD }}"
930897
# tag_name: "v${{ env.VERSION_BUILD }}"
931-
repository: ${{ secrets.GIT_RELEASE_TARGET_REPO }} # repo to draft a release under, in <user>/<repo> format
898+
repository: ${{ vars.GIT_RELEASE_TARGET_REPO }} # repo to draft a release under, in <user>/<repo> format
932899
token: ${{ secrets.GIT_REPO_ACCESS_TOKEN }} # only needed when pushing to a repo other than 'self'
933900
fail_on_unmatched_files: true
934901

‎.github/workflows/release-update-repos.yml‎

Lines changed: 12 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -291,13 +291,13 @@ jobs:
291291
292292
- name: Update Debian Repository
293293
env:
294-
DEBIAN_FRONTEND: noninteractive
295-
SIGNING_KEY_GPG_ID: ${{ secrets.SIGNING_KEY_GPG_ID }}
296-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
297-
AWS_BUCKET_NAME: cf-cli-debian-repo
298-
AWS_DEFAULT_REGION: us-west-2
294+
DEBIAN_FRONTEND: noninteractive
295+
SIGNING_KEY_GPG_ID: ${{ vars.SIGNING_KEY_GPG_ID }}
296+
AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
297+
AWS_BUCKET_NAME: cf-cli-debian-repo
298+
AWS_DEFAULT_REGION: us-west-2
299299
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
300-
AWS_S3_ROLE_ARN: ${{ secrets.AWS_S3_ROLE_ARN }}
300+
AWS_S3_ROLE_ARN: ${{ vars.AWS_S3_ROLE_ARN }}
301301
run: |
302302
export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s" $(aws sts assume-role --role-arn ${AWS_S3_ROLE_ARN} --role-session-name foobar --output text --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]"))
303303
deb-s3 upload installers/*.deb \
@@ -360,7 +360,7 @@ jobs:
360360
# TODO: fix backup
361361
# - name: Download current RPM repodata
362362
# env:
363-
# AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
363+
# AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
364364
# AWS_DEFAULT_REGION: us-east-1
365365
# AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
366366
# uses: docker://amazon/aws-cli:latest
@@ -394,17 +394,13 @@ jobs:
394394
395395
- name: Setup aws to upload installers to CLAW S3 bucket
396396
uses: aws-actions/configure-aws-credentials@v4
397-
env:
398-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
399-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
400-
AWS_S3_ROLE_ARN: ${{ secrets.AWS_S3_ROLE_ARN }}
401397
with:
402-
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
403-
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
404-
aws-region: us-west-1
405-
role-to-assume: ${{ env.AWS_S3_ROLE_ARN }}
398+
aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
399+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
400+
aws-region: ${{ vars.AWS_REGION }}
401+
role-to-assume: ${{ vars.AWS_S3_ROLE_ARN }}
406402
role-skip-session-tagging: true
407-
role-duration-seconds: 1200
403+
role-duration-seconds: 1200
408404

409405
- name: Download V8 RPMs
410406
run: aws s3 sync --exclude "*" --include "releases/*/*installer*.rpm" s3://v8-cf-cli-releases .

0 commit comments

Comments
 (0)