Skip to content

Commit f17e33f

Browse files
BarkinKctpBarkinKctp
committed
feat: update workflows to use GitHub App token and improve permissions
1 parent 7891e7c commit f17e33f

16 files changed

Lines changed: 64 additions & 43 deletions

‎.github/workflows/build-citus-community-nightlies.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ jobs:
1818
build_package:
1919
name: Build package
2020
runs-on: ubuntu-latest
21+
permissions:
22+
contents: write
23+
packages: write
24+
pull-requests: read
2125
strategy:
2226
fail-fast: false
2327
matrix:
@@ -39,16 +43,14 @@ jobs:
3943
app-id: ${{ vars.GH_APP_ID }}
4044
private-key: ${{ secrets.GH_APP_KEY }}
4145
owner: ${{ github.repository_owner }}
42-
repositories: |
43-
tools
44-
packaging
4546

4647
- name: Checkout repository
4748
uses: actions/checkout@v3
4849
with:
4950
token: ${{ steps.app.outputs.token }}
5051
fetch-depth: 1
5152
path: tools
53+
submodules: true
5254

5355
# This step is to fetch the images unanonymously to have higher bandwidth
5456
- name: Login to Docker Hub
@@ -60,8 +62,7 @@ jobs:
6062
- name: Clone build branch
6163
env:
6264
GH_TOKEN: ${{ steps.app.outputs.token }}
63-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
64-
run: git clone -b "${MAIN_BRANCH}" --depth=1 https://gh-token:${GH_TOKEN}@github.com/citusdata/packaging.git packaging
65+
run: git clone -b "${MAIN_BRANCH}" --depth=1 https://${GH_TOKEN}@github.com/citusdata/packaging.git packaging
6566

6667
- name: Install package dependencies
6768
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
@@ -72,7 +73,6 @@ jobs:
7273
- name: Build packages
7374
env:
7475
GH_TOKEN: ${{ steps.app.outputs.token }}
75-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
7676
run: |
7777
python -m tools.packaging_automation.citus_package \
7878
--gh_token "${GH_TOKEN}" \

‎.github/workflows/citus-package-all-platforms-test.yml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ on:
1717
jobs:
1818
unit_test_execution:
1919
runs-on: ubuntu-latest
20+
permissions:
21+
contents: write
22+
packages: write
23+
pull-requests: read
2024
strategy:
2125
fail-fast: false
2226
matrix:
@@ -40,10 +44,6 @@ jobs:
4044
with:
4145
app-id: ${{ vars.GH_APP_ID }}
4246
private-key: ${{ secrets.GH_APP_KEY }}
43-
owner: citusdata
44-
repositories: |
45-
tools
46-
packaging
4747

4848
- name: Checkout repository
4949
uses: actions/checkout@v3
@@ -62,5 +62,4 @@ jobs:
6262
- name: Citus package tests
6363
env:
6464
GH_TOKEN: ${{ steps.app.outputs.token }}
65-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
6665
run: python -m pytest -q packaging_automation/tests/test_citus_package.py -s

‎.github/workflows/package-tests.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ on:
1414
jobs:
1515
metadata:
1616
runs-on: ubuntu-latest
17+
permissions:
18+
contents: write
19+
packages: write
20+
pull-requests: read
1721
outputs:
1822
pg_versions: ${{ steps.generate-postgres.outputs.pg_versions }}
1923
citus_version: ${{ steps.get-citus-version.outputs.citus_version }}
@@ -31,6 +35,8 @@ jobs:
3135
with:
3236
token: ${{ steps.app.outputs.token }}
3337
fetch-depth: 2
38+
submodules: true
39+
3440
- name: Package version
3541
id: get-citus-version
3642
run: |
@@ -91,7 +97,6 @@ jobs:
9197
- name: Citus package tests
9298
env:
9399
GH_TOKEN: ${{ steps.app.outputs.token }}
94-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
95100
run: |
96101
export PROJECT_VERSION="${{ github.event.inputs.project_version }}"
97102
echo "Citus Version: ${PROJECT_VERSION} "

‎.github/workflows/packaging-methods-tests.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,10 @@ on:
1010
jobs:
1111
unit_test_execution:
1212
runs-on: ubuntu-latest
13-
13+
permissions:
14+
contents: write
15+
packages: write
16+
pull-requests: read
1417
steps:
1518
- name: Create GitHub App token
1619
id: app
@@ -19,14 +22,12 @@ jobs:
1922
app-id: ${{ vars.GH_APP_ID }}
2023
private-key: ${{ secrets.GH_APP_KEY }}
2124
owner: citusdata
22-
repositories: |
23-
tools
24-
packaging
2525

2626
- name: Checkout repository
2727
uses: actions/checkout@v3
2828
with:
2929
token: ${{ steps.app.outputs.token }}
30+
submodules: true
3031

3132
- name: Install package dependencies
3233
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
@@ -37,5 +38,4 @@ jobs:
3738
- name: Citus package tests
3839
env:
3940
GH_TOKEN: ${{ steps.app.outputs.token }}
40-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
4141
run: python -m pytest -q packaging_automation/tests/test_citus_package_utils.py

‎.github/workflows/publish-docker-image-tests.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,10 @@ on:
1010
jobs:
1111
unit_test_execution:
1212
runs-on: ubuntu-latest
13-
13+
permissions:
14+
contents: write
15+
packages: write
16+
pull-requests: read
1417
steps:
1518

1619
- name: Create GitHub App token
@@ -25,6 +28,7 @@ jobs:
2528
uses: actions/checkout@v3
2629
with:
2730
token: ${{steps.app.outputs.token}}
31+
submodules: true
2832

2933

3034
- name: Install package dependencies
@@ -36,5 +40,4 @@ jobs:
3640
- name: Build and publish docker images tests
3741
env:
3842
GH_TOKEN: ${{ steps.app.outputs.token }}
39-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
4043
run: python -m pytest -q packaging_automation/tests/test_publish_docker.py

‎.github/workflows/pypi-statistics-schedule.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
steps:
2222
- name: Checkout repository
2323
uses: actions/checkout@v3
24-
24+
2525
- name: Install package dependencies
2626
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
2727

‎.github/workflows/statistic-schedule.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ on:
1818
jobs:
1919
execute_job:
2020
runs-on: ubuntu-latest
21+
permissions:
22+
contents: write
23+
packages: write
24+
pull-requests: read
2125
strategy:
2226
fail-fast: false
2327
matrix:
@@ -36,6 +40,7 @@ jobs:
3640
uses: actions/checkout@v3
3741
with:
3842
token: ${{ steps.app.outputs.token }}
43+
submodules: true
3944

4045
- name: Install package dependencies
4146
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
@@ -46,6 +51,5 @@ jobs:
4651
- name: Execute 'Fetch Daily Statistics'
4752
env:
4853
GH_TOKEN: ${{ steps.app.outputs.token }}
49-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
5054
JOB_NAME: "${{ matrix.JOB_NAME }}"
5155
run: packaging_automation/bash/daily-statistics-job.sh

‎.github/workflows/statistic-tests.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,10 @@ on:
1818
jobs:
1919
unit_test_execution:
2020
runs-on: ubuntu-latest
21-
21+
permissions:
22+
contents: write
23+
packages: write
24+
pull-requests: read
2225
steps:
2326
- name: Create GitHub App token
2427
id: app
@@ -32,6 +35,7 @@ jobs:
3235
uses: actions/checkout@v3
3336
with:
3437
token: ${{ steps.app.outputs.token }}
38+
submodules: true
3539

3640
- name: Install package dependencies
3741
run: sudo apt-get update && sudo apt-get install libcurl4-openssl-dev libssl-dev python3-testresources
@@ -42,23 +46,19 @@ jobs:
4246
- name: Unit tests for "Docker statistics"
4347
env:
4448
GH_TOKEN: ${{ steps.app.outputs.token }}
45-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
4649
run: python -m pytest -q packaging_automation/tests/test_docker_statistics_collector.py
4750

4851
- name: Unit tests for "Github clone statistics"
4952
env:
5053
GH_TOKEN: ${{ steps.app.outputs.token }}
51-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
5254
run: python -m pytest -q packaging_automation/tests/test_github_statistics_collector.py
5355

5456
- name: Unit tests for "Packagecloud download statistics"
5557
env:
5658
GH_TOKEN: ${{ steps.app.outputs.token }}
57-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
5859
run: python -m pytest -q packaging_automation/tests/test_package_cloud_statistics_collector.py
5960

6061
- name: Unit tests for "Homebrew download statistics"
6162
env:
6263
GH_TOKEN: ${{ steps.app.outputs.token }}
63-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
6464
run: python -m pytest -q packaging_automation/tests/test_homebrew_statistics_collector.py

‎.github/workflows/tool-tests.yml‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,10 @@ jobs:
2424

2525
unit_test_execution:
2626
runs-on: ubuntu-latest
27-
27+
permissions:
28+
contents: write
29+
packages: write
30+
pull-requests: read
2831
steps:
2932
- name: Create GitHub App token
3033
id: app
@@ -33,15 +36,13 @@ jobs:
3336
app-id: ${{ vars.GH_APP_ID }}
3437
private-key: ${{ secrets.GH_APP_KEY }}
3538
owner: citusdata
36-
repositories: |
37-
tools
38-
packaging
3939

4040
- name: Checkout repository
4141
uses: actions/checkout@v3
4242
with:
4343
token: ${{ steps.app.outputs.token }}
4444
fetch-depth: 0
45+
submodules: true
4546

4647
- name: Set up Python 3.10
4748
uses: actions/setup-python@v5
@@ -66,13 +67,11 @@ jobs:
6667
- name: Unit tests for "Common tools"
6768
env:
6869
GH_TOKEN: ${{ steps.app.outputs.token }}
69-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
7070
run: python -m pytest -q packaging_automation/tests/test_common_tool_methods.py
7171

7272
- name: Unit tests for "Update Package Properties"
7373
env:
7474
GH_TOKEN: ${{ steps.app.outputs.token }}
75-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
7675
run: python -m pytest -q packaging_automation/tests/test_update_package_properties.py
7776

7877
# no longer viable, outdated test, skipping to not block the pipeline
@@ -82,17 +81,14 @@ jobs:
8281
- name: Unit tests for "Update Docker"
8382
env:
8483
GH_TOKEN: ${{ steps.app.outputs.token }}
85-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
8684
run: python -m pytest -q packaging_automation/tests/test_update_docker.py
8785

8886
- name: Unit tests for "Update Pgxn"
8987
env:
9088
GH_TOKEN: ${{ steps.app.outputs.token }}
91-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
9289
run: python -m pytest -q packaging_automation/tests/test_update_pgxn.py
9390

9491
- name: Packaging Warning Handler
9592
env:
9693
GH_TOKEN: ${{ steps.app.outputs.token }}
97-
GITHUB_TOKEN: ${{ steps.app.outputs.token }}
9894
run: python -m pytest -q packaging_automation/tests/test_packaging_warning_handler.py

‎packaging_automation/common_tool_methods.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -680,7 +680,8 @@ def remove_suffix(initial_str: str, suffix: str) -> str:
680680
def initialize_env(exec_path: str, project_name: str, checkout_dir: str):
681681
remove_cloned_code(f"{exec_path}/{checkout_dir}")
682682
if not os.path.exists(checkout_dir):
683-
run(f"git clone https://github.com/citusdata/{project_name}.git {checkout_dir}")
683+
GH_TOKEN = os.environ.get("GH_TOKEN", "")
684+
run(f"git clone https://{GH_TOKEN}@github.com/citusdata/{project_name}.git {checkout_dir}")
684685

685686

686687
def create_pr(

0 commit comments

Comments
 (0)