fix: only pull credentials after the release

.github/terraform-maintainers

@@ -0,0 +1,3 @@
+matttrach
+jiaqiluo
+HarrisonWAffel

.github/workflows/backport.yml

@@ -18,16 +18,38 @@ jobs:
             const parentIssueNumber = parentIssue.number;
             const repo = context.repo.repo;
             const owner = context.repo.owner;
+            const parentIssueBody = parentIssue.body;
+
+            const fs = require('fs'); // Import the Node.js file system module
+            const fileContent = fs.readFileSync('.github/terraform-maintainers', 'utf8');
+            const assignees = fileContent.split('\n').map(u => u.trim()).filter(Boolean);
+            if (assignees.length === 0) {
+              console.log('No assignees found in the team file.');
+              return;
+            }
+
+            if (!parentIssueBody) {
+              core.setFailed('Issue body is empty.');
+              return;
+            }
+            const regex = /https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/(\d+)/;
+            const match = parentIssueBody.match(regex);
+            if (!match) {
+              core.setFailed('Could not find a PR link in the issue body.');
+              return;
+            }
+            const prNumber = match[1];
+            console.log(`Found PR Number: ${prNumber}`);
 
             // Note: can't get terraform-maintainers team, the default token can't access org level objects
             // Create the sub-issue
             const newIssue = await github.rest.issues.create({
               owner: owner,
               repo: repo,
-              title: "Backport #" + parentIssueNumber + " to release/v0",
-              body:  "Backport #" + parentIssueNumber + " to release/v0",
+              title: `Backport #${prNumber} to release/v0`,
+              body:  `Backport #${prNumber} to release/v0 for #${parentIssueNumber}`,
               labels: ['release/v0'],
-              assignees: ['matttrach']
+              assignees: assignees
             });
 
             const subIssueId = newIssue.data.id;

.github/workflows/main-issue.yml

@@ -24,6 +24,14 @@ jobs:
               const versionLabel = releaseLabel.name.replace('release/', 'version/');
               newLabels.push(versionLabel);
             }
+            const fs = require('fs'); // Import the Node.js file system module
+            const fileContent = fs.readFileSync('.github/terraform-maintainers', 'utf8');
+            const assignees = fileContent.split('\n').map(u => u.trim()).filter(Boolean);
+            if (assignees.length === 0) {
+              console.log('No assignees found in the team file.');
+              return;
+            }
+
             // Note: can't get terraform-maintainers team, the default token can't access org level objects
             // Create the main issue
             // https://docs.github.com/en/rest/issues/issues?apiVersion=2022-11-28#create-an-issue
@@ -37,10 +45,10 @@ jobs:
                 "Please add comments for user issues which this issue addresses. \n\n" +
                 "Description copied from PR: \n" + pr.body,
               labels: newLabels,
-              assignees: ['matttrach']
+              assignees: assignees
             });
             if (releaseLabel) {
-              // if version label detected, then add appropriate sub-issues
+              // if release label detected, then add appropriate sub-issues
               const parentIssue = newIssue.data;
               const parentIssueTitle = parentIssue.title;
               const parentIssueNumber = parentIssue.number;
@@ -49,10 +57,10 @@ jobs:
               const newSubIssue = await github.rest.issues.create({
                 owner: owner,
                 repo: repo,
-                title: "Backport #" + parentIssueNumber + " to release/v0",
-                body:  "Backport #" + parentIssueNumber + " to release/v0",
+                title: `Backport #${pr.number} to release/v0`,
+                body:  `Backport #${pr.number} to release/v0 for #${parentIssueNumber}`,
                 labels: ['release/v0'],
-                assignees: ['matttrach']
+                assignees: assignees
               });
               const subIssueId = newSubIssue.data.id;
               // Attach the sub-issue to the parent using API request

.github/workflows/release.yml

@@ -90,9 +90,9 @@ jobs:
         uses: rancher-eio/read-vault-secrets@main
         with:
           secrets: |
-            secret/data/github/repo/rancher/${{ github.repository }}/signing/gpg passphrase | GPG_PASSPHRASE ;
-            secret/data/github/repo/rancher/${{ github.repository }}/signing/gpg privateKeyId | GPG_KEY_ID ;
-            secret/data/github/repo/rancher/${{ github.repository }}/signing/gpg privateKey | GPG_KEY
+            secret/data/github/repo/${{ github.repository }}/signing/gpg passphrase | GPG_PASSPHRASE ;
+            secret/data/github/repo/${{ github.repository }}/signing/gpg privateKeyId | GPG_KEY_ID ;
+            secret/data/github/repo/${{ github.repository }}/signing/gpg privateKey | GPG_KEY
       - name: import_gpg_key
         if: steps.release-please.outputs.pr && (steps.run-unit-tests.conclusion == 'success')
         env:
@@ -134,12 +134,13 @@ jobs:
           go-version-file: 'go.mod'
           cache: true
       - name: retrieve GPG Credentials
+        if: steps.release-please.outputs.version
         uses: rancher-eio/read-vault-secrets@main
         with:
           secrets: |
-            secret/data/github/repo/rancher/${{ github.repository }}/signing/gpg passphrase | GPG_PASSPHRASE ;
-            secret/data/github/repo/rancher/${{ github.repository }}/signing/gpg privateKeyId | GPG_KEY_ID ;
-            secret/data/github/repo/rancher/${{ github.repository }}/signing/gpg privateKey | GPG_KEY
+            secret/data/github/repo/${{ github.repository }}/signing/gpg passphrase | GPG_PASSPHRASE ;
+            secret/data/github/repo/${{ github.repository }}/signing/gpg privateKeyId | GPG_KEY_ID ;
+            secret/data/github/repo/${{ github.repository }}/signing/gpg privateKey | GPG_KEY
       - name: import_gpg_key
         if: steps.release-please.outputs.version
         env:

aspell_custom.txt

@@ -15,3 +15,4 @@ pr
 assignees
 backport
 url
+gpg