[codex] Apply generated cpflow GitHub Actions flow #732
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,124 @@ | ||
| name: Build Docker Image | ||
| description: Builds and pushes the app image for a Control Plane workload | ||
|
|
||
| inputs: | ||
| app_name: | ||
| description: Name of the application | ||
| required: true | ||
| org: | ||
| description: Control Plane organization name | ||
| required: true | ||
| commit: | ||
| description: Commit SHA to tag the image with | ||
| required: true | ||
| pr_number: | ||
| description: Pull request number for status messaging | ||
| required: false | ||
| docker_build_extra_args: | ||
| description: Optional newline-delimited extra docker build tokens. Use key=value forms like --build-arg=FOO=bar. | ||
| required: false | ||
| docker_build_ssh_key: | ||
| description: Optional private SSH key used for Docker builds that fetch private dependencies with RUN --mount=type=ssh | ||
| required: false | ||
| docker_build_ssh_known_hosts: | ||
| description: Optional SSH known_hosts entries used with docker_build_ssh_key. Defaults to pinned GitHub.com host keys; override if GitHub rotates keys or your build uses another SSH host. | ||
| required: false | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| # Keep SSH key handling in a dedicated step so DOCKER_BUILD_SSH_KEY is never present | ||
| # in the main build step's environment. ACTIONS_STEP_DEBUG=true dumps env before any | ||
| # command runs, so keeping the key out of env there avoids even admin-triggered exposure. | ||
| - name: Prepare SSH agent for Docker build | ||
| if: ${{ inputs.docker_build_ssh_key != '' }} | ||
| shell: bash | ||
| env: | ||
| # Pass the key via env so the file write is a single printf call rather than a | ||
| # heredoc with a fixed terminator (a heredoc would silently truncate the key if | ||
| # any line of the key value happened to match the terminator). Scope is still | ||
| # this step only — the build step below does not receive DOCKER_BUILD_SSH_KEY. | ||
| DOCKER_BUILD_SSH_KEY: ${{ inputs.docker_build_ssh_key }} | ||
| DOCKER_BUILD_SSH_KNOWN_HOSTS: ${{ inputs.docker_build_ssh_known_hosts }} | ||
| run: | | ||
| set -euo pipefail | ||
|
|
||
| umask 077 | ||
| mkdir -p ~/.ssh | ||
| chmod 700 ~/.ssh | ||
|
|
||
| if [[ -n "${DOCKER_BUILD_SSH_KNOWN_HOSTS}" ]]; then | ||
| printf '%s\n' "${DOCKER_BUILD_SSH_KNOWN_HOSTS}" > ~/.ssh/known_hosts | ||
| else | ||
| # GitHub.com host keys verified against GitHub's published keys on 2026-05-01. | ||
| # Override docker_build_ssh_known_hosts if GitHub rotates keys again. | ||
| printf '%s\n' \ | ||
| 'github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl' \ | ||
| 'github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=' \ | ||
| 'github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=' \ | ||
| > ~/.ssh/known_hosts | ||
| fi | ||
| chmod 600 ~/.ssh/known_hosts | ||
|
|
||
| printf '%s\n' "${DOCKER_BUILD_SSH_KEY}" > ~/.ssh/cpflow_build_key | ||
| chmod 600 ~/.ssh/cpflow_build_key | ||
|
|
||
| - name: Build Docker image | ||
| shell: bash | ||
| env: | ||
| APP_NAME: ${{ inputs.app_name }} | ||
| COMMIT_SHA: ${{ inputs.commit }} | ||
| CONTROL_PLANE_ORG: ${{ inputs.org }} | ||
| DOCKER_BUILD_EXTRA_ARGS: ${{ inputs.docker_build_extra_args }} | ||
| PR_NUMBER: ${{ inputs.pr_number }} | ||
| run: | | ||
| set -euo pipefail | ||
|
|
||
| PR_INFO="" | ||
| docker_build_args=() | ||
| ssh_agent_started=false | ||
|
|
||
| cleanup_build_ssh() { | ||
| if [[ "${ssh_agent_started}" == "true" ]]; then | ||
| ssh-agent -k >/dev/null || true | ||
| fi | ||
| rm -f "${HOME}/.ssh/cpflow_build_key" | ||
| } | ||
| trap cleanup_build_ssh EXIT | ||
|
|
||
| if [[ -n "${PR_NUMBER}" ]]; then | ||
| PR_INFO=" for PR #${PR_NUMBER}" | ||
| fi | ||
|
|
||
| if [[ -n "${DOCKER_BUILD_EXTRA_ARGS}" ]]; then | ||
| while IFS= read -r arg; do | ||
| arg="${arg%$'\r'}" | ||
| [[ -n "${arg}" ]] || continue | ||
|
|
||
| if [[ "${arg}" =~ [[:space:]] ]]; then | ||
| echo "docker_build_extra_args entries must be single docker-build tokens. " \ | ||
| "Use key=value forms like --build-arg=FOO=bar." >&2 | ||
| exit 1 | ||
|
There was a problem hiding this comment. This The cleanest fix is a dedicated cleanup step: - name: Remove SSH key
if: always()
shell: bash
run: rm -f "${HOME}/.ssh/cpflow_build_key"Alternatively, set the trap at the very top of this step (before the |
||
| fi | ||
|
|
||
| docker_build_args+=("${arg}") | ||
| done <<< "${DOCKER_BUILD_EXTRA_ARGS}" | ||
| fi | ||
|
|
||
| if [[ -f "${HOME}/.ssh/cpflow_build_key" ]]; then | ||
| eval "$(ssh-agent -s)" | ||
| ssh_agent_started=true | ||
| ssh-add "${HOME}/.ssh/cpflow_build_key" | ||
| docker_build_args+=("--ssh=default") | ||
| fi | ||
|
|
||
| echo "🏗️ Building Docker image${PR_INFO} (commit ${COMMIT_SHA})..." | ||
| cpflow build-image -a "${APP_NAME}" --commit="${COMMIT_SHA}" --org="${CONTROL_PLANE_ORG}" "${docker_build_args[@]}" | ||
| echo "✅ Docker image build successful${PR_INFO} (commit ${COMMIT_SHA})" | ||
|
|
||
| - name: Remove SSH key | ||
| if: ${{ always() }} | ||
| shell: bash | ||
| run: | | ||
| # Defence in depth for cancellations or future refactors around the build trap. | ||
| rm -f "${HOME}/.ssh/cpflow_build_key" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| name: Delete Control Plane App | ||
| description: Deletes a Control Plane app and all associated resources | ||
|
|
||
| inputs: | ||
| app_name: | ||
| description: Name of the application to delete | ||
| required: true | ||
| cpln_org: | ||
| description: Control Plane organization name | ||
| required: true | ||
| review_app_prefix: | ||
| description: Prefix used for review app names | ||
| required: true | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Delete application | ||
| shell: bash | ||
| run: ${{ github.action_path }}/delete-app.sh | ||
| env: | ||
| APP_NAME: ${{ inputs.app_name }} | ||
| CPLN_ORG: ${{ inputs.cpln_org }} | ||
| REVIEW_APP_PREFIX: ${{ inputs.review_app_prefix }} |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These three GitHub host keys are correct today, but GitHub has rotated keys before (the RSA key was replaced in March 2023). If rotation happens again, Docker SSH builds will fail until this action is updated.
Two mitigations worth considering:
# Verified 2025-05) so reviewers know how stale the pins might be.docker_build_ssh_known_hostsinput description that users can override these defaults — callers who need pinning stability can fetch current keys viassh-keyscan github.comin their own CI and supply them asvars.DOCKER_BUILD_SSH_KNOWN_HOSTS.