Skip to content

Latest commit

 

History

History
92 lines (63 loc) · 4.95 KB

manage-build-secrets.md

File metadata and controls

92 lines (63 loc) · 4.95 KB
Raw

How to manage secret values for automated builds and deploys

This document describes how we manage secret values for use in automated builds.

Tooling required

In order to work with these values, you will need:

The secrets needed

In order to build the network correctly, all build systems will need to have access to two values:

  1. The license code for the Advanced Custom Fields plugin.
  2. A Github "classic" token with repository scope, managed by the mitlib-wp-network-deploy user, for access to some private repositories.

Both current values can be found in the MIT Libraries' shared LastPass account, in the Shared-Product-Pantheon folder. The user credentials for the deploy user are also in that folder.

The Github token is currently set to expire every 90 days. New values can be generated by logging into that account and going to the Classic Tokens page within the Developer settings.

When you make a new token, your first step should be to save the new value in LastPass, before updating anything else.

For builds on Github, the following additional values are needed:

  1. A known_hosts file for deploying from Github to Pantheon.
  2. An SSH private key for deploying from Github to Pantheon.
  3. The SSH-format address of the Pantheon git repository.

The build processes

Working with the WordPress network involves a few different automated build processes, and each requires these two values to be stored in slightly different ways.

Local builds

Your local Composer installation will build the network when you are working locally. Composer stores its secrets in an auth.json file within your user profile, and it will manage the file on its own. If updates are needed, it will prompt you for the new value.

Github builds

We have a handful of automated checks within Github Actions, which run for every pull request. Additionally, there is a deploy workflow which pushes the master branch to the Dev tier within Pantheon when a PR merges.

These workflows require the following secrets to be defined:

  • ACF_PRO_KEY - The license file on its own.
  • COMPOSER_AUTH - A JSON structure which combines the ACF key and the token (the format for this value is provided in LastPass).
  • DEPLOY_SSH_KNOWN_HOSTS - The known_hosts file to allow Github's CI to trust the Pantheon git server.
  • DEPLOY_SSH_PRIVATE_KEY - The private key (with blank passphrase) used to connect to Pantheon's git server. The public key is added to your personal settings within Pantheon.
  • PANTHEON_REPOSITORY - The SSH-format address of the git repository in Pantheon.

These values can be defined, but not read, using the Actions secrets and variables page within this repository.

Pantheon builds

The Pantheon platform builds the WordPress application when deploying changes to any tier, including setting up new multidev instances and promoting changes to production.

Managing these values within Pantheon is done via the Terminus Secrets Manager plugin. Please see the readme for that project for installation and usage instructions.

There are three values defined by this plugin.

  • ACF_PRO_KEY - The license file on its own. This is an env type secret, with a scope of ic.
  • COMPOSER_AUTH - A JSON structure which combines the ACF key and the token (the format for this value is provided in LastPass). This is an env type secret, with a scope of ic, user.
  • github-oauth.github.com - The Github classic token on its own. This is a composer type secret, with a scope of user, ic.

The current configuration of these values can be seen via:

% terminus secret:list mitlib-wp-network
 ------------- ------------- ------------------------------------------------------------------------- --------------- 
  Secret name   Secret type   Secret value                                                              Secret scopes  
 ------------- ------------- ------------------------------------------------------------------------- --------------- 
  ...           ...           ...                                                                       ...
 ------------- ------------- ------------------------------------------------------------------------- ---------------