ci: use trusted publisher instead of token flow #1874
Conversation
Signed-off-by: Adrien Mannocci <adrien.mannocci@elastic.co>
Signed-off-by: Adrien Mannocci <adrien.mannocci@elastic.co>
There was a problem hiding this comment.
I have the same concern as @beniwohli but otherwise this looks good.
| runs-on: ubuntu-latest | ||
| env: | ||
| PYPI_SECRET_PATH: secret/apm-team/ci/apm-agent-python-pypi-prod | ||
| environment: release |
There was a problem hiding this comment.
Q: What is the purpose of the environment here?
There was a problem hiding this comment.
A: It allows to apply specific restriction about who trigger the workflow and is allowed to publish an artifact.
Configuring an environment is optional, but strongly recommended: with a GitHub environment, you can apply additional restrictions to your trusted workflow, such as requiring manual approval on each run by a trusted subset of repository maintainers.
There was a problem hiding this comment.
The security applied by using environments is a side effect. I would not recommend using that approach.
There was a problem hiding this comment.
The security applied by using environments is a side effect. I would not recommend using that approach.
From what I read here, it's designed for this usecase https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment.
I was just surprised to see no protection rules as checked in the environment settings. Hence, I did not understand why this was created.
There was a problem hiding this comment.
It is designed to approve deployments, not workflows; it is not strictly the same.
If you need approval to release something, maybe the trigger is not the creation of a tag. Maybe those tags should be created by the CI when you bump the version o a file, or you make another change in the repository that will require approval of a PR and will be triggered when you merge the PR.
Signed-off-by: Adrien Mannocci <adrien.mannocci@elastic.co>
What is the change being made?
How has this been tested?
https://test.pypi.org/legacy/.Related Issues
Closes #1835