From 67242ea7c85ddd5ed5070507f74935b09047b55b Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Fri, 9 Oct 2026 12:39:15 -0700 Subject: [PATCH 1/2] chore(gocd): expose App credentials to image deploy jobs --- gocd/templates/pipelines/conduit.libsonnet | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/gocd/templates/pipelines/conduit.libsonnet b/gocd/templates/pipelines/conduit.libsonnet index 214b374..fad18de 100644 --- a/gocd/templates/pipelines/conduit.libsonnet +++ b/gocd/templates/pipelines/conduit.libsonnet @@ -2,6 +2,9 @@ local gocdtasks = import 'github.com/getsentry/gocd-jsonnet/libs/gocd-tasks.libs function(region) { environment_variables: { + // k8s-deploy dispatches GitHub workflows using these App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', // SENTRY_REGION is used by the dev-infra scripts to connect to GKE SENTRY_REGION: region, }, @@ -22,10 +25,6 @@ function(region) { checks: { timeout: 10, elastic_profile_id: 'conduit', - environment_variables: { - GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', - GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', - }, tasks: [ gocdtasks.script(importstr '../bash/check-github-runs.sh'), ], From d33e97d8820ee7bf066e49de8f641b3f59b173e2 Mon Sep 17 00:00:00 2001 From: joshuarli Date: Fri, 9 Oct 2026 13:54:21 -0700 Subject: [PATCH 2/2] fix(gocd): scope workflow credentials to deployment jobs --- gocd/templates/pipelines/conduit.libsonnet | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/gocd/templates/pipelines/conduit.libsonnet b/gocd/templates/pipelines/conduit.libsonnet index fad18de..b615e10 100644 --- a/gocd/templates/pipelines/conduit.libsonnet +++ b/gocd/templates/pipelines/conduit.libsonnet @@ -2,9 +2,6 @@ local gocdtasks = import 'github.com/getsentry/gocd-jsonnet/libs/gocd-tasks.libs function(region) { environment_variables: { - // k8s-deploy dispatches GitHub workflows using these App credentials. - GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', - GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', // SENTRY_REGION is used by the dev-infra scripts to connect to GKE SENTRY_REGION: region, }, @@ -25,6 +22,10 @@ function(region) { checks: { timeout: 10, elastic_profile_id: 'conduit', + environment_variables: { + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', + }, tasks: [ gocdtasks.script(importstr '../bash/check-github-runs.sh'), ], @@ -40,6 +41,9 @@ function(region) { timeout: 20, elastic_profile_id: 'conduit', environment_variables: { + // k8s-deploy dispatches GitHub workflows using these App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', LABEL_SELECTOR: 'service=conduit', }, tasks: [