Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(ci): Secrets unavailable for deploy jobs #4215

Merged
merged 10 commits into from
Jun 24, 2024
Merged

fix(ci): Secrets unavailable for deploy jobs #4215

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
76cd41f
fix: Secrets unavailable for deploy jobs
khvn26 Jun 24, 2024
3a413e3
test
khvn26 Jun 24, 2024
8e54858
avoid chown
khvn26 Jun 24, 2024
cf4f2ad
quote the key?
khvn26 Jun 24, 2024
a095e43
quote gpg secret properly?
khvn26 Jun 24, 2024
26a4d4b
remove unused input
khvn26 Jun 24, 2024
84e8c70
bump aws action, unmask image-url output
khvn26 Jun 24, 2024
9906aff
testing done
khvn26 Jun 24, 2024
d5162f9
chown
khvn26 Jun 24, 2024
8d16f3f
finish testing
khvn26 Jun 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/actions/api-deploy-ecs/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ runs:

steps:
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v1-node16
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ inputs.aws_access_key_id }}
aws-secret-access-key: ${{ inputs.aws_secret_access_key }}
Expand Down
2 changes: 1 addition & 1 deletion .github/actions/task-processor-deploy-ecs/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ runs:

steps:
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v1-node16
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ inputs.aws_access_key_id }}
aws-secret-access-key: ${{ inputs.aws_secret_access_key }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/.reusable-deploy-ecs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,11 +33,12 @@ jobs:
uses: depot/setup-action@v1

- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v1-node16
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: eu-west-2
mask-aws-account-id: 'no'

- name: Login to Amazon ECR
id: login-ecr
Expand All @@ -61,7 +62,7 @@ jobs:
build-args: CI_COMMIT_SHA=${{ github.sha }}
secrets: |
github_private_cloud_token=${{ secrets.GH_PRIVATE_ACCESS_TOKEN }}
sse_pgp_pkey=${{ secrets.SSE_PGP_PRIVATE_KEY }}
"sse_pgp_pkey=${{ secrets.SSE_PGP_PRIVATE_KEY }}"
matthewelwell marked this conversation as resolved.
Show resolved Hide resolved
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
Expand All @@ -85,7 +86,6 @@ jobs:
aws_ecs_service_name: ${{ vars.AWS_ECS_SERVICE_NAME }}
aws_vpc_subnet_id: ${{ vars.AWS_VPC_SUBNET_ID }}
aws_ecs_security_group_id: ${{ vars.AWS_ECS_SECURITY_GROUP_ID }}
aws_ecr_repository_arn: ${{ vars.AWS_ECR_REPOSITORY_ARN }}
aws_identity_migration_event_bus_name: ${{ vars.AWS_IDENTITY_MIGRATION_EVENT_BUS_NAME }}
aws_identity_migration_event_bus_rule_id: ${{ vars.AWS_IDENTITY_MIGRATION_EVENT_BUS_RULE_ID }}
aws_identity_migration_task_role_arn: ${{ vars.AWS_IDENTITY_MIGRATION_TASK_ROLE_ARN }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/api-deploy-production-ecs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,3 +14,4 @@ jobs:
uses: ./.github/workflows/.reusable-deploy-ecs.yml
with:
environment: production
secrets: inherit
1 change: 1 addition & 0 deletions .github/workflows/api-deploy-staging-ecs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,3 +15,4 @@ jobs:
uses: ./.github/workflows/.reusable-deploy-ecs.yml
with:
environment: staging
secrets: inherit
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,8 +167,8 @@ FROM api-runtime-private as saas-api
RUN --mount=type=secret,id=sse_pgp_pkey \
apt-get update && apt-get install -y gnupg && \
gpg --import /run/secrets/sse_pgp_pkey && \
mv /root/.gnupg /app/; \
chown -R nobody /app/.gnupg
mv /root/.gnupg/ /app/ && \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you able to build this image without any GPG key?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you able to build this image without any GPG key?

There's no need as saas-api target is only intended for building with the key.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you able to build this image without any GPG key?

There's no need as saas-api target is only intended for building with the key.

Hmm, I am little confused… Is this file not used for private cloud? What if we want to build an image locally to test something?

Copy link
Member Author

@khvn26 khvn26 Jun 24, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is used for all of our targets now. To build the private-cloud target, you don't need the key; the GPG import is the only layer added by the saas-api target stage.

I'd love to make the key a runtime dependency and shave off one target, though! Let me know if you have an idea how to do that.

See Dockerfile comments and the PR description for details.

chown -R nobody /app/.gnupg/

ARG PYTHON_SITE_DIR
COPY --from=build-python-private ${PYTHON_SITE_DIR} ${PYTHON_SITE_DIR}
Expand Down
Loading