Skip to content

ci: use trusted publisher instead of token flow #1874

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jul 12, 2023
Merged

ci: use trusted publisher instead of token flow #1874

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6983e58
ci: use trusted publisher instead of token auth
amannocci Jul 10, 2023
b0c4f22
ci: backport changes to release workflow
amannocci Jul 10, 2023
fed88ec
ci: build also source distribution
amannocci Jul 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/packages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,8 @@ jobs:
run: pip install --user wheel
- name: Building universal wheel
run: python setup.py bdist_wheel
- name: Building source distribution
run: python setup.py sdist
- name: Upload Packages
uses: actions/upload-artifact@v3
with:
Expand Down
33 changes: 10 additions & 23 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,32 +20,19 @@ jobs:
- test
- packages
runs-on: ubuntu-latest
env:
PYPI_SECRET_PATH: secret/apm-team/ci/apm-agent-python-pypi-prod
environment: release
Copy link
Member

@reakaleek reakaleek Jul 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Q: What is the purpose of the environment here?

Copy link
Contributor Author

@amannocci amannocci Jul 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A: It allows to apply specific restriction about who trigger the workflow and is allowed to publish an artifact.

Configuring an environment is optional, but strongly recommended: with a GitHub environment, you can apply additional restrictions to your trusted workflow, such as requiring manual approval on each run by a trusted subset of repository maintainers.

Copy link
Contributor

@kuisathaverat kuisathaverat Jul 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The security applied by using environments is a side effect. I would not recommend using that approach.

Copy link
Member

@reakaleek reakaleek Jul 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The security applied by using environments is a side effect. I would not recommend using that approach.

From what I read here, it's designed for this usecase https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment.

I was just surprised to see no protection rules as checked in the environment settings. Hence, I did not understand why this was created.

Copy link
Contributor

@kuisathaverat kuisathaverat Jul 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is designed to approve deployments, not workflows; it is not strictly the same.

If you need approval to release something, maybe the trigger is not the creation of a tag. Maybe those tags should be created by the CI when you bump the version o a file, or you make another change in the repository that will require approval of a PR and will be triggered when you merge the PR.

permissions:
id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
steps:
- uses: actions/checkout@v3
- uses: hashicorp/vault-action@v2.4.2
with:
url: ${{ secrets.VAULT_ADDR }}
method: approle
roleId: ${{ secrets.VAULT_ROLE_ID }}
secretId: ${{ secrets.VAULT_SECRET_ID }}
secrets: |
${{ env.PYPI_SECRET_PATH }} user | TWINE_USER ;
${{ env.PYPI_SECRET_PATH }} password | TWINE_PASSWORD
- uses: actions/download-artifact@v3
with:
name: packages
path: dist
- name: Upload
run: |
python -m pip install --user twine
python setup.py sdist
echo "Uploading to ${REPO_URL} with user ${TWINE_USER}"
python -m twine upload --username "${TWINE_USER}" --password "${TWINE_PASSWORD}" --skip-existing --repository-url ${REPO_URL} dist/*.tar.gz
python -m twine upload --username "${TWINE_USER}" --password "${TWINE_PASSWORD}" --skip-existing --repository-url ${REPO_URL} dist/*.whl
env:
REPO_URL: "https://upload.pypi.org/legacy/"
uses: pypa/gh-action-pypi-publish@f5622bde02b04381239da3573277701ceca8f6a0
with:
repository-url: https://upload.pypi.org/legacy/

build-distribution:
uses: ./.github/workflows/build-distribution.yml
Expand All @@ -56,7 +43,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: hashicorp/vault-action@v2.5.0
- uses: hashicorp/vault-action@v2.7.2
with:
url: ${{ secrets.VAULT_ADDR }}
method: approle
Expand All @@ -74,7 +61,7 @@ jobs:
# Convert v1.2.3 to ver-1-2-3
VERSION=${GITHUB_REF_NAME/v/ver-}
VERSION=${VERSION//./-}

ELASTIC_LAYER_NAME="elastic-apm-python-${VERSION}" .ci/publish-aws.sh
- uses: actions/upload-artifact@v3
with:
Expand Down Expand Up @@ -113,7 +100,7 @@ jobs:
.
- name: Docker retag
run: >-
docker tag
docker tag
${{ steps.setup-docker.outputs.name }}:${{ steps.setup-docker.outputs.tag }}
${{ steps.setup-docker.outputs.name }}:latest
- name: Docker push
Expand All @@ -133,7 +120,7 @@ jobs:
with:
name: arn-file
- name: Create GitHub Draft Release
run: >-
run: >-
gh release create "${GITHUB_REF_NAME}"
--title="${GITHUB_REF_NAME}"
--generate-notes
Expand Down