Skip to content

Commit a571e9b

Browse files
BarkinKctpBarkinKctp
committed
refactor: update workflows and scripts to use GitHub App token for authentication
1 parent 237d179 commit a571e9b

10 files changed

Lines changed: 102 additions & 76 deletions

‎.github/workflows/build-citus-community-nightlies.yml‎

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,6 @@ jobs:
2424
build_package:
2525
name: Build package
2626
runs-on: ubuntu-latest
27-
permissions:
28-
id-token: write
29-
contents: read
3027

3128
strategy:
3229
fail-fast: false
@@ -48,12 +45,18 @@ jobs:
4845
app-id: ${{ vars.GH_APP_ID }}
4946
private-key: ${{ secrets.GH_APP_KEY }}
5047
owner: ${{ github.repository_owner }}
51-
48+
49+
- name: Set GH_TOKEN for all steps
50+
run: echo "GH_TOKEN=${{ steps.app.outputs.token }}" >> $GITHUB_ENV
51+
5252
- name: Checkout repository
53-
uses: actions/checkout@v3
53+
uses: actions/checkout@v6
5454
with:
5555
token: ${{ steps.app.outputs.token }}
5656

57+
- name: Configure git with x-access-token
58+
run: git config --global url."https://x-access-token:${{ steps.app.outputs.token }}@github.com/".insteadOf "https://github.com/"
59+
5760

5861
# This step is to fetch the images unanonymously to have higher bandwidth
5962
- name: Login to Docker Hub
@@ -63,14 +66,10 @@ jobs:
6366
password: ${{ secrets.DOCKERHUB_PASSWORD }}
6467

6568
- name: Clone tools repo for test
66-
env:
67-
GH_TOKEN: ${{ steps.app.outputs.token }}
68-
run: git clone -b v0.8.35 --depth=1 https://x-access-token:${GH_TOKEN}@github.com/citusdata/tools.git tools
69+
run: git clone -b v0.8.35 --depth=1 https://github.com/citusdata/tools.git tools
6970

7071
- name: Clone build branch
71-
env:
72-
GH_TOKEN: ${{ steps.app.outputs.token }}
73-
run: git clone -b "${MAIN_BRANCH}" --depth=1 https://x-access-token:${GH_TOKEN}@github.com/citusdata/packaging.git packaging
72+
run: git clone -b "${MAIN_BRANCH}" --depth=1 https://github.com/citusdata/packaging.git packaging
7473

7574
- name: Install package dependencies
7675
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
@@ -79,8 +78,6 @@ jobs:
7978
run: python -m pip install -r tools/packaging_automation/requirements.txt
8079

8180
- name: Build packages
82-
env:
83-
GH_TOKEN: ${{ steps.app.outputs.token }}
8481
run: |
8582
python -m tools.packaging_automation.citus_package \
8683
--gh_token "${GH_TOKEN}" \
@@ -93,8 +90,6 @@ jobs:
9390
--is_test
9491
9592
- name: Publish packages
96-
env:
97-
GH_TOKEN: ${{ steps.app.outputs.token }}
9893
run: |
9994
python -m tools.packaging_automation.upload_to_package_cloud \
10095
--platform "${{ matrix.platform }}" \

‎.github/workflows/build-package-test.yml‎

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
runs-on: ubuntu-latest
2626
steps:
2727
- name: Checkout repository
28-
uses: actions/checkout@v2
28+
uses: actions/checkout@v6
2929
- name: Update and check dockerfiles
3030
run: |
3131
./update_dockerfiles
@@ -65,11 +65,17 @@ jobs:
6565
private-key: ${{ secrets.GH_APP_KEY }}
6666
owner: ${{ github.repository_owner }}
6767

68+
- name: Set GH_TOKEN for all steps
69+
run: echo "GH_TOKEN=${{ steps.app.outputs.token }}" >> $GITHUB_ENV
70+
6871
- name: Checkout repository
69-
uses: actions/checkout@v2
72+
uses: actions/checkout@v6
7073
with:
7174
token: ${{ steps.app.outputs.token }}
7275

76+
- name: Configure git with x-access-token
77+
run: git config --global url."https://x-access-token:${{ steps.app.outputs.token }}@github.com/".insteadOf "https://github.com/"
78+
7379
- name: Install package dependencies
7480
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
7581

@@ -84,18 +90,10 @@ jobs:
8490
env:
8591
TARGET_PLATFORM: ${{ matrix.TARGET_PLATFORM }}
8692
POSTGRES_VERSION: ${{ matrix.POSTGRES_VERSION }}
87-
GH_TOKEN: ${{ steps.app.outputs.token }}
8893

89-
- name: Setup git authentication for GitHub App
90-
env:
91-
GH_TOKEN: ${{ steps.app.outputs.token }}
92-
run: |
93-
git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
9494

9595
- name: Clone tools repo for test
96-
env:
97-
GH_TOKEN: ${{ steps.app.outputs.token }}
98-
run: git clone -b v0.8.35 --depth=1 https://x-access-token:${GH_TOKEN}@github.com/citusdata/tools.git tools
96+
run: git clone -b v0.8.35 --depth=1 https://github.com/citusdata/tools.git tools
9997

10098
- name: Execute packaging tests
10199
run: |

‎.github/workflows/build-package.yml‎

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
runs-on: ubuntu-latest
2626
steps:
2727
- name: Checkout repository
28-
uses: actions/checkout@v2
28+
uses: actions/checkout@v6
2929
- name: Update and check dockerfiles
3030
run: |
3131
./update_dockerfiles
@@ -64,17 +64,17 @@ jobs:
6464
private-key: ${{ secrets.GH_APP_KEY }}
6565
owner: ${{ github.repository_owner }}
6666

67-
- name: Setup git authentication for GitHub App
68-
env:
69-
GH_TOKEN: ${{ steps.app.outputs.token }}
70-
run: |
71-
git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
67+
- name: Set GH_TOKEN for all steps
68+
run: echo "GH_TOKEN=${{ steps.app.outputs.token }}" >> $GITHUB_ENV
7269

7370
- name: Checkout repository
74-
uses: actions/checkout@v2
71+
uses: actions/checkout@v6
7572
with:
7673
token: ${{ steps.app.outputs.token }}
7774

75+
- name: Configure git with x-access-token
76+
run: git config --global url."https://x-access-token:${{ steps.app.outputs.token }}@github.com/".insteadOf "https://github.com/"
77+
7878
- name: Install package dependencies
7979
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
8080

@@ -89,20 +89,16 @@ jobs:
8989
env:
9090
TARGET_PLATFORM: ${{ matrix.TARGET_PLATFORM }}
9191
POSTGRES_VERSION: ${{ matrix.POSTGRES_VERSION }}
92-
GH_TOKEN: ${{ steps.app.outputs.token }}
9392

9493
- name: Clone tools repo for test
95-
env:
96-
GH_TOKEN: ${{ steps.app.outputs.token }}
97-
run: git clone -b v0.8.35 --depth=1 https://x-access-token:${GH_TOKEN}@github.com/citusdata/tools.git tools
94+
run: git clone -b v0.8.35 --depth=1 https://github.com/citusdata/tools.git tools
9895

9996
- name: Execute packaging tests
10097
run: |
10198
python -m pip install -r tools/packaging_automation/requirements.txt
10299
python -m pytest -q tools/packaging_automation/tests/test_citus_package.py -k 'test_build_packages'
103100
env:
104101
PACKAGING_IMAGE_PLATFORM: "${{matrix.TARGET_PLATFORM}}"
105-
GH_TOKEN: ${{ steps.app.outputs.token }}
106102

107103
- name: Push images
108104
run: |

‎.github/workflows/build-pgazure-nightlies.yml‎

Lines changed: 8 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -45,16 +45,16 @@ jobs:
4545
private-key: ${{ secrets.GH_APP_KEY }}
4646
owner: ${{ github.repository_owner }}
4747

48+
- name: Set GH_TOKEN for all steps
49+
run: echo "GH_TOKEN=${{ steps.app.outputs.token }}" >> $GITHUB_ENV
50+
4851
- name: Checkout repository
49-
uses: actions/checkout@v2
52+
uses: actions/checkout@v6
5053
with:
5154
token: ${{ steps.app.outputs.token }}
5255

53-
- name: Setup git authentication for GitHub App
54-
env:
55-
GH_TOKEN: ${{ steps.app.outputs.token }}
56-
run: |
57-
git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
56+
- name: Configure git with x-access-token
57+
run: git config --global url."https://x-access-token:${{ steps.app.outputs.token }}@github.com/".insteadOf "https://github.com/"
5858

5959
# This step is to fetch the images unanonymously to have higher bandwidth
6060
- name: Login to Docker Hub
@@ -64,14 +64,10 @@ jobs:
6464
password: ${{ secrets.DOCKERHUB_PASSWORD }}
6565

6666
- name: Clone tools branch
67-
env:
68-
GH_TOKEN: ${{ steps.app.outputs.token }}
69-
run: git clone -b v0.8.35 --depth=1 https://x-access-token:${GH_TOKEN}@github.com/citusdata/tools.git tools
67+
run: git clone -b v0.8.35 --depth=1 https://github.com/citusdata/tools.git tools
7068

7169
- name: Clone build branch
72-
env:
73-
GH_TOKEN: ${{ steps.app.outputs.token }}
74-
run: git clone -b "${MAIN_BRANCH}" --depth=1 https://x-access-token:${GH_TOKEN}@github.com/citusdata/packaging.git packaging
70+
run: git clone -b "${MAIN_BRANCH}" --depth=1 https://github.com/citusdata/packaging.git packaging
7571

7672
- name: Install package dependencies
7773
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
@@ -80,8 +76,6 @@ jobs:
8076
run: python -m pip install -r tools/packaging_automation/requirements.txt
8177

8278
- name: Build packages
83-
env:
84-
GH_TOKEN: ${{ steps.app.outputs.token }}
8579
run: |
8680
python -m tools.packaging_automation.citus_package \
8781
--gh_token "${GH_TOKEN}" \
@@ -93,8 +87,6 @@ jobs:
9387
--input_files_dir "$(pwd)/packaging"
9488
9589
- name: Publish packages
96-
env:
97-
GH_TOKEN: ${{ steps.app.outputs.token }}
9890
run: |
9991
python -m tools.packaging_automation.upload_to_package_cloud \
10092
--platform "${{ matrix.platform }}" \

‎.github/workflows/image-health-check.yml‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,17 @@ jobs:
3535
private-key: ${{ secrets.GH_APP_KEY }}
3636
owner: ${{ github.repository_owner }}
3737

38+
- name: Set GH_TOKEN for all steps
39+
run: echo "GH_TOKEN=${{ steps.app.outputs.token }}" >> $GITHUB_ENV
40+
3841
- name: Check out repository
39-
uses: actions/checkout@v2
42+
uses: actions/checkout@v6
4043
with:
4144
token: ${{ steps.app.outputs.token }}
4245

46+
- name: Configure git with x-access-token
47+
run: git config --global url."https://x-access-token:${{ steps.app.outputs.token }}@github.com/".insteadOf "https://github.com/"
48+
4349
- name: Update and check dockerfiles
4450
run: |
4551
./update_dockerfiles
@@ -79,11 +85,17 @@ jobs:
7985
private-key: ${{ secrets.GH_APP_KEY }}
8086
owner: ${{ github.repository_owner }}
8187

88+
- name: Set GH_TOKEN for all steps
89+
run: echo "GH_TOKEN=${{ steps.app.outputs.token }}" >> $GITHUB_ENV
90+
8291
- name: Checkout repository
83-
uses: actions/checkout@v2
92+
uses: actions/checkout@v6
8493
with:
8594
token: ${{ steps.app.outputs.token }}
8695

96+
- name: Configure git with x-access-token
97+
run: git config --global url."https://x-access-token:${{ steps.app.outputs.token }}@github.com/".insteadOf "https://github.com/"
98+
8799
- name: Install package dependencies
88100
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
89101

@@ -101,15 +113,12 @@ jobs:
101113

102114

103115
- name: Clone tools repo for test
104-
env:
105-
GH_TOKEN: ${{ steps.app.outputs.token }}
106-
run: git clone -b v0.8.35 --depth=1 https://x-access-token:${GH_TOKEN}@github.com/citusdata/tools.git tools
116+
run: git clone -b v0.8.35 --depth=1 https://github.com/citusdata/tools.git tools
107117

108118
- name: Execute packaging tests
109119
run: |
110120
python -m pip install -r tools/packaging_automation/requirements.txt
111121
python -m pytest -q tools/packaging_automation/tests/test_citus_package.py -k 'test_build_packages'
112122
env:
113123
PACKAGING_IMAGE_PLATFORM: "${{matrix.TARGET_PLATFORM}}"
114-
GH_TOKEN: ${{ steps.app.outputs.token }}
115124

‎.github/workflows/update-pgxn-version.yml‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,31 +24,27 @@ jobs:
2424
private-key: ${{ secrets.GH_APP_KEY }}
2525
owner: ${{ github.repository_owner }}
2626

27+
- name: Set GH_TOKEN for all steps
28+
run: echo "GH_TOKEN=${{ steps.app.outputs.token }}" >> $GITHUB_ENV
29+
2730
- name: Check out repository
28-
uses: actions/checkout@v2
31+
uses: actions/checkout@v6
2932
with:
3033
token: ${{ steps.app.outputs.token }}
3134

32-
- name: Setup git authentication for GitHub App
33-
env:
34-
GH_TOKEN: ${{ steps.app.outputs.token }}
35-
run: |
36-
git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
35+
- name: Configure git with x-access-token
36+
run: git config --global url."https://x-access-token:${{ steps.app.outputs.token }}@github.com/".insteadOf "https://github.com/"
3737

3838
- name: Install dependencies
3939
run: sudo apt install libcurl4-openssl-dev libssl-dev
4040

4141
- name: Clone Tools branch
42-
env:
43-
GH_TOKEN: ${{ steps.app.outputs.token }}
44-
run: git clone --branch v0.8.35 https://x-access-token:${GH_TOKEN}@github.com/citusdata/tools.git
42+
run: git clone --branch v0.8.35 https://github.com/citusdata/tools.git
4543

4644
- name: Install Python requirements
4745
run: python -m pip install -r tools/packaging_automation/requirements.txt
4846

4947
- name: Update pgxn files
50-
env:
51-
GH_TOKEN: ${{ steps.app.outputs.token }}
5248
run: |
5349
python -m tools.packaging_automation.update_pgxn \
5450
--prj_ver ${PROJECT_VERSION} \

‎.github/workflows/update_package_properties.yml‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,24 @@ jobs:
1818

1919
# Steps represent a sequence of tasks that will be executed as part of the job
2020
steps:
21-
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
22-
- uses: actions/checkout@v2
21+
- name: Create GitHub App token
22+
id: app
23+
uses: actions/create-github-app-token@v1
24+
with:
25+
app-id: ${{ vars.GH_APP_ID }}
26+
private-key: ${{ secrets.GH_APP_KEY }}
27+
owner: ${{ github.repository_owner }}
28+
29+
- name: Set GH_TOKEN for all steps
30+
run: echo "GH_TOKEN=${{ steps.app.outputs.token }}" >> $GITHUB_ENV
31+
32+
- name: Checkout repository
33+
uses: actions/checkout@v6
34+
with:
35+
token: ${{ steps.app.outputs.token }}
36+
37+
- name: Configure git with x-access-token
38+
run: git config --global url."https://x-access-token:${{ steps.app.outputs.token }}@github.com/".insteadOf "https://github.com/"
2339

2440
# Runs a single command using the runners shell
2541
- name: Clone Tools branch

‎scripts/fetch_and_build_deb‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,15 @@ if [ -z "${pkglatest}" ]; then
8888
exit $noinput
8989
fi
9090

91-
echo "header=\"Authorization: token ${GITHUB_TOKEN}\"" > ~/.curlrc
91+
if [ -z "${GH_TOKEN:-}" ]; then
92+
echo "$0: GH_TOKEN (GitHub App token) is required but not set" >&2
93+
exit 66
94+
fi
95+
96+
echo "header=\"Authorization: Bearer ${GH_TOKEN}\"" > ~/.curlrc
97+
98+
# ensuring GH_TOKEN usage for clones/fetches
99+
git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
92100

93101
export NAME
94102
NAME=$(determine_name)

‎scripts/fetch_and_build_pgxn‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,15 @@ if [ -z "${pkglatest}" ]; then
5050
exit $noinput
5151
fi
5252

53-
echo "header=\"Authorization: token ${GITHUB_TOKEN}\"" > ~/.curlrc
53+
if [ -z "${GH_TOKEN:-}" ]; then
54+
echo "$0: GH_TOKEN (GitHub App token) is required but not set" >&2
55+
exit 66
56+
fi
57+
58+
echo "header=\"Authorization: Bearer ${GH_TOKEN}\"" > ~/.curlrc
59+
60+
# ensuring GH_TOKEN usage for clones/fetches
61+
git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
5462

5563
cp -R /buildfiles/META.json "${builddir}"
5664
repopath="citusdata/${hubproj}"

‎scripts/fetch_and_build_rpm‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,15 @@ if [ -z "${pkglatest}" ]; then
8181
exit $noinput
8282
fi
8383

84-
echo "header=\"Authorization: token ${GITHUB_TOKEN}\"" > ~/.curlrc
84+
if [ -z "${GH_TOKEN:-}" ]; then
85+
echo "$0: GH_TOKEN (GitHub App token) is required but not set" >&2
86+
exit 66
87+
fi
88+
89+
echo "header=\"Authorization: Bearer ${GH_TOKEN}\"" > ~/.curlrc
90+
91+
# ensuring GH_TOKEN usage for clones/fetches
92+
git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
8593

8694
name=$(determine_name)
8795
email=$(determine_email)

0 commit comments

Comments
 (0)