fix(ci): Secrets unavailable for deploy jobs #4215
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎ 3 Ignored Deployments
|
|
Uffizzi Preview |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #4215 +/- ##
==========================================
+ Coverage 96.51% 96.53% +0.01%
==========================================
Files 1177 1177
Lines 38307 38368 +61
==========================================
+ Hits 36973 37037 +64
+ Misses 1334 1331 -3 ☔ View full report in Codecov by Sentry. |
khvn26
force-pushed
the
fix/ecs-deploy-secrets
branch
from
d9f442c to
84e8c70
Compare
khvn26
changed the title
Dockerfile
Outdated
| mv /root/.gnupg /app/; \ | ||
| chown -R nobody /app/.gnupg | ||
| mv /root/.gnupg/ /app/ |
There was a problem hiding this comment.
I'm keen to get @gagantrivedi's review here as well to make sure we know what we need to test.
There was a problem hiding this comment.
Sure. The image has been deployed to staging so we just need to verify SSE there.
There was a problem hiding this comment.
Yeah, we have to make sure sse events are still reaching influx
| @@ -167,8 +167,8 @@ FROM api-runtime-private as saas-api | |||
| RUN --mount=type=secret,id=sse_pgp_pkey \ | |||
| apt-get update && apt-get install -y gnupg && \ | |||
| gpg --import /run/secrets/sse_pgp_pkey && \ | |||
| mv /root/.gnupg /app/; \ | |||
| chown -R nobody /app/.gnupg | |||
| mv /root/.gnupg/ /app/ && \ | |||
There was a problem hiding this comment.
Are you able to build this image without any GPG key?
There was a problem hiding this comment.
Are you able to build this image without any GPG key?
There's no need as saas-api target is only intended for building with the key.
There was a problem hiding this comment.
Are you able to build this image without any GPG key?
There's no need as
saas-apitarget is only intended for building with the key.
Hmm, I am little confused… Is this file not used for private cloud? What if we want to build an image locally to test something?
There was a problem hiding this comment.
This file is used for all of our targets now. To build the private-cloud target, you don't need the key; the GPG import is the only layer added by the saas-api target stage.
I'd love to make the key a runtime dependency and shave off one target, though! Let me know if you have an idea how to do that.
See Dockerfile comments and the PR description for details.
Thanks for submitting a PR! Please check the boxes below:
pre-committo check lintingdocs/if required so people know about the feature!Changes
Fixes deploy jobs.
How did you test this code?
This is a CI change.