Skip to content

DATAGO-121329: Explicitly use vault token for reading SolaceDev packages #48

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AmanRiat1 merged 4 commits into from
Jan 9, 2026
Merged

DATAGO-121329: Explicitly use vault token for reading SolaceDev packages #48

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5642bfb
feat: Update release workflows to use output token from Vault and add…
AmanRiat1 Jan 9, 2026
d1a9d70
fix: Update GitHub Actions workflows to use read-only credentials for…
AmanRiat1 Jan 9, 2026
6f074d7
chore: Remove test release authentication workflow
AmanRiat1 Jan 9, 2026
dc01678
fix: Update GitHub Actions to use new environment variable names for …
AmanRiat1 Jan 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions .github/workflows/build-integrationtest.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,8 +65,8 @@ jobs:
path: jwt-github
jwtGithubAudience: https://github.com/${{ github.repository_owner }}
exportToken: true
secrets: secret/data/tools/githubactions RE_BOT_PACKAGES_READ_ONLY_CLASSIC_USER | GITHUB_USER ;
secret/data/tools/githubactions RE_BOT_PACKAGES_READ_ONLY_CLASSIC_TOKEN | GITHUB_TOKEN ;
secrets: secret/data/tools/githubactions RE_BOT_PACKAGES_READ_ONLY_CLASSIC_USER | PACKAGES_READ_USER ;
secret/data/tools/githubactions RE_BOT_PACKAGES_READ_ONLY_CLASSIC_TOKEN | PACKAGES_READ_TOKEN ;

- name: Warn of Vault Login Failure
if: steps.secrets.outcome != 'success'
Expand Down Expand Up @@ -97,6 +97,9 @@ jobs:
echo "GITHUB_PACKAGES_DEPLOY=$GITHUB_PACKAGES_DEPLOY" >> $GITHUB_ENV

- name: Static Code Analysis
env:
PACKAGES_READ_USER: ${{ steps.secrets.outputs.PACKAGES_READ_USER }}
PACKAGES_READ_TOKEN: ${{ steps.secrets.outputs.PACKAGES_READ_TOKEN }}
run: mvn -B compile process-classes pmd:aggregate-pmd-check spotbugs:check --settings "${GITHUB_WORKSPACE}/maven/settings.xml"

- name: Unit/Integration Tests JDK 8 (zulu)
Expand All @@ -109,6 +112,9 @@ jobs:
run: docker info

- name: Run Unit/Integration Tests
env:
PACKAGES_READ_USER: ${{ steps.secrets.outputs.PACKAGES_READ_USER }}
PACKAGES_READ_TOKEN: ${{ steps.secrets.outputs.PACKAGES_READ_TOKEN }}
run: >-
mvn -B clean jacoco:report -Dit.test=SolaceSparkIntegrationTestSuite verify
--settings "${GITHUB_WORKSPACE}/maven/settings.xml"
Expand Down
8 changes: 6 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,8 +53,8 @@ jobs:
jwtGithubAudience: https://github.com/${{ github.repository_owner }}
exportToken: true
secrets:
secret/data/tools/githubactions RE_BOT_PACKAGES_READ_WRITE_CLASSIC_USER | GITHUB_USER ;
secret/data/tools/githubactions RE_BOT_PACKAGES_READ_WRITE_CLASSIC_TOKEN | GITHUB_TOKEN ;
secret/data/tools/githubactions RE_BOT_PACKAGES_READ_ONLY_CLASSIC_USER | PACKAGES_READ_USER ;
secret/data/tools/githubactions RE_BOT_PACKAGES_READ_ONLY_CLASSIC_TOKEN | PACKAGES_READ_TOKEN ;
secret/data/tools/githubactions MAVEN_GPG_KEY_PASSPHRASE | MAVEN_GPG_KEY_PASSPHRASE ;
secret/data/tools/githubactions MAVEN_GPG_KEY | MAVEN_GPG_KEY ;
secret/data/tools/githubactions MAVEN_USERNAME | MAVEN_USERNAME ;
Expand Down Expand Up @@ -128,12 +128,16 @@ jobs:

- name: Deploy Artifacts (GH Packages)
env:
PACKAGES_READ_USER: ${{ steps.secrets.outputs.PACKAGES_READ_USER }}
Copy link

@shooshmand-sol shooshmand-sol Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wondering can this token deploy to github packages (this looks readonly?) , or it is just for reading, and write is done using github_token?

Copy link
Collaborator Author

@AmanRiat1 AmanRiat1 Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes exactly that

Copy link
Collaborator Author

@AmanRiat1 AmanRiat1 Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Basically the packages token works for this in the settings.xml to get packages from SolaceDev

  maven/settings.xml (lines 37-41):
  <server>
      <id>github-solacedev</id>
      <username>${env.PACKAGES_READ_USER}</username>
      <password>${env.PACKAGES_READ_TOKEN}</password>
  </server>

  This matches the repository definition at lines 20-31:
  <repository>
      <id>github-solacedev</id>
      <url>https://maven.pkg.github.com/SolaceDev/*</url>
      ...
  </repository>

When we publish we use this profile which use the github workflow token to publish the package:

  maven/settings.xml (lines 42-46):
  <server>
      <id>github</id>
      <username>${env.GITHUB_ACTOR}</username>
      <password>${env.GITHUB_TOKEN}</password>
  </server>

  pom.xml (lines 641-647) - In the profile activated by -DreleaseTarget=github:
  <distributionManagement>
      <repository>
          <id>github</id>
          <name>GitHub SolaceProducts Maven Packages - Binder</name>
          <url>https://maven.pkg.github.com/SolaceProducts/pubsubplus-connector-spark</url>
      </repository>
  </distributionManagement>

Copy link

@shooshmand-sol shooshmand-sol Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome, thanks for explanations @AmanRiat1

PACKAGES_READ_TOKEN: ${{ steps.secrets.outputs.PACKAGES_READ_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: >-
mvn deploy -B -DreleaseTarget=github -s maven/settings.xml $SKIP_FLAGS_ALL_TESTS

- name: Deploy Artifacts (Maven Central)
env:
PACKAGES_READ_USER: ${{ steps.secrets.outputs.PACKAGES_READ_USER }}
PACKAGES_READ_TOKEN: ${{ steps.secrets.outputs.PACKAGES_READ_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: >-
mvn deploy -B -DreleaseTarget=central -s maven/settings.xml $SKIP_FLAGS_ALL_TESTS
Expand Down
4 changes: 2 additions & 2 deletions maven/settings.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,8 @@
<servers>
<server>
<id>github-solacedev</id>
<username>${env.GITHUB_USER}</username>
<password>${env.GITHUB_TOKEN}</password>
<username>${env.PACKAGES_READ_USER}</username>
<password>${env.PACKAGES_READ_TOKEN}</password>
</server>
<server>
<id>github</id>
Expand Down
Loading