Skip to content

Commit 8ad8c35

Browse files
author
Skylar Simoncelli
committed
fix: tokens
1 parent ca3f877 commit 8ad8c35

File tree

3 files changed

+131
-126
lines changed

3 files changed

+131
-126
lines changed

‎.github/actions/images/build-and-publish-ghcr/action.yml

+1-3
Original file line numberDiff line numberDiff line change
@@ -56,9 +56,7 @@ runs:
5656
registry: ghcr.io
5757
username: ${{ env.GITHUB_ACTOR }}
5858
password: ${{ env.GITHUB_TOKEN }}
59-
env:
60-
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
61-
FORCE_COLOR: 1
59+
logout: true
6260

6361
- name: Tag and Push Image to GHCR
6462
run: |

‎.github/actions/release/publish-draft-release/action.yml

+14-11
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ runs:
2121
run: |
2222
set -e
2323
tag="${{ inputs.tag }}"
24-
release_response=$(curl -s -H "Authorization: token ${{ env.GITHUB_TOKEN }} \
24+
release_response=$(curl -s -H "Authorization: token ${{ env.GITHUB_TOKEN }}" \
2525
"https://api.github.com/repos/${{ github.repository }}/releases/tags/$tag")
2626
2727
if echo "$release_response" | grep -q '"message": "Not Found"'; then
@@ -35,18 +35,21 @@ runs:
3535
shell: bash
3636

3737
- name: Publish release
38-
if: ${{ steps.check_release.outputs.release_exists == 'true' }}
3938
run: |
4039
set -e
41-
release_id="${{ steps.check_release.outputs.release_id }}"
42-
response=$(curl -s -X PATCH -H "Authorization: token ${{ env.GITHUB_TOKEN }}" \
43-
-d '{"draft": false}' \
44-
"https://api.github.com/repos/${{ github.repository }}/releases/$release_id")
45-
echo "Response: $response"
46-
if echo "$response" | jq -e '.id' >/dev/null; then
47-
echo "Release updated successfully"
40+
if [[ "${{ steps.check_release.outputs.release_exists }}" == "true" ]]; then
41+
release_id="${{ steps.check_release.outputs.release_id }}"
42+
response=$(curl -s -X PATCH -H "Authorization: token ${{ env.GITHUB_TOKEN }}" \
43+
-d '{"draft": false}' \
44+
"https://api.github.com/repos/${{ github.repository }}/releases/$release_id")
45+
echo "Response: $response"
46+
if echo "$response" | jq -e '.id' >/dev/null; then
47+
echo "Release updated successfully"
48+
else
49+
echo "Failed to update release"
50+
exit 1
51+
fi
4852
else
49-
echo "Failed to update release"
50-
exit 1
53+
echo "Release does not exist, skipping publish step."
5154
fi
5255
shell: bash

‎.github/workflows/cd.yml

+116-112
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ on:
1515
permissions:
1616
id-token: write
1717
contents: write
18+
packages: write
1819

1920
env:
2021
AWS_REGION: "eu-central-1"
@@ -37,63 +38,64 @@ jobs:
3738
tag: ${{ inputs.tag }}
3839
os: linux
3940

40-
build-macos-x86_64:
41-
permissions:
42-
id-token: write
43-
contents: write
44-
runs-on: macos-latest
45-
steps:
46-
- name: Checkout
47-
uses: actions/checkout@v4
48-
with:
49-
ref: ${{ inputs.sha }}
50-
- name: Build and Upload for macOS x86_64
51-
uses: ./.github/actions/artifacts/build-pc-artifacts
52-
with:
53-
tag: ${{ inputs.tag }}
54-
os: macos-x86_64
55-
56-
build-macos-arm64:
57-
permissions:
58-
id-token: write
59-
contents: write
60-
runs-on: macos-latest
61-
steps:
62-
- name: Checkout
63-
uses: actions/checkout@v4
64-
with:
65-
ref: ${{ inputs.sha }}
66-
- name: Build and Upload for macOS arm64
67-
uses: ./.github/actions/artifacts/build-pc-artifacts
68-
with:
69-
tag: ${{ inputs.tag }}
70-
os: macos-arm64
71-
72-
build-and-publish-ecr:
73-
permissions:
74-
id-token: write
75-
contents: write
76-
needs: build-linux
77-
runs-on: ubuntu-latest
78-
steps:
79-
- name: Checkout
80-
uses: actions/checkout@v4
81-
- name: Build and Publish to ECR
82-
uses: ./.github/actions/images/build-and-publish-ecr
83-
with:
84-
sha: ${{ inputs.sha }}
85-
tag: ${{ inputs.tag }}
86-
env:
87-
AWS_REGION: "eu-central-1"
88-
ECR_REGISTRY_SECRET: ${{ secrets.ECR_REGISTRY_SECRET }}
89-
AWS_ROLE_ARN_SECRET: ${{ secrets.AWS_ROLE_ARN_SECRET }}
90-
SSH_KEY: ${{ secrets.SUBSTRATE_REPO_SSH_KEY }}
41+
# build-macos-x86_64:
42+
# permissions:
43+
# id-token: write
44+
# contents: write
45+
# runs-on: macos-latest
46+
# steps:
47+
# - name: Checkout
48+
# uses: actions/checkout@v4
49+
# with:
50+
# ref: ${{ inputs.sha }}
51+
# - name: Build and Upload for macOS x86_64
52+
# uses: ./.github/actions/artifacts/build-pc-artifacts
53+
# with:
54+
# tag: ${{ inputs.tag }}
55+
# os: macos-x86_64
56+
#
57+
# build-macos-arm64:
58+
# permissions:
59+
# id-token: write
60+
# contents: write
61+
# runs-on: macos-latest
62+
# steps:
63+
# - name: Checkout
64+
# uses: actions/checkout@v4
65+
# with:
66+
# ref: ${{ inputs.sha }}
67+
# - name: Build and Upload for macOS arm64
68+
# uses: ./.github/actions/artifacts/build-pc-artifacts
69+
# with:
70+
# tag: ${{ inputs.tag }}
71+
# os: macos-arm64
72+
#
73+
# build-and-publish-ecr:
74+
# permissions:
75+
# id-token: write
76+
# contents: write
77+
# needs: build-linux
78+
# runs-on: ubuntu-latest
79+
# steps:
80+
# - name: Checkout
81+
# uses: actions/checkout@v4
82+
# - name: Build and Publish to ECR
83+
# uses: ./.github/actions/images/build-and-publish-ecr
84+
# with:
85+
# sha: ${{ inputs.sha }}
86+
# tag: ${{ inputs.tag }}
87+
# env:
88+
# AWS_REGION: "eu-central-1"
89+
# ECR_REGISTRY_SECRET: ${{ secrets.ECR_REGISTRY_SECRET }}
90+
# AWS_ROLE_ARN_SECRET: ${{ secrets.AWS_ROLE_ARN_SECRET }}
91+
# SSH_KEY: ${{ secrets.SUBSTRATE_REPO_SSH_KEY }}
9192

9293
create-draft-release:
9394
permissions:
9495
id-token: write
9596
contents: write
96-
needs: [build-linux, build-macos-x86_64, build-macos-arm64]
97+
needs: [build-linux]
98+
#needs: [build-linux, build-macos-x86_64, build-macos-arm64]
9799
runs-on: ubuntu-latest
98100
steps:
99101
- name: Checkout
@@ -103,63 +105,63 @@ jobs:
103105
with:
104106
tag: ${{ inputs.tag }}
105107
env:
106-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
108+
GITHUB_TOKEN: ${{ github.token }}
107109

108-
generate-chain-specs:
109-
permissions:
110-
id-token: write
111-
contents: write
112-
needs: build-linux
113-
runs-on: ubuntu-latest
114-
steps:
115-
- name: Checkout
116-
uses: actions/checkout@v4
117-
- name: Generate Chain Specs
118-
uses: ./.github/actions/artifacts/generate-chain-specs
119-
with:
120-
tag: ${{ inputs.tag }}
121-
122-
upload-chain-specs:
123-
permissions:
124-
id-token: write
125-
contents: write
126-
needs: generate-chain-specs
127-
runs-on: [self-hosted, eks]
128-
steps:
129-
- name: Checkout
130-
uses: actions/checkout@v4
131-
- name: Upload chain spec artifacts to Kubernetes
132-
uses: ./.github/actions/deploy/upload-chain-specs
133-
with:
134-
sha: ${{ github.sha }}
135-
env:
136-
kubeconfig_base64: ${{ secrets.kubeconfig_base64 }}
137-
K8S_SERVER: ${{ secrets.K8S_SERVER }}
138-
K8S_SA_TOKEN: ${{ secrets.K8S_SA_TOKEN }}
139-
140-
deploy-staging-preview:
141-
permissions:
142-
id-token: write
143-
contents: write
144-
needs: [build-and-publish-ecr, upload-chain-specs]
145-
runs-on: [self-hosted, eks]
146-
steps:
147-
- name: Checkout
148-
uses: actions/checkout@v4
149-
- name: Deploy staging-preview
150-
uses: ./.github/actions/deploy/deploy-staging-preview
151-
with:
152-
image: ${{ secrets.ECR_REGISTRY_SECRET }}/substrate-node:${{ inputs.sha }}
153-
sha: ${{ github.sha }}
154-
env:
155-
AWS_REGION: "eu-central-1"
156-
SSH_AUTH_SOCK: /tmp/ssh_agent.sock
157-
ACTIONS_PAT: ${{ secrets.ACTIONS_PAT }}
158-
AWS_ROLE_ARN_SECRET: ${{ secrets.AWS_ROLE_ARN_SECRET }}
159-
ECR_REGISTRY_SECRET: ${{ secrets.ECR_REGISTRY_SECRET }}
160-
kubeconfig_base64: ${{ secrets.kubeconfig_base64 }}
161-
K8S_SERVER: ${{ secrets.K8S_SERVER }}
162-
K8S_SA_TOKEN: ${{ secrets.K8S_SA_TOKEN }}
110+
# generate-chain-specs:
111+
# permissions:
112+
# id-token: write
113+
# contents: write
114+
# needs: build-linux
115+
# runs-on: ubuntu-latest
116+
# steps:
117+
# - name: Checkout
118+
# uses: actions/checkout@v4
119+
# - name: Generate Chain Specs
120+
# uses: ./.github/actions/artifacts/generate-chain-specs
121+
# with:
122+
# tag: ${{ inputs.tag }}
123+
#
124+
# upload-chain-specs:
125+
# permissions:
126+
# id-token: write
127+
# contents: write
128+
# needs: generate-chain-specs
129+
# runs-on: [self-hosted, eks]
130+
# steps:
131+
# - name: Checkout
132+
# uses: actions/checkout@v4
133+
# - name: Upload chain spec artifacts to Kubernetes
134+
# uses: ./.github/actions/deploy/upload-chain-specs
135+
# with:
136+
# sha: ${{ github.sha }}
137+
# env:
138+
# kubeconfig_base64: ${{ secrets.kubeconfig_base64 }}
139+
# K8S_SERVER: ${{ secrets.K8S_SERVER }}
140+
# K8S_SA_TOKEN: ${{ secrets.K8S_SA_TOKEN }}
141+
#
142+
# deploy-staging-preview:
143+
# permissions:
144+
# id-token: write
145+
# contents: write
146+
# needs: [build-and-publish-ecr, upload-chain-specs]
147+
# runs-on: [self-hosted, eks]
148+
# steps:
149+
# - name: Checkout
150+
# uses: actions/checkout@v4
151+
# - name: Deploy staging-preview
152+
# uses: ./.github/actions/deploy/deploy-staging-preview
153+
# with:
154+
# image: ${{ secrets.ECR_REGISTRY_SECRET }}/substrate-node:${{ inputs.sha }}
155+
# sha: ${{ github.sha }}
156+
# env:
157+
# AWS_REGION: "eu-central-1"
158+
# SSH_AUTH_SOCK: /tmp/ssh_agent.sock
159+
# ACTIONS_PAT: ${{ secrets.ACTIONS_PAT }}
160+
# AWS_ROLE_ARN_SECRET: ${{ secrets.AWS_ROLE_ARN_SECRET }}
161+
# ECR_REGISTRY_SECRET: ${{ secrets.ECR_REGISTRY_SECRET }}
162+
# kubeconfig_base64: ${{ secrets.kubeconfig_base64 }}
163+
# K8S_SERVER: ${{ secrets.K8S_SERVER }}
164+
# K8S_SA_TOKEN: ${{ secrets.K8S_SA_TOKEN }}
163165

164166
# staging-preview-tests:
165167
# permissions:
@@ -190,7 +192,8 @@ jobs:
190192
permissions:
191193
id-token: write
192194
contents: write
193-
needs: deploy-staging-preview
195+
packages: write
196+
needs: build-linux
194197
#needs: staging-preview-tests
195198
runs-on: ubuntu-latest
196199
steps:
@@ -203,14 +206,15 @@ jobs:
203206
tag: ${{ inputs.tag }}
204207
env:
205208
GITHUB_ACTOR: ${{ github.actor }}
206-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
209+
GITHUB_TOKEN: ${{ github.token }}
207210

208211
publish-release:
209212
permissions:
210213
id-token: write
211214
contents: write
215+
packages: write
212216
# needs: staging-preview-tests
213-
needs: deploy-staging-preview
217+
needs: create-draft-release
214218
runs-on: ubuntu-latest
215219
steps:
216220
- name: Checkout
@@ -220,7 +224,7 @@ jobs:
220224
with:
221225
tag: ${{ inputs.tag }}
222226
env:
223-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
227+
GITHUB_TOKEN: ${{ github.token }}
224228
#
225229
# deploy-staging-preprod:
226230
# permissions:

0 commit comments

Comments
 (0)