Packaging: GH App token migration (phase 2) - app-token mint + dev5 pin#1184
Open
ihalatci wants to merge 7 commits into
Open
Packaging: GH App token migration (phase 2) - app-token mint + dev5 pin#1184ihalatci wants to merge 7 commits into
ihalatci wants to merge 7 commits into
Conversation
Mint a GitHub App token (actions/create-github-app-token@v3) per job and export it to GH_TOKEN + GITHUB_TOKEN via \, overriding the workflow-level token for subsequent steps. Workflow-level secrets.GH_TOKEN refs are kept live (removed only in Phase 6). Bump tools pin v0.8.36-dev2 -> v0.8.36-dev3 in the 5 signing/publish/health workflows. docker/login-action already at @v4. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Fold the two leftover v0.8.35 tools clones (update-pgxn-version.yml, update_package_properties.yml) into the Phase 2 dev3 pin so all tools references are consistent. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…n fix) GitHub App installation tokens have no /user endpoint and return 403, which aborted the build container at the identity assignment with empty output. Resolve packager identity env-first (PACKAGER_NAME/PACKAGER_EMAIL, RPM_PACKAGER, DEBFULLNAME/DEBEMAIL) with a fixed 'Citus Bot <bots@citusdata.com>' fallback so the all-platforms test path greens without identity env. ~/.curlrc writes are retained (reused for App-safe /repos + tarball source fetch). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…6-dev4 Roll-forward fix for the rpm reds: pass the matrix leg's POSTGRES_VERSION into the 'Execute packaging tests' env so dev4's test_build_packages builds+tests ONLY the leg's own locally-built, R1-fixed image instead of iterating all pg versions and docker-pulling stale sibling images (which 403 on /user under the App token). deb/pgxn include-legs leave POSTGRES_VERSION empty -> None -> all/[all], no regression. Re-pins the pytest tools-clone dev3->dev4 in the 3 build/test workflows. Token mints (@V3), docker/login (@v4), the determine_name/determine_email R1 fix, and the dev3 pins in the 4 nightly/write workflows are untouched. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
dev5 fixes the two remaining rpm test-harness bugs surfaced by dev4: (1) the build-count assertion now expects 1xcount when POSTGRES_VERSION is set, and (2) pytest.skip when the leg's matrix pg version is not in the distro's release set (so pg14/pg18 legs skip the test but still run push_images to reseed their update_image-built base images). POSTGRES_VERSION env (added previously) stays as-is. Token mints (@V3), docker/login (@v4), the R1 determine_name/determine_email fix, and the dev3 pins in the 4 nightly/write workflows are untouched. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bump the 4 nightly/write workflows (build-citus-community-nightlies, build-pgazure-nightlies, update-pgxn-version, update_package_properties) from v0.8.36-dev3 to v0.8.36-dev5 so every workflow in the repo pins the same tools tag. dev3..dev5 changes only packaging_automation/citus_package.py (new optional postgres_version arg, default None -> identical iteration when unset) and tests/test_citus_package.py (pytest-only). Neither nightly passes postgres_version, and update-*/update_package_properties do not invoke citus_package.py, so behavior is unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
GH_APP_ID is an org variable, not a secret. Simplify the create-github-app-token app-id input from vars.GH_APP_ID || secrets.GH_APP_ID to just vars.GH_APP_ID across all 6 token mints. private-key stays secrets.GH_APP_KEY (a real secret). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 2 of the citusdata CI migration from the org PAT secret
GH_TOKENto a GitHub App installation token, for the packaging workflows. Three coordinated parts plus the script fix the App token exposed:1. App-token mint (replaces org PAT)
Replace the
GH_TOKENorg-PAT secret with a per-run GitHub App installation token viaactions/create-github-app-token@v3in all token-consuming workflows:app-id: ${{ vars.GH_APP_ID }}(GH_APP_ID is an org variable, not a secret -- no secrets fallback)private-key: ${{ secrets.GH_APP_KEY }}(real secret, retained)$GITHUB_ENV(GH_TOKEN+GITHUB_TOKEN) so downstream steps/containers receive the App tokendocker/login-action@v4where a DockerHub login exists (the 2 nightly workflows)2. Tools-clone pin -> v0.8.36-dev5
Pin all 7 workflow tools-clones to
v0.8.36-dev5(addsbuild_packagesper-pg-version filter + pytest harness fixes: filtered-count assertion + graceful skip for out-of-set pg versions). The dev3->dev5 delta is behaviorally inert for callers that don't passpostgres_version(guarded byif postgres_version:), so nightly/write workflows iterate identically to before.3. R1 fix -- drop /user from bot identity resolution
scripts/determine_name/scripts/determine_emailpreviously curledhttps://api.github.com/user, which 403s under an App installation token (the App identity has no/userendpoint) and, underset -euo pipefail, aborted the build with empty output. Fixed to resolve the packager identity from env first (PACKAGER_NAME/PACKAGER_EMAIL->RPM_PACKAGER/DEBFULLNAME/DEBEMAIL) with a fixedCitus Bot <bots@citusdata.com>fallback -- no/usercall. The R1-fixed images have been reseeded into thecitus/packaging-test:*registry tags.Validation
All 4 push-event workflows GREEN on
ae12aad:vars.GH_APP_IDresolves with no fallback.Package publishing skipped since current branch is not equal to develop) -- nothing published from the feature branch.GH_TOKENretained live throughout (zero-downtime; shadowed PAT removal deferred to a later decommission phase).Dependency
Relies on tools tag
v0.8.36-dev5(citusdata/tools PR #410) being merged/stable before this is re-pinned to a stable tag.Notes
app-iddeprecation annotation (app-id->client-id) is a deferred stable-phase org-secret item; intentionally keepingapp-id: vars.GH_APP_IDfor now.Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com