Skip to content

Commit 5bbd080

Browse files
BarkinKctpBarkinKctp
committed
refactor: update workflows and tests to use GitHub App token for authentication and improve error handling
1 parent 40d7364 commit 5bbd080

17 files changed

Lines changed: 173 additions & 43 deletions

‎.github/workflows/build-citus-community-nightlies.yml‎

Lines changed: 8 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ jobs:
1919
name: Build package
2020
runs-on: ubuntu-latest
2121
permissions:
22-
id-token: write
2322
contents: read
2423
strategy:
2524
fail-fast: false
@@ -43,27 +42,10 @@ jobs:
4342
private-key: ${{ secrets.GH_APP_KEY }}
4443
owner: ${{ github.repository_owner }}
4544

46-
- name: Debug - Test token access to repos
47-
env:
48-
GH_TOKEN: ${{ steps.app.outputs.token }}
49-
run: |
50-
echo "Testing token access to repositories..."
51-
for repo in citus packaging tools; do
52-
echo "Testing access to citusdata/$repo..."
53-
if gh api repos/citusdata/$repo --jq '.full_name' 2>/dev/null; then
54-
echo "✓ Access to citusdata/$repo OK"
55-
else
56-
echo "✗ No access to citusdata/$repo"
57-
fi
58-
done
59-
echo "Token scopes:"
60-
curl -sS -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/rate_limit | head -20
61-
6245
- name: Checkout repository
6346
uses: actions/checkout@v3
6447
with:
65-
fetch-depth: 1
66-
path: tools
48+
token: ${{steps.app.outputs.token}}
6749

6850
# This step is to fetch the images unanonymously to have higher bandwidth
6951
- name: Login to Docker Hub
@@ -73,7 +55,11 @@ jobs:
7355
password: ${{ secrets.DOCKERHUB_PASSWORD }}
7456

7557
- name: Clone build branch
76-
run: git clone -b "${MAIN_BRANCH}" --depth=1 https://github.com/citusdata/packaging.git packaging
58+
env:
59+
GH_TOKEN: ${{steps.app.outputs.token}}
60+
run: |
61+
git clone -b "${MAIN_BRANCH}" --depth=1 \
62+
https://x-access-token:${GH_TOKEN}@github.com/citusdata/packaging.git packaging
7763
7864
- name: Install package dependencies
7965
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
@@ -83,7 +69,8 @@ jobs:
8369

8470
- name: Build packages
8571
env:
86-
GH_TOKEN: ${{ steps.app.outputs.token }}
72+
GH_TOKEN: ${{steps.app.outputs.token}}
73+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
8774
run: |
8875
python -m tools.packaging_automation.citus_package \
8976
--gh_token "${GH_TOKEN}" \

‎.github/workflows/citus-package-all-platforms-test.yml‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
name: Citus package all platforms tests
22

33
env:
4-
GH_TOKEN: ${{ secrets.GH_TOKEN }}
5-
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
64
PACKAGING_PASSPHRASE: ${{ secrets.PACKAGING_PASSPHRASE }}
75
MICROSOFT_EMAIL: gindibay@microsoft.com
86
USER_NAME: Gurkan Indibay
@@ -19,6 +17,8 @@ on:
1917
jobs:
2018
unit_test_execution:
2119
runs-on: ubuntu-latest
20+
permissions:
21+
contents: read
2222
strategy:
2323
fail-fast: false
2424
matrix:
@@ -36,17 +36,33 @@ jobs:
3636
PLATFORM: ${{ matrix.platform }}
3737

3838
steps:
39+
40+
- name: Create GitHub App token
41+
id: app
42+
uses: actions/create-github-app-token@v1
43+
with:
44+
app-id: ${{ vars.GH_APP_ID }}
45+
private-key: ${{ secrets.GH_APP_KEY }}
46+
owner: ${{ github.repository_owner }}
47+
3948
- name: Checkout repository
4049
uses: actions/checkout@v3
50+
with:
51+
token: ${{steps.app.outputs.token}}
52+
53+
4154

4255
- name: Install dependencies
4356
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
4457

45-
- name: Define git credentails
58+
- name: Define git credentials
4659
run: git config --global user.email "${MICROSOFT_EMAIL}"&& git config --global user.name "${USER_NAME}"
4760

4861
- name: Install python requirements
4962
run: python -m pip install -r packaging_automation/requirements.txt
5063

5164
- name: Citus package tests
65+
env:
66+
GH_TOKEN: ${{steps.app.outputs.token}}
67+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
5268
run: python -m pytest -q packaging_automation/tests/test_citus_package.py -s

‎.github/workflows/package-tests.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,8 @@ jobs:
4444
echo "::set-output name=pg_versions::${POSTGRES_VERSIONS}"
4545
test_execution:
4646
runs-on: ubuntu-latest
47+
permissions:
48+
contents: read
4749
needs: metadata
4850
strategy:
4951
fail-fast: false
@@ -60,8 +62,19 @@ jobs:
6062
PLATFORM: ${{ matrix.platform }}
6163

6264
steps:
65+
66+
- name: Create GitHub App token
67+
id: app
68+
uses: actions/create-github-app-token@v1
69+
with:
70+
app-id: ${{ vars.GH_APP_ID }}
71+
private-key: ${{ secrets.GH_APP_KEY }}
72+
owner: ${{ github.repository_owner }}
73+
6374
- name: Checkout repository
6475
uses: actions/checkout@v3
76+
with:
77+
token: ${{steps.app.outputs.token}}
6578

6679
- name: Install dependencies
6780
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
@@ -70,6 +83,9 @@ jobs:
7083
run: python -m pip install -r packaging_automation/requirements.txt
7184

7285
- name: Citus package tests
86+
env:
87+
GH_TOKEN: ${{steps.app.outputs.token}}
88+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
7389
run: |
7490
export PROJECT_VERSION="${{ github.event.inputs.project_version }}"
7591
echo "Citus Version: ${PROJECT_VERSION} "

‎.github/workflows/packaging-methods-tests.yml‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
name: Packaging helper methods tests
22

3-
env:
4-
GH_TOKEN: ${{ secrets.GH_TOKEN }}
5-
63
on:
74
push:
85
branches:
@@ -13,10 +10,23 @@ on:
1310
jobs:
1411
unit_test_execution:
1512
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
1615

1716
steps:
17+
18+
- name: Create GitHub App token
19+
id: app
20+
uses: actions/create-github-app-token@v1
21+
with:
22+
app-id: ${{ vars.GH_APP_ID }}
23+
private-key: ${{ secrets.GH_APP_KEY }}
24+
owner: ${{ github.repository_owner }}
25+
1826
- name: Checkout repository
1927
uses: actions/checkout@v3
28+
with:
29+
token: ${{steps.app.outputs.token}}
2030

2131
- name: Install package dependencies
2232
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
@@ -25,4 +35,8 @@ jobs:
2535
run: python -m pip install -r packaging_automation/requirements.txt
2636

2737
- name: Citus package tests
38+
env:
39+
GH_TOKEN: ${{steps.app.outputs.token}}
40+
41+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
2842
run: python -m pytest -q packaging_automation/tests/test_citus_package_utils.py

‎.github/workflows/statistic-schedule.yml‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ env:
55
DB_PASSWORD: ${{ secrets.STATS_DB_PASSWORD }}
66
DB_HOST_AND_PORT: ${{ secrets.STATS_DB_HOST_AND_PORT }}
77
DB_NAME: ${{ secrets.STATS_DB_NAME }}
8-
GH_TOKEN: ${{ secrets.GH_TOKEN }}
98
on:
109
schedule:
1110
- cron: "0 16 * * *"
@@ -19,14 +18,26 @@ on:
1918
jobs:
2019
execute_job:
2120
runs-on: ubuntu-latest
21+
permissions:
22+
contents: read
2223
strategy:
2324
fail-fast: false
2425
matrix:
2526
job_name: [docker_pull_citus, github_clone_citus, homebrew_citus]
2627

2728
steps:
29+
- name: Create GitHub App token
30+
id: app
31+
uses: actions/create-github-app-token@v1
32+
with:
33+
app-id: ${{ vars.GH_APP_ID }}
34+
private-key: ${{ secrets.GH_APP_KEY }}
35+
owner: ${{ github.repository_owner }}
36+
2837
- name: Checkout repository
2938
uses: actions/checkout@v3
39+
with:
40+
token: ${{steps.app.outputs.token}}
3041

3142
- name: Install package dependencies
3243
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
@@ -35,6 +46,9 @@ jobs:
3546
run: python -m pip install -r packaging_automation/requirements.txt
3647

3748
- name: Execute 'Fetch Daily Statistics'
38-
run: packaging_automation/bash/daily-statistics-job.sh
3949
env:
4050
JOB_NAME: "${{ matrix.JOB_NAME }}"
51+
GH_TOKEN: ${{steps.app.outputs.token}}
52+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
53+
run: packaging_automation/bash/daily-statistics-job.sh
54+

‎.github/workflows/statistic-tests.yml‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ env:
55
DB_PASSWORD: ${{ secrets.STATS_DB_PASSWORD }}
66
DB_HOST_AND_PORT: ${{ secrets.STATS_DB_HOST_AND_PORT }}
77
DB_NAME: ${{ secrets.STATS_DB_NAME }}
8-
GH_TOKEN: ${{ secrets.GH_TOKEN }}
98
PACKAGE_CLOUD_API_TOKEN: ${{ secrets.PACKAGE_CLOUD_API_TOKEN }}
109
PACKAGE_CLOUD_ADMIN_API_TOKEN: ${{ secrets.PACKAGE_CLOUD_ADMIN_API_TOKEN }}
1110
on:
@@ -19,10 +18,24 @@ on:
1918
jobs:
2019
unit_test_execution:
2120
runs-on: ubuntu-latest
21+
permissions:
22+
contents: read
2223

2324
steps:
25+
26+
- name: Create GitHub App token
27+
id: app
28+
uses: actions/create-github-app-token@v1
29+
with:
30+
app-id: ${{ vars.GH_APP_ID }}
31+
private-key: ${{ secrets.GH_APP_KEY }}
32+
owner: ${{ github.repository_owner }}
33+
2434
- name: Checkout repository
2535
uses: actions/checkout@v3
36+
with:
37+
token: ${{ steps.app.outputs.token }}
38+
2639

2740
- name: Install package dependencies
2841
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
@@ -31,13 +44,25 @@ jobs:
3144
run: python -m pip install -r packaging_automation/requirements.txt
3245

3346
- name: Unit tests for "Docker statistics"
47+
env:
48+
GH_TOKEN: ${{steps.app.outputs.token}}
49+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
3450
run: python -m pytest -q packaging_automation/tests/test_docker_statistics_collector.py
3551

3652
- name: Unit tests for "Github clone statistics"
53+
env:
54+
GH_TOKEN: ${{steps.app.outputs.token}}
55+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
3756
run: python -m pytest -q packaging_automation/tests/test_github_statistics_collector.py
3857

3958
- name: Unit tests for "Packagecloud download statistics"
59+
env:
60+
GH_TOKEN: ${{steps.app.outputs.token}}
61+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
4062
run: python -m pytest -q packaging_automation/tests/test_package_cloud_statistics_collector.py
4163

4264
- name: Unit tests for "Homebrew download statistics"
65+
env:
66+
GH_TOKEN: ${{steps.app.outputs.token}}
67+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
4368
run: python -m pytest -q packaging_automation/tests/test_homebrew_statistics_collector.py

‎.github/workflows/tool-tests.yml‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
name: Tool Tests
22

33
env:
4-
GH_TOKEN: ${{ secrets.GH_TOKEN }}
54
MICROSOFT_EMAIL: gindibay@microsoft.com
65
USER_NAME: Gurkan Indibay
76
MAIN_BRANCH: all-citus
@@ -25,12 +24,24 @@ jobs:
2524

2625
unit_test_execution:
2726
runs-on: ubuntu-latest
27+
permissions:
28+
contents: read
2829

2930
steps:
31+
32+
- name: Create GitHub App token
33+
id: app
34+
uses: actions/create-github-app-token@v1
35+
with:
36+
app-id: ${{ vars.GH_APP_ID }}
37+
private-key: ${{ secrets.GH_APP_KEY }}
38+
owner: ${{ github.repository_owner }}
39+
3040
- name: Checkout repository
3141
uses: actions/checkout@v3
3242
with:
3343
fetch-depth: 0
44+
token: ${{ steps.app.outputs.token }}
3445

3546
- name: Set up Python 3.10
3647
uses: actions/setup-python@v5
@@ -53,20 +64,35 @@ jobs:
5364
run: black . --check
5465

5566
- name: Unit tests for "Common tools"
67+
env:
68+
GH_TOKEN: ${{steps.app.outputs.token}}
69+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
5670
run: python -m pytest -q packaging_automation/tests/test_common_tool_methods.py
5771

5872
- name: Unit tests for "Update Package Properties"
73+
env:
74+
GH_TOKEN: ${{steps.app.outputs.token}}
75+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
5976
run: python -m pytest -q packaging_automation/tests/test_update_package_properties.py
6077

6178
# no longer viable, outdated test, skipping to not block the pipeline
6279
# - name: Unit tests for "Prepare Release"
6380
# run: python -m pytest -q packaging_automation/tests/test_prepare_release.py
6481

6582
- name: Unit tests for "Update Docker"
83+
env:
84+
GH_TOKEN: ${{steps.app.outputs.token}}
85+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
6686
run: python -m pytest -q packaging_automation/tests/test_update_docker.py
6787

6888
- name: Unit tests for "Update Pgxn"
89+
env:
90+
GH_TOKEN: ${{steps.app.outputs.token}}
91+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
6992
run: python -m pytest -q packaging_automation/tests/test_update_pgxn.py
7093

7194
- name: Packaging Warning Handler
95+
env:
96+
GH_TOKEN: ${{steps.app.outputs.token}}
97+
GITHUB_TOKEN: ${{steps.app.outputs.token}}
7298
run: python -m pytest -q packaging_automation/tests/test_packaging_warning_handler.py

0 commit comments

Comments
 (0)