fix(ci): Correctly pass secrets to the k8s-deployments composite acti…

…ons (#120)
dfinity · Jan 26, 2024 · 41f0ce3 · 41f0ce3
1 parent 879cd7c
commit 41f0ce3
Show file tree

Hide file tree

Showing 4 changed files with 17 additions and 2 deletions.
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
@@ -47,6 +47,9 @@ jobs:
       - name: Call prepare release
         if: startsWith(github.ref, 'refs/tags/v')
         uses: ./.github/workflows/prepare-release.yml
+        with:
+          ARTIFACT_NAME: dre
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       ########################################
       # Upload container images
@@ -67,6 +70,8 @@ jobs:
       - name: Update k8s deployments
         if: ${{ startsWith(github.ref, 'refs/tags/v') || startsWith(github.head_ref, 'container') || startsWith(github.ref, 'refs/heads/container') || (github.ref == 'refs/heads/main') }}
         uses: ./.github/workflows/update-k8s-deployments
+        with:
+          gitlab_api_token: ${{ secrets.GITLAB_API_TOKEN }}
 
       ########################################
       # Clean up runner

diff --git a/.github/workflows/manage-runner-post/action.yaml b/.github/workflows/manage-runner-post/action.yaml
@@ -8,6 +8,7 @@ runs:
     # Optimize bazel cache by hard-linking duplicate files
     ########################################
     - name: Optimize bazel cache directory before uploading
+      if: ${{ github.ref == 'refs/heads/main' }}
       run: ./bin/optimize-bazel-cache.sh
       shell: bash
 

diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
@@ -6,6 +6,10 @@ on:
         required: true
         description: "Name of the artifact to download"
         type: string
+      GITHUB_TOKEN:
+        required: true
+        description: "GitHub token"
+        type: string
 
 jobs:
   prepare:
@@ -25,7 +29,7 @@ jobs:
         # v0.1.15
         uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ inputs.GITHUB_TOKEN }}
           body_path: CHANGELOG.md
           generate_release_notes: true
           draft: true

diff --git a/.github/workflows/update-k8s-deployments/action.yaml b/.github/workflows/update-k8s-deployments/action.yaml
@@ -1,11 +1,16 @@
 name: Update k8s deployments
 description: Reusable action for updating k8s deployments
 
+inputs:
+  gitlab_api_token:
+    description: 'A GitLab API token with access to the k8s repository'
+    required: true
+
 runs:
   using: composite
   steps:
     - env:
-        GITLAB_API_TOKEN: ${{ secrets.GITLAB_API_TOKEN }}
+        GITLAB_API_TOKEN: ${{ inputs.gitlab_api_token }}
       shell: bash
       run: |
         set -eExou pipefail