Skip to content

Commit fe7c397

Browse files
Takaros999Takaros999
committed
fix(ci): use biometric engines app token
1 parent 5de9426 commit fe7c397

5 files changed

Lines changed: 73 additions & 48 deletions

File tree

‎.github/workflows/build-docker.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,15 @@ jobs:
4141
- name: Checkout code
4242
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
4343

44+
- name: Mint biometric-engines access token
45+
id: biometric-engines-token
46+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
47+
with:
48+
client-id: ${{ secrets.BIOMETRIC_ENGINES_APP_ID }}
49+
private-key: ${{ secrets.BIOMETRIC_ENGINES_APP_PRIVATE_KEY }}
50+
owner: worldcoin
51+
repositories: biometric-engines
52+
4453
- name: Resolve version
4554
id: version
4655
if: github.ref_type == 'tag' || inputs.version != ''
@@ -73,15 +82,6 @@ jobs:
7382
- name: Set up Docker Buildx
7483
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
7584

76-
- name: Check private dependency token
77-
env:
78-
GIT_HUB_TOKEN: ${{ secrets.GIT_HUB_TOKEN }}
79-
run: |
80-
if [[ -z "$GIT_HUB_TOKEN" ]]; then
81-
echo "::error::GIT_HUB_TOKEN is required to fetch private dependencies"
82-
exit 1
83-
fi
84-
8585
- name: Login to GitHub Container Registry
8686
if: github.event_name != 'pull_request'
8787
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
@@ -103,7 +103,7 @@ jobs:
103103
cache-to: type=gha,mode=max
104104
platforms: linux/amd64
105105
secrets: |
106-
GITHUB_TOKEN=${{ secrets.GIT_HUB_TOKEN }}
106+
GITHUB_TOKEN=${{ steps.biometric-engines-token.outputs.token }}
107107
108108
- name: Attest build provenance
109109
if: github.event_name != 'pull_request'

‎.github/workflows/build-enclave-eif.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,15 @@ jobs:
4343
- name: Checkout code
4444
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
4545

46+
- name: Mint biometric-engines access token
47+
id: biometric-engines-token
48+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
49+
with:
50+
client-id: ${{ secrets.BIOMETRIC_ENGINES_APP_ID }}
51+
private-key: ${{ secrets.BIOMETRIC_ENGINES_APP_PRIVATE_KEY }}
52+
owner: worldcoin
53+
repositories: biometric-engines
54+
4655
- name: Install Rust toolchain
4756
uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
4857

@@ -75,7 +84,7 @@ jobs:
7584

7685
- name: Build EIF and PCRs
7786
env:
78-
GIT_HUB_TOKEN: ${{ secrets.GIT_HUB_TOKEN }}
87+
GIT_HUB_TOKEN: ${{ steps.biometric-engines-token.outputs.token }}
7988
run: scripts/build-eif.sh target/eif
8089

8190
- name: Publish PCR measurements

‎.github/workflows/ci.yml‎

Lines changed: 44 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -31,21 +31,25 @@ jobs:
3131
runs-on: ubuntu-latest
3232
steps:
3333
- uses: actions/checkout@v4
34+
- name: Mint biometric-engines access token
35+
id: biometric-engines-token
36+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
37+
with:
38+
client-id: ${{ secrets.BIOMETRIC_ENGINES_APP_ID }}
39+
private-key: ${{ secrets.BIOMETRIC_ENGINES_APP_PRIVATE_KEY }}
40+
owner: worldcoin
41+
repositories: biometric-engines
3442
- uses: dtolnay/rust-toolchain@1.97.0
3543
with:
3644
components: clippy
3745
- uses: Swatinem/rust-cache@v2
3846
- name: Configure private Git dependencies
3947
env:
40-
GIT_HUB_TOKEN: ${{ secrets.GIT_HUB_TOKEN }}
48+
BIOMETRIC_ENGINES_TOKEN: ${{ steps.biometric-engines-token.outputs.token }}
4149
run: |
42-
if [[ -z "$GIT_HUB_TOKEN" ]]; then
43-
echo "::error::GIT_HUB_TOKEN is required to fetch private dependencies"
44-
exit 1
45-
fi
4650
git config --global \
47-
url."https://${GIT_HUB_TOKEN}:x-oauth-basic@github.com/".insteadOf \
48-
"https://github.com/"
51+
url."https://x-access-token:${BIOMETRIC_ENGINES_TOKEN}@github.com/worldcoin/biometric-engines".insteadOf \
52+
"https://github.com/worldcoin/biometric-engines"
4953
- name: Run Clippy
5054
run: cargo clippy --locked --all-targets --all-features --
5155

@@ -54,19 +58,23 @@ jobs:
5458
runs-on: ubuntu-latest
5559
steps:
5660
- uses: actions/checkout@v4
61+
- name: Mint biometric-engines access token
62+
id: biometric-engines-token
63+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
64+
with:
65+
client-id: ${{ secrets.BIOMETRIC_ENGINES_APP_ID }}
66+
private-key: ${{ secrets.BIOMETRIC_ENGINES_APP_PRIVATE_KEY }}
67+
owner: worldcoin
68+
repositories: biometric-engines
5769
- uses: dtolnay/rust-toolchain@1.97.0
5870
- uses: Swatinem/rust-cache@v2
5971
- name: Configure private Git dependencies
6072
env:
61-
GIT_HUB_TOKEN: ${{ secrets.GIT_HUB_TOKEN }}
73+
BIOMETRIC_ENGINES_TOKEN: ${{ steps.biometric-engines-token.outputs.token }}
6274
run: |
63-
if [[ -z "$GIT_HUB_TOKEN" ]]; then
64-
echo "::error::GIT_HUB_TOKEN is required to fetch private dependencies"
65-
exit 1
66-
fi
6775
git config --global \
68-
url."https://${GIT_HUB_TOKEN}:x-oauth-basic@github.com/".insteadOf \
69-
"https://github.com/"
76+
url."https://x-access-token:${BIOMETRIC_ENGINES_TOKEN}@github.com/worldcoin/biometric-engines".insteadOf \
77+
"https://github.com/worldcoin/biometric-engines"
7078
- name: Build debug
7179
run: cargo build --locked --verbose
7280
- name: Build release
@@ -77,19 +85,23 @@ jobs:
7785
runs-on: ubuntu-latest
7886
steps:
7987
- uses: actions/checkout@v4
88+
- name: Mint biometric-engines access token
89+
id: biometric-engines-token
90+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
91+
with:
92+
client-id: ${{ secrets.BIOMETRIC_ENGINES_APP_ID }}
93+
private-key: ${{ secrets.BIOMETRIC_ENGINES_APP_PRIVATE_KEY }}
94+
owner: worldcoin
95+
repositories: biometric-engines
8096
- uses: dtolnay/rust-toolchain@1.97.0
8197
- uses: Swatinem/rust-cache@v2
8298
- name: Configure private Git dependencies
8399
env:
84-
GIT_HUB_TOKEN: ${{ secrets.GIT_HUB_TOKEN }}
100+
BIOMETRIC_ENGINES_TOKEN: ${{ steps.biometric-engines-token.outputs.token }}
85101
run: |
86-
if [[ -z "$GIT_HUB_TOKEN" ]]; then
87-
echo "::error::GIT_HUB_TOKEN is required to fetch private dependencies"
88-
exit 1
89-
fi
90102
git config --global \
91-
url."https://${GIT_HUB_TOKEN}:x-oauth-basic@github.com/".insteadOf \
92-
"https://github.com/"
103+
url."https://x-access-token:${BIOMETRIC_ENGINES_TOKEN}@github.com/worldcoin/biometric-engines".insteadOf \
104+
"https://github.com/worldcoin/biometric-engines"
93105
- name: Run tests
94106
run: cargo test --locked --all --verbose
95107

@@ -104,17 +116,21 @@ jobs:
104116
continue-on-error: ${{ matrix.checks == 'advisories' }}
105117
steps:
106118
- uses: actions/checkout@v4
119+
- name: Mint biometric-engines access token
120+
id: biometric-engines-token
121+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
122+
with:
123+
client-id: ${{ secrets.BIOMETRIC_ENGINES_APP_ID }}
124+
private-key: ${{ secrets.BIOMETRIC_ENGINES_APP_PRIVATE_KEY }}
125+
owner: worldcoin
126+
repositories: biometric-engines
107127
- name: Configure private Git dependencies
108128
env:
109-
GIT_HUB_TOKEN: ${{ secrets.GIT_HUB_TOKEN }}
129+
BIOMETRIC_ENGINES_TOKEN: ${{ steps.biometric-engines-token.outputs.token }}
110130
run: |
111-
if [[ -z "$GIT_HUB_TOKEN" ]]; then
112-
echo "::error::GIT_HUB_TOKEN is required to fetch private dependencies"
113-
exit 1
114-
fi
115131
git config --global \
116-
url."https://${GIT_HUB_TOKEN}:x-oauth-basic@github.com/".insteadOf \
117-
"https://github.com/"
132+
url."https://x-access-token:${BIOMETRIC_ENGINES_TOKEN}@github.com/worldcoin/biometric-engines".insteadOf \
133+
"https://github.com/worldcoin/biometric-engines"
118134
- uses: EmbarkStudios/cargo-deny-action@v2
119135
with:
120136
command: check ${{ matrix.checks }}

‎Dockerfile‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,26 +22,26 @@ COPY --from=planner /app/recipe.json recipe.json
2222
RUN --mount=type=secret,id=GITHUB_TOKEN,required=true \
2323
GITHUB_TOKEN="$(cat /run/secrets/GITHUB_TOKEN)" && \
2424
git config --global \
25-
url."https://${GITHUB_TOKEN}:x-oauth-basic@github.com/".insteadOf \
26-
"https://github.com/" && \
25+
url."https://x-access-token:${GITHUB_TOKEN}@github.com/worldcoin/biometric-engines".insteadOf \
26+
"https://github.com/worldcoin/biometric-engines" && \
2727
CARGO_NET_GIT_FETCH_WITH_CLI=true cargo chef cook --release --locked \
2828
--target x86_64-unknown-linux-musl \
2929
--recipe-path recipe.json \
3030
--package api && \
3131
git config --global --unset-all \
32-
url."https://${GITHUB_TOKEN}:x-oauth-basic@github.com/".insteadOf
32+
url."https://x-access-token:${GITHUB_TOKEN}@github.com/worldcoin/biometric-engines".insteadOf
3333
COPY . .
3434
RUN --mount=type=secret,id=GITHUB_TOKEN,required=true \
3535
GITHUB_TOKEN="$(cat /run/secrets/GITHUB_TOKEN)" && \
3636
git config --global \
37-
url."https://${GITHUB_TOKEN}:x-oauth-basic@github.com/".insteadOf \
38-
"https://github.com/" && \
37+
url."https://x-access-token:${GITHUB_TOKEN}@github.com/worldcoin/biometric-engines".insteadOf \
38+
"https://github.com/worldcoin/biometric-engines" && \
3939
CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release --locked \
4040
--target x86_64-unknown-linux-musl \
4141
--package api \
4242
&& mv target/x86_64-unknown-linux-musl/release/api /app/api-bin \
4343
&& git config --global --unset-all \
44-
url."https://${GITHUB_TOKEN}:x-oauth-basic@github.com/".insteadOf
44+
url."https://x-access-token:${GITHUB_TOKEN}@github.com/worldcoin/biometric-engines".insteadOf
4545

4646
FROM scratch AS runtime
4747
WORKDIR /app

‎secure-enclave/Dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,12 @@ COPY . .
2020
RUN --mount=type=secret,id=GITHUB_TOKEN,required=true \
2121
GITHUB_TOKEN="$(cat /run/secrets/GITHUB_TOKEN)" && \
2222
git config --global \
23-
url."https://${GITHUB_TOKEN}:x-oauth-basic@github.com/".insteadOf \
24-
"https://github.com/" && \
23+
url."https://x-access-token:${GITHUB_TOKEN}@github.com/worldcoin/biometric-engines".insteadOf \
24+
"https://github.com/worldcoin/biometric-engines" && \
2525
CARGO_NET_GIT_FETCH_WITH_CLI=true \
2626
cargo build --release --locked --package secure-enclave --bin secure-enclave && \
2727
git config --global --unset-all \
28-
url."https://${GITHUB_TOKEN}:x-oauth-basic@github.com/".insteadOf
28+
url."https://x-access-token:${GITHUB_TOKEN}@github.com/worldcoin/biometric-engines".insteadOf
2929

3030
FROM debian:bookworm-slim
3131

0 commit comments

Comments
 (0)