Environment ASK_REFRESH_TOKEN ignored

[DrPsychick]

I'm submitting a...

[ ] Regression (a behavior that used to work and stopped working in a new release)
[x] Bug report  
[ ] Performance issue
[ ] Feature request
[ ] Documentation issue or request 
[ ] Other... Please describe: 

Expected Behavior

I expect that, ASK_REFRESH_TOKEN, ASK_ACCESS_TOKEN, ASK_VENDOR_ID environment variables, if defined, take precedence over the values in the cli_config file.

Current Behavior

1. without cli_config it simply crashes
2. with a cli_config with invalid access_token and refresh_token it correctly displays "Token is invalid/expired."
3. even when setting the correct environment variables, ask still uses the values from the cli_config file

ASK_DEFAULT_PROFILE=default
ASK_ACCESS_TOKEN="Atza|IwEBIDef..."
ASK_REFRESH_TOKEN="Atzr|IwEBICM..."
ASK_VENDOR_ID="M2C.."

Steps to Reproduce (for bugs)

# set valid credentials via ENV
export ASK_DEFAULT_PROFILE=default
export ASK_ACCESS_TOKEN="Atza|IwEBIDef..."
export ASK_REFRESH_TOKEN="Atzr|IwEBICM..."
export ASK_VENDOR_ID="M2C.."
# edit your `cli_config` and edit `access_token` and `refresh_token` to become invalid

ask dialog --debug --replay mySkill.replay
[...]
Request headers: {"authorization":"Atza|IwEBIPE..." ...
# notice that the token used in the request is NOT the one provided via ENV

Possible Solution

Check why ENV is not working

• if ENV is given and there is no cli_config file, it should be created
• if ENV is given, it should always take precedence

Your Environment and Context

• ask-cli version: 2.24.1
• Operating System and version: macOS Big Sur (arm64)
• Node.js version used for development: v16.8.0
• NPM version used for development: 7.21.0

[galah92]

I'm having the exact same problem, trying to setup a CI to deploy my skills using GitHub Actions.
This is my current workflow:

name: Alexa

on:
  workflow_dispatch:

jobs:
  alexa-deploy:
    runs-on: [ubuntu-latest]
    defaults:
      run:
        working-directory: alexa-skill
    env:
      ASK_DEFAULT_PROFILE: "my-skill"
      ASK_ACCESS_TOKEN: ${{ secrets.ASK_ACCESS_TOKEN }}
      ASK_REFRESH_TOKEN: ${{ secrets.ASK_REFRESH_TOKEN }}
      ASK_VENDOR_ID: ${{ secrets.ASK_VENDOR_ID }}
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-node@v2
        with:
          node-version: "14"
          cache: "npm"
          cache-dependency-path: alexa-skill
      - run: npm install -g ask-cli
      - run: ask deploy --profile my-skill

And I'm getting the following:

Run ask deploy --profile walabothome-app-cloud
  ask deploy --profile walabothome-app-cloud
  shell: /usr/bin/bash -e {0}
  env:
    ASK_DEFAULT_PROFILE: my-skill
    ASK_ACCESS_TOKEN: ***
    ASK_REFRESH_TOKEN: ***
    ASK_VENDOR_ID: ***
    AWS_ACCESS_KEY_ID: ***
    AWS_SECRET_ACCESS_KEY: ***
Error: : ENOENT: no such file or directory, op
en '/home/runner/.ask/cli_config'
Error: Process completed with exit code 1.

Attached the raw log as well - alexa-raw-log.txt

Any chance to help with that? Without that working I cannot setup a proper CI flow.

[jrglg]

I'm having the same issue. Why is this still broken?

[CamdenFoucht]

@galah92

You can use environment variables when using the __ENVIRONMENT_ASK_PROFILE__. I don't believe the ask-cli supports using environment variables without explicitly using this profile.

You can add this profile in your ask-resources.json file like so:

  # ask-resources.json
  "profiles": {
    "__ENVIRONMENT_ASK_PROFILE__": {
      "skillMetadata": {
        "src": "./skill-package"
      },
      "code": {
        "default": {
          "src": "./lambda"
        }
      },
      "skillInfrastructure": {
        "userConfig": {
          "runtime": "nodejs12.x",
          "handler": "index.handler",
          "awsRegion": "us-east-1"
        },
        "type": "@ask-cli/lambda-deployer"
      }
    }
  }

For deploying in GitHub actions you can just run:

ask deploy or equivalently ask deploy --profile __ENVIRONMENT_ASK_PROFILE__.

It's likely the current errors you're receiving is because you are either specifying a profile or the CLI is using the default profile which does not support environment variables. Thus it will attempt to load you config from~/.ask/cli_config and you'll run into the file not existing or other related errors.

@DrPsychick Using the environment profile should fix the errors you're encountering with the ask dialog command.

[galah92]

You can use environment variables when using the __ENVIRONMENT_ASK_PROFILE__. I don't believe the ask-cli supports using environment variables without explicitly using this profile.

It should be supported according to the docs - see here. It specifically states for all environment variables that

When this environment variable exists, ASK CLI uses it instead of the credentials in the configuration file.

And this seems to be broken.

My use case include two different profiles for a single skill (one for a production environment, second for development environment), so using __ENVIRONMENT_ASK_PROFILE__ is not possible.

[DrPsychick]

So, I've tried using the --profile __ENVIRONMENT_ASK_PROFILE__, but that still requires a cli_config...

Then I renamed the default profile in the cli_config to __ENVIRONMENT_ASK_PROFILE__ and tried to pass ASK_REFRESH_TOKEN etc. via ENV - it did not work, it was still using the token from the cli_config.

So the provided solution above by @CamdenFoucht did not work for me as expected.
His PR #430 seems to be a proper solution to use environment variables - I hope we can see it approved and merged soon.

[CamdenFoucht]

@DrPsychick

When using __ENVIRONMENT_ASK_PROFILE__ did you specify all of:

• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
• ASK_VENDOR_ID
• ASK_REFRESH_TOKEN or ASK_ACCESS_TOKEN

It won't work unless all are specified I believe. I have tested this on the current CLI version and it works for me. https://github.com/alexa/ask-cli/blob/develop/docs/concepts/CI-CD.md

[DrPsychick]

You're right @CamdenFoucht , when specifying all of them it works and takes the values from the ENV. But still requires the cli_config, so your PR is highly appreciated!

[CamdenFoucht]

@DrPsychick Hmm. I'm currently doing it without the cli_config, so it should be possible without it!

[DrPsychick]

Again - you're right 😉 Thanks for your help with this!

[galah92]

@CamdenFoucht is there a way to support my case? Since I'm using the same code to deploy to two different skills (dev & prod), I can't use the __ENVIRONMENT_ASK_PROFILE__ env var.

[CamdenFoucht]

Hey @galah92

Maybe we could write the config files within the github action itself without needing to use ask config. Then we could use multiple profiles for CI/CD. I added a few steps to your github workflow doing this.

name: Alexa

on:
  workflow_dispatch:

jobs:
  alexa-deploy:
    runs-on: [ubuntu-latest]
    env:
      ASK_DEFAULT_PROFILE: "my-skill"
      ASK_ACCESS_TOKEN: ${{ secrets.ASK_ACCESS_TOKEN }}
      ASK_REFRESH_TOKEN: ${{ secrets.ASK_REFRESH_TOKEN }}
      ASK_VENDOR_ID: ${{ secrets.ASK_VENDOR_ID }}
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-node@v2
        with:
          node-version: "14"
      - run: |
            mkdir ~/.ask
            touch ~/.ask/cli_config
            jq -n --arg ask_default_profile "$ASK_DEFAULT_PROFILE" --arg ask_access_token "$ASK_ACCESS_TOKEN"  --arg ask_refresh_token "$ASK_REFRESH_TOKEN" --arg ask_vendor_id "$ASK_VENDOR_ID" '{"profiles": { "my-skill": {"token": {"access_token": "\($ask_access_token)", "refresh_token": "\($ask_refresh_token)", "token_type": "bearer", "expires_in": 3600, "expires_at": "2020-03-29T05:03:21.994Z"}, "vendor_id": "\($ask_vendor_id)", "aws_profile": "default"}}}' > ~/.ask/cli_config
            cat ~/.ask/cli_config
      - run: |
            mkdir ~/.aws
            touch ~/.aws/credentials
            echo [default] > ~/.aws/credentials
            echo aws_access_key_id="$AWS_ACCESS_KEY_ID" >> ~/.aws/credentials
            echo aws_secret_access_key="$AWS_SECRET_ACCESS_KEY" >> ~/.aws/credentials
            cat ~/.aws/credentials
      - run: npm install -g ask-cli
      - run: ask deploy --profile my-skill

Here is some of the outputs from the above steps:

the ~/.ask/cli_config file created

the ~/.aws/credentials file created

Now that the config is created, we can deploy the skill like you want specifying any profile that we configured in the action / that also exists in the ask-resources.json file. You can see in the image that it does a SMAPI skill package deployment and is able to create roles/deploy the lambdas.

Hope this helps!

[CamdenFoucht]

I will close this issue since @DrPsychick original issue was solved. @galah92 If you would like to request using a non __ENVIRONMENT_ASK_PROFILE__ profiles in a CI environment please make a feature request and we can get that addressed!