Skip to content

[ACS-11844] Refactor CI configurations to restrict global secrets and improve env… #3455

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joyjit-hyland wants to merge 36 commits into
base: master
Choose a base branch
from
+246 −85
Open

[ACS-11844] Refactor CI configurations to restrict global secrets and improve env… #3455

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
36 commits
Select commit Hold shift + click to select a range
e259f6f
Refactor CI configurations to restrict global secrets and improve env…
joyjit-hyland Jun 4, 2026
b598e3e
Merge branch 'master' of https://github.com/Alfresco/acs-packaging in…
joyjit-hyland Jun 4, 2026
862516a
Refactor CI configuration to enhance secret management and restrict g…
joyjit-hyland Jun 4, 2026
6003b13
Refactor CI configurations to standardize permissions and enhance sec…
joyjit-hyland Jun 4, 2026
ba32bab
Refactor CI configuration to include Docker Hub credentials in enviro…
joyjit-hyland Jun 4, 2026
31768cf
Refactor CI configuration to include Quay credentials in environment …
joyjit-hyland Jun 4, 2026
4bb10a0
Refactor CI configuration to include Quay credentials and standardize…
joyjit-hyland Jun 4, 2026
cb3899b
Refactor precommit formatter to restore Maven credentials for secure …
joyjit-hyland Jun 4, 2026
88345cd
Refactor CI configuration to include Quay credentials for enhanced se…
joyjit-hyland Jun 4, 2026
f0e208f
Refactor ARM64 CI configuration to restore Maven credentials for secu…
joyjit-hyland Jun 4, 2026
7d7b844
Refactor precommit formatter to include Maven credentials for secure …
joyjit-hyland Jun 4, 2026
8a8cdd1
Refactor CI configuration to include Maven and Git credentials for en…
joyjit-hyland Jun 4, 2026
42e49f3
Potential fix for pull request finding
joyjit-hyland Jun 23, 2026
9436e80
Potential fix for pull request finding
joyjit-hyland Jun 23, 2026
6f1dcd5
Potential fix for pull request finding
joyjit-hyland Jun 23, 2026
7f089a2
Merge branch 'master' of https://github.com/Alfresco/acs-packaging in…
joyjit-hyland Jun 23, 2026
2333da6
Update detect-secrets command to scan all files for baseline
joyjit-hyland Jun 23, 2026
24d4e33
Update secrets baseline and adjust line numbers in precommit formatter
joyjit-hyland Jun 23, 2026
83454c8
Refactor CI configuration to restrict global secrets and improve envi…
joyjit-hyland Jul 9, 2026
2cefb29
Refactor CI configuration to restrict global secrets and improve envi…
joyjit-hyland Jul 9, 2026
fdb170b
Revert "Refactor CI configuration to restrict global secrets and impr…
joyjit-hyland Jul 27, 2026
1948eae
Update secrets baseline and adjust line numbers in precommit formatter
joyjit-hyland Jul 27, 2026
9de65e1
Add Quay credentials to CI configuration
joyjit-hyland Jul 28, 2026
1024b0c
quay creds corrected
joyjit-hyland Jul 28, 2026
3282dec
Add GitHub credentials to CI configuration
joyjit-hyland Jul 28, 2026
7069655
Add Maven credentials to CI configuration
joyjit-hyland Jul 28, 2026
c80a22e
Add Maven credentials to CI configuration
joyjit-hyland Jul 28, 2026
618942c
Refactor CI configuration to restrict global secrets and improve envi…
joyjit-hyland Jul 28, 2026
20484fc
Temporarily add branch to CI configuration for review of global secrets
joyjit-hyland Jul 28, 2026
0ef67b2
Update line number for hashed secret in .secrets.baseline
joyjit-hyland Jul 28, 2026
81cd663
temporarily removing condition to run jobs - [pipeline_docker]
joyjit-hyland Jul 28, 2026
e53db48
Add Maven and Docker credentials to CI configuration [pipeline_docker]
joyjit-hyland Jul 28, 2026
c6457ba
Refactor CI configuration to restore Docker and Quay credentials for …
joyjit-hyland Jul 29, 2026
c7bc8a6
Update actions/checkout and related actions to latest versions in CI …
joyjit-hyland Aug 4, 2026
481d618
Uncomment condition to run jobs in CI configuration and remove tempor…
joyjit-hyland Aug 4, 2026
179f6cd
Update version numbers in configuration files and Docker images to la…
joyjit-hyland Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions .github/workflows/arm64.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,6 @@ on:
env:
JAVA_VERSION: "21"
GITHUB_ACTIONS_DEPLOY_TIMEOUT: 60
MAVEN_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
MAVEN_USERNAME: ${{ secrets.NEXUS_USERNAME }}
TAS_ENVIRONMENT: ./tests/environment
TAS_SCRIPTS: ../alfresco-community-repo/packaging/tests/scripts
AWS_REGION: eu-west-1
Expand All @@ -19,6 +17,9 @@ jobs:
arm64_health_check:
name: "ARM64 Health Check"
runs-on: ubuntu-24.04-arm
env:
MAVEN_USERNAME: ${{ secrets.NEXUS_USERNAME }}
MAVEN_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
outputs:
test_failure: ${{ steps.persist_test_failure_flag.outputs.test_failure }}
steps:
Expand Down
17 changes: 7 additions & 10 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,17 +18,7 @@ env:
JAVA_VERSION: "21"
AZURE_AUTHENTICATION_MODE: sharedKey
AZURE_STORAGE_ACCOUNT_NAME: acspackagingci
AZURE_STORAGE_ACCOUNT_KEY: ${{ secrets.AZURE_PACKAGING_STORAGE_ACCOUNT_KEY }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
GITHUB_ACTIONS_DEPLOY_TIMEOUT: 60
GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }}
GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
MAVEN_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
MAVEN_USERNAME: ${{ secrets.NEXUS_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
CI_WORKSPACE: ${{ github.workspace }}
Comment thread
joyjit-hyland marked this conversation as resolved.
AWS_REGION: eu-west-1
TAS_ENVIRONMENT: ./tests/environment
Expand Down Expand Up @@ -83,6 +73,10 @@ jobs:
(github.ref_name == 'master' || startsWith(github.ref_name, 'release/') || github.event_name == 'pull_request') &&
github.actor != 'dependabot[bot]' &&
!contains(github.event.head_commit.message, '[skip tests]')
env:
GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }}
GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
steps:
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v12.4.3
- uses: actions/checkout@v4
Expand Down Expand Up @@ -686,6 +680,9 @@ jobs:
if: >
github.event_name != 'pull_request' &&
!contains(github.event.head_commit.message, '[skip tests]')
env:
GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
strategy:
fail-fast: false
matrix:
Expand Down
38 changes: 29 additions & 9 deletions .github/workflows/master_release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,15 +11,6 @@ on:
env:
JAVA_VERSION: "21"
AWS_REGION: eu-west-1
GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }}
GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
MAVEN_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
MAVEN_USERNAME: ${{ secrets.NEXUS_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
GITHUB_ACTIONS_DEPLOY_TIMEOUT: 60
BASE_BUILD_NUMBER: 10000
# Release version has to start with real version (23.2.0-....) for the docker image to build successfully.
Expand All @@ -39,6 +30,13 @@ jobs:
!(failure() || cancelled()) &&
!contains(github.event.head_commit.message, '[skip docker_latest]') &&
github.ref_name == 'master' && github.event_name != 'pull_request'
env:
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
MAVEN_USERNAME: ${{ secrets.NEXUS_USERNAME }}
MAVEN_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
Comment thread
Copilot marked this conversation as resolved.
Outdated
services:
registry:
image: registry:2
Expand Down Expand Up @@ -84,6 +82,16 @@ jobs:
image: registry:2
ports:
- 5000:5000
env:
GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }}
GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
MAVEN_USERNAME: ${{ secrets.NEXUS_USERNAME }}
MAVEN_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
steps:
- uses: actions/checkout@v4
with:
Expand Down Expand Up @@ -143,6 +151,12 @@ jobs:
!(failure() || cancelled()) &&
contains(github.event.head_commit.message, '[publish]') &&
github.event_name != 'pull_request'
env:
GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }}
GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
MAVEN_USERNAME: ${{ secrets.NEXUS_USERNAME }}
MAVEN_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
Comment thread
Copilot marked this conversation as resolved.
Outdated
steps:
- uses: actions/checkout@v4
with:
Expand Down Expand Up @@ -189,6 +203,12 @@ jobs:
(contains(github.event.head_commit.message, '[downstream]') || (contains(github.event.head_commit.message, '[release]') &&
!contains(github.event.head_commit.message, '[no downstream]'))) &&
github.event_name != 'pull_request'
env:
GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }}
GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
MAVEN_USERNAME: ${{ secrets.NEXUS_USERNAME }}
MAVEN_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
Comment thread
Copilot marked this conversation as resolved.
Outdated
steps:
- uses: actions/checkout@v4
with:
Expand Down
5 changes: 3 additions & 2 deletions .github/workflows/precommit_formatter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,15 @@ on:

env:
JAVA_VERSION: "21"
MAVEN_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
MAVEN_USERNAME: ${{ secrets.NEXUS_USERNAME }}

jobs:
format-code:
name: "Reformat code"
runs-on: ubuntu-latest
if: contains(github.event.head_commit.message, '[reformat code]')
env:
MAVEN_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
MAVEN_USERNAME: ${{ secrets.NEXUS_USERNAME }}
steps:
- uses: actions/checkout@v4
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v12.4.3
Expand Down