Skip to content

Commit 8ec03dc

Browse files
vitormattosvitormattos
authored
fix: use configured app secrets in consumer workflows (#129)
Signed-off-by: Vitor Mattos <vitor@php.rio>
1 parent 5a16fb0 commit 8ec03dc

5 files changed

Lines changed: 27 additions & 13 deletions

File tree

‎patches/nextcloud/sync-workflow-templates.yml.patch‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
+ shell: bash
3939
+ env:
4040
+ AUTH_MODE: ${{ vars.WORKFLOW_SYNC_AUTH_MODE || 'librecode-app' }}
41-
+ LIBRECODE_APP_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
41+
+ LIBRECODE_APP_ID: ${{ secrets.LIBRECODE_WORKFLOW_APP_ID }}
4242
+ LIBRECODE_APP_PRIVATE_KEY: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
4343
+ CONSUMER_APP_ID: ${{ vars.WORKFLOW_SYNC_APP_ID }}
4444
+ CONSUMER_APP_PRIVATE_KEY: ${{ secrets.WORKFLOW_SYNC_APP_PRIVATE_KEY }}
@@ -78,7 +78,7 @@
7878
+ id: librecode-app-token
7979
+ uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
8080
+ with:
81-
+ app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
81+
+ app-id: ${{ secrets.LIBRECODE_WORKFLOW_APP_ID }}
8282
+ private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
8383
+ owner: ${{ github.repository_owner }}
8484
+ repositories: ${{ github.event.repository.name }}

‎tests/test_portable_workflow_sync_auth.py‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,13 @@ def test_external_modes_do_not_require_librecode_credentials(self) -> None:
2929
self.assertIn('github-app) token="${CONSUMER_APP_TOKEN}"', content)
3030
self.assertIn('token) token="${CONSUMER_TOKEN}"', content)
3131

32+
def test_librecode_app_credentials_use_actions_secrets(self) -> None:
33+
content = TEMPLATE.read_text(encoding="utf-8")
34+
35+
self.assertIn("LIBRECODE_APP_ID: ${{ secrets.LIBRECODE_WORKFLOW_APP_ID }}", content)
36+
self.assertIn("app-id: ${{ secrets.LIBRECODE_WORKFLOW_APP_ID }}", content)
37+
self.assertNotIn("vars.LIBRECODE_WORKFLOW_APP_ID", content)
38+
3239
def test_generated_pull_request_uses_selected_token(self) -> None:
3340
content = TEMPLATE.read_text(encoding="utf-8")
3441

‎tests/test_prepare_release_template.py‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,21 +43,28 @@ def test_dispatch_help_is_concise_and_explains_risky_inputs(self) -> None:
4343

4444
def test_template_delegates_all_release_stages_to_versioned_actions(self) -> None:
4545
content = TEMPLATE.read_text(encoding="utf-8")
46-
sha = "622599cc128ec55007b443d2908f78da930b8a21"
46+
sha = "5a16fb0ae5b846117f70e1d86a1d25e46492c333"
4747

4848
self.assertIn(
49-
f"actions/release-prepare@{sha} # v0.5.0",
49+
f"actions/release-prepare@{sha} # v0.6.2",
5050
content,
5151
)
5252
self.assertIn(
53-
f"actions/release-post-merge@{sha} # v0.5.0",
53+
f"actions/release-post-merge@{sha} # v0.6.2",
5454
content,
5555
)
5656
self.assertIn(
57-
f"actions/release-publication@{sha} # v0.5.0",
57+
f"actions/release-publication@{sha} # v0.6.2",
5858
content,
5959
)
6060

61+
def test_release_mutation_credentials_use_actions_secrets(self) -> None:
62+
content = TEMPLATE.read_text(encoding="utf-8")
63+
64+
self.assertEqual(2, content.count("secrets.LIBRECODE_WORKFLOW_APP_ID"))
65+
self.assertEqual(2, content.count("secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY"))
66+
self.assertNotIn("vars.LIBRECODE_WORKFLOW_APP_ID", content)
67+
6168
def test_template_keeps_permissions_stage_scoped(self) -> None:
6269
content = TEMPLATE.read_text(encoding="utf-8")
6370

‎workflow-templates/prepare-release.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ jobs:
8080
ref: ${{ inputs.ref != '' && inputs.ref || inputs.branch }}
8181

8282
- name: Prepare release
83-
uses: LibreCodeCoop/github-workflows/actions/release-prepare@622599cc128ec55007b443d2908f78da930b8a21 # v0.5.0
83+
uses: LibreCodeCoop/github-workflows/actions/release-prepare@5a16fb0ae5b846117f70e1d86a1d25e46492c333 # v0.6.2
8484
with:
8585
branch: ${{ inputs.branch }}
8686
ref: ${{ inputs.ref }}
@@ -93,7 +93,7 @@ jobs:
9393
config-path: .nextcloud-release.yml
9494
actor: ${{ github.actor }}
9595
github-token: ${{ secrets.GITHUB_TOKEN }}
96-
app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
96+
app-id: ${{ secrets.LIBRECODE_WORKFLOW_APP_ID }}
9797
app-private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
9898

9999
post_merge:
@@ -118,14 +118,14 @@ jobs:
118118
ref: ${{ github.event.pull_request.base.ref }}
119119

120120
- name: Finalize merged release
121-
uses: LibreCodeCoop/github-workflows/actions/release-post-merge@622599cc128ec55007b443d2908f78da930b8a21 # v0.5.0
121+
uses: LibreCodeCoop/github-workflows/actions/release-post-merge@5a16fb0ae5b846117f70e1d86a1d25e46492c333 # v0.6.2
122122
with:
123123
pull-request-number: ${{ github.event.pull_request.number }}
124124
merger: ${{ github.event.pull_request.merged_by.login }}
125125
config-path: .nextcloud-release.yml
126126
prepare-workflow-path: .github/workflows/prepare-release.yml
127127
github-token: ${{ secrets.GITHUB_TOKEN }}
128-
app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
128+
app-id: ${{ secrets.LIBRECODE_WORKFLOW_APP_ID }}
129129
app-private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
130130

131131
verify_publication:
@@ -145,7 +145,7 @@ jobs:
145145
ref: ${{ github.event.release.tag_name }}
146146

147147
- name: Verify publication
148-
uses: LibreCodeCoop/github-workflows/actions/release-publication@622599cc128ec55007b443d2908f78da930b8a21 # v0.5.0
148+
uses: LibreCodeCoop/github-workflows/actions/release-publication@5a16fb0ae5b846117f70e1d86a1d25e46492c333 # v0.6.2
149149
with:
150150
github-release-id: ${{ github.event.release.id }}
151151
config-path: .nextcloud-release.yml

‎workflow-templates/sync-workflow-templates.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646
shell: bash
4747
env:
4848
AUTH_MODE: ${{ vars.WORKFLOW_SYNC_AUTH_MODE || 'librecode-app' }}
49-
LIBRECODE_APP_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
49+
LIBRECODE_APP_ID: ${{ secrets.LIBRECODE_WORKFLOW_APP_ID }}
5050
LIBRECODE_APP_PRIVATE_KEY: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
5151
CONSUMER_APP_ID: ${{ vars.WORKFLOW_SYNC_APP_ID }}
5252
CONSUMER_APP_PRIVATE_KEY: ${{ secrets.WORKFLOW_SYNC_APP_PRIVATE_KEY }}
@@ -86,7 +86,7 @@ jobs:
8686
id: librecode-app-token
8787
uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
8888
with:
89-
app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
89+
app-id: ${{ secrets.LIBRECODE_WORKFLOW_APP_ID }}
9090
private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
9191
owner: ${{ github.repository_owner }}
9292
repositories: ${{ github.event.repository.name }}

0 commit comments

Comments
 (0)