Skip to content

Commit 46b4541

Browse files
a-ba-b
committed
Switch from repo secrets to vars
- cleanup
1 parent 1fcb100 commit 46b4541

File tree

2 files changed

+20
-56
lines changed

2 files changed

+20
-56
lines changed

‎.github/workflows/release-build-sign-upload.yml

+8-40
Original file line numberDiff line numberDiff line change
@@ -44,45 +44,17 @@ permissions:
4444
contents: read
4545

4646
defaults:
47-
# top-level defaults subkeys apply to jobs
48-
# run subkeys apply to all steps within all jobs
4947
run:
5048
shell: bash
5149

5250
jobs:
53-
54-
# test:
55-
# environment: DEV
56-
# runs-on: ubuntu-latest
57-
# steps:
58-
# - name: Setup upterm session
59-
# env:
60-
# AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
61-
# AWS_REGION: ${{ secrets.AWS_REGION }}
62-
# AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
63-
# GIT_RELEASE_TARGET_REPO: ${{ secrets.GIT_RELEASE_TARGET_REPO }}
64-
# GIT_REPO_ACCESS_TOKEN: ${{ secrets.GIT_REPO_ACCESS_TOKEN }}
65-
# SIGNING_KEY_GPG: ${{ secrets.SIGNING_KEY_GPG }}
66-
# SIGNING_KEY_GPG_ID: ${{ secrets.SIGNING_KEY_GPG_ID }}
67-
# SIGNING_KEY_GPG_PASSPHRASE: ${{ secrets.SIGNING_KEY_GPG_PASSPHRASE }}
68-
# SIGNING_KEY_MAC_ID: ${{ secrets.SIGNING_KEY_MAC_ID }}
69-
# SIGNING_KEY_MAC_PASSPHRASE: ${{ secrets.SIGNING_KEY_MAC_PASSPHRASE }}
70-
# SIGNING_KEY_MAC_PFX: ${{ secrets.SIGNING_KEY_MAC_PFX }}
71-
# SIGNING_KEY_WINDOWS_ID: ${{ secrets.SIGNING_KEY_WINDOWS_ID }}
72-
# SIGNING_KEY_WINDOWS_PASSPHRASE: ${{ secrets.SIGNING_KEY_WINDOWS_PASSPHRASE }}
73-
# SIGNING_KEY_WINDOWS_PFX: ${{ secrets.SIGNING_KEY_WINDOWS_PFX }}
74-
# SIGNING_TEST_CA_MAC: ${{ secrets.SIGNING_TEST_CA_MAC }}
75-
# if: always()
76-
# uses: lhotari/action-upterm@v1
77-
# timeout-minutes: 60
78-
7951
setup:
8052
name: Setup
8153
# needs: test
8254
runs-on: ubuntu-latest
8355

8456
outputs:
85-
aws-s3-bucket: "v${{ steps.parse-semver.outputs.version-major }}-cf-cli-releases"
57+
aws-s3-bucket: "v${{ steps.parse-semver.outputs.version-major }}-cf-cli-releases"
8658

8759
version-build: ${{ steps.parse-semver.outputs.version-build }}
8860
version-major: ${{ steps.parse-semver.outputs.version-major }}
@@ -781,8 +753,8 @@ jobs:
781753
actions: read
782754
contents: read
783755
env:
784-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
785-
AWS_REGION: ${{ secrets.AWS_REGION }}
756+
AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
757+
AWS_REGION: ${{ vars.AWS_REGION }}
786758
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
787759
AWS_S3_BUCKET: ${{ needs.setup.outputs.aws-s3-bucket }}
788760
VERSION_BUILD: ${{ needs.setup.outputs.version-build }}
@@ -887,17 +859,13 @@ jobs:
887859

888860
- name: Setup aws to upload installers to CLAW S3 bucket
889861
uses: aws-actions/configure-aws-credentials@v4
890-
env:
891-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
892-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
893-
AWS_S3_ROLE_ARN: ${{ secrets.AWS_S3_ROLE_ARN }}
894862
with:
895-
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
896-
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
897-
aws-region: us-west-1
898-
role-to-assume: ${{ env.AWS_S3_ROLE_ARN }}
863+
aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
864+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
865+
aws-region: ${{ vars.AWS_REGION }}
866+
role-to-assume: ${{ vars.AWS_S3_ROLE_ARN }}
899867
role-skip-session-tagging: true
900-
role-duration-seconds: 1200
868+
role-duration-seconds: 1200
901869

902870
- name: Upload installers to CLAW S3 bucket
903871
run: aws s3 sync upload "s3://v${VERSION_MAJOR}-cf-cli-releases/releases/v${VERSION_BUILD}/"

‎.github/workflows/release-update-repos.yml

+12-16
Original file line numberDiff line numberDiff line change
@@ -290,13 +290,13 @@ jobs:
290290
291291
- name: Update Debian Repository
292292
env:
293-
DEBIAN_FRONTEND: noninteractive
294-
SIGNING_KEY_GPG_ID: ${{ secrets.SIGNING_KEY_GPG_ID }}
295-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
296-
AWS_BUCKET_NAME: cf-cli-debian-repo
297-
AWS_DEFAULT_REGION: us-west-2
293+
DEBIAN_FRONTEND: noninteractive
294+
SIGNING_KEY_GPG_ID: ${{ secrets.SIGNING_KEY_GPG_ID }}
295+
AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
296+
AWS_BUCKET_NAME: cf-cli-debian-repo
297+
AWS_DEFAULT_REGION: us-west-2
298298
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
299-
AWS_S3_ROLE_ARN: ${{ secrets.AWS_S3_ROLE_ARN }}
299+
AWS_S3_ROLE_ARN: ${{ vars.AWS_S3_ROLE_ARN }}
300300
run: |
301301
export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s" $(aws sts assume-role --role-arn ${AWS_S3_ROLE_ARN} --role-session-name foobar --output text --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]"))
302302
deb-s3 upload installers/*.deb \
@@ -359,7 +359,7 @@ jobs:
359359
# TODO: fix backup
360360
# - name: Download current RPM repodata
361361
# env:
362-
# AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
362+
# AWS_ACCESS_KEY_ID: ${{ vars.AWS_ACCESS_KEY_ID }}
363363
# AWS_DEFAULT_REGION: us-east-1
364364
# AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
365365
# uses: docker://amazon/aws-cli:latest
@@ -393,17 +393,13 @@ jobs:
393393
394394
- name: Setup aws to upload installers to CLAW S3 bucket
395395
uses: aws-actions/configure-aws-credentials@v4
396-
env:
397-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
398-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
399-
AWS_S3_ROLE_ARN: ${{ secrets.AWS_S3_ROLE_ARN }}
400396
with:
401-
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
402-
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
403-
aws-region: us-west-1
404-
role-to-assume: ${{ env.AWS_S3_ROLE_ARN }}
397+
aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
398+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
399+
aws-region: ${{ vars.AWS_REGION }}
400+
role-to-assume: ${{ vars.AWS_S3_ROLE_ARN }}
405401
role-skip-session-tagging: true
406-
role-duration-seconds: 1200
402+
role-duration-seconds: 1200
407403

408404
- name: Download V8 RPMs
409405
run: aws s3 sync --exclude "*" --include "releases/*/*installer*.rpm" s3://v8-cf-cli-releases .

0 commit comments

Comments
 (0)