Skip to content

Commit c548f22

Browse files
trxcllnttrxcllnt
authored
Use GHA id-token for sccache-dist auth token (#1790)
Use the GitHub OIDC token for sccache-dist auth instead of the org's `secrets.GIST_REPO_READ_ORG_GITHUB_TOKEN` personal access token. This change is already implemented, this PR just removes any references to `GIST_REPO_READ_ORG_GITHUB_TOKEN`. Authors: - Paul Taylor (https://github.com/trxcllnt) Approvers: - James Lamb (https://github.com/jameslamb) URL: #1790
1 parent b0dccf2 commit c548f22

3 files changed

Lines changed: 0 additions & 22 deletions

File tree

‎.github/workflows/build.yaml‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,6 @@ jobs:
4343
node_type: cpu16
4444
script: ci/build_cpp.sh
4545
sha: ${{ inputs.sha }}
46-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
4746

4847
rocky8-clib-standalone-build:
4948
secrets: inherit
@@ -69,7 +68,6 @@ jobs:
6968
artifact-name: "libcuvs_c_${{ matrix.cuda_version }}_${{ matrix.arch }}.tar.gz"
7069
file_to_upload: "libcuvs_c.tar.gz"
7170
sha: ${{ inputs.sha }}
72-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
7371
rust-build:
7472
needs: cpp-build
7573
secrets: inherit
@@ -91,7 +89,6 @@ jobs:
9189
node_type: "gpu-l4-latest-1"
9290
script: "ci/build_rust.sh"
9391
sha: ${{ inputs.sha }}
94-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
9592
go-build:
9693
needs: cpp-build
9794
secrets: inherit
@@ -135,7 +132,6 @@ jobs:
135132
artifact-name: "cuvs-java-cuda${{ matrix.cuda_version }}"
136133
file_to_upload: "java/cuvs-java/target/"
137134
sha: ${{ inputs.sha }}
138-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
139135
python-build:
140136
needs: [cpp-build]
141137
secrets: inherit
@@ -146,7 +142,6 @@ jobs:
146142
date: ${{ inputs.date }}
147143
script: ci/build_python.sh
148144
sha: ${{ inputs.sha }}
149-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
150145
upload-conda:
151146
needs: [cpp-build, python-build]
152147
secrets: inherit
@@ -189,7 +184,6 @@ jobs:
189184
matrix_filter: group_by([.ARCH, (.CUDA_VER|split(".")|map(tonumber)|.[0])]) | map(max_by(.PY_VER|split(".")|map(tonumber)))
190185
package-name: libcuvs
191186
package-type: cpp
192-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
193187
wheel-publish-libcuvs:
194188
needs: wheel-build-libcuvs
195189
secrets: inherit
@@ -213,7 +207,6 @@ jobs:
213207
node_type: cpu8
214208
script: ci/build_wheel_cuvs.sh
215209
package-name: cuvs
216-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
217210
package-type: python
218211
wheel-publish-cuvs:
219212
needs: wheel-build-cuvs

‎.github/workflows/pr.yaml‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -317,7 +317,6 @@ jobs:
317317
build_type: pull-request
318318
node_type: cpu16
319319
script: ci/build_cpp.sh
320-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
321320
conda-cpp-tests:
322321
needs: [conda-cpp-build, changed-files]
323322
secrets: inherit
@@ -326,7 +325,6 @@ jobs:
326325
with:
327326
build_type: pull-request
328327
script: ci/test_cpp.sh
329-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
330328
conda-cpp-checks:
331329
needs: conda-cpp-build
332330
secrets: inherit
@@ -349,7 +347,6 @@ jobs:
349347
with:
350348
build_type: pull-request
351349
script: ci/test_python.sh
352-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
353350
rocky8-clib-standalone-build:
354351
needs: [checks]
355352
secrets: inherit
@@ -374,7 +371,6 @@ jobs:
374371
artifact-name: "libcuvs_c_${{ matrix.cuda_version }}_${{ matrix.arch }}.tar.gz"
375372
file_to_upload: "libcuvs_c.tar.gz"
376373
sha: ${{ inputs.sha }}
377-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
378374
rocky8-clib-tests:
379375
needs: [rocky8-clib-standalone-build, changed-files]
380376
secrets: inherit
@@ -418,7 +414,6 @@ jobs:
418414
script: "ci/test_java.sh"
419415
artifact-name: "cuvs-java-cuda${{ matrix.cuda_version }}"
420416
file_to_upload: "java/cuvs-java/target/"
421-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
422417
rust-build:
423418
needs: [conda-cpp-build, changed-files]
424419
secrets: inherit
@@ -438,7 +433,6 @@ jobs:
438433
arch: "amd64"
439434
container_image: "rapidsai/ci-conda:26.04-cuda${{ matrix.cuda_version }}-ubuntu24.04-py3.13"
440435
script: "ci/build_rust.sh"
441-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
442436
go-build:
443437
needs: [conda-cpp-build, changed-files]
444438
secrets: inherit
@@ -480,7 +474,6 @@ jobs:
480474
matrix_filter: group_by([.ARCH, (.CUDA_VER|split(".")|map(tonumber)|.[0])]) | map(max_by(.PY_VER|split(".")|map(tonumber)))
481475
package-name: libcuvs
482476
package-type: cpp
483-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
484477
wheel-build-cuvs:
485478
needs: wheel-build-libcuvs
486479
secrets: inherit
@@ -491,7 +484,6 @@ jobs:
491484
script: ci/build_wheel_cuvs.sh
492485
package-name: cuvs
493486
package-type: python
494-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
495487
wheel-tests-cuvs:
496488
needs: [wheel-build-cuvs, changed-files]
497489
secrets: inherit
@@ -500,7 +492,6 @@ jobs:
500492
with:
501493
build_type: pull-request
502494
script: ci/test_wheel_cuvs.sh
503-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
504495
devcontainer:
505496
secrets: inherit
506497
needs: telemetry-setup
@@ -509,12 +500,10 @@ jobs:
509500
arch: '["amd64", "arm64"]'
510501
cuda: '["13.1"]'
511502
node_type: "cpu8"
512-
rapids-aux-secret-1: GIST_REPO_READ_ORG_GITHUB_TOKEN
513503
env: |
514504
SCCACHE_DIST_MAX_RETRIES=inf
515505
SCCACHE_SERVER_LOG=sccache=debug
516506
SCCACHE_DIST_FALLBACK_TO_LOCAL_COMPILE=false
517-
SCCACHE_DIST_AUTH_TOKEN_VAR=RAPIDS_AUX_SECRET_1
518507
build_command: |
519508
sccache --zero-stats;
520509
build-all -j0 --verbose 2>&1 | tee telemetry-artifacts/build.log;

‎.github/workflows/test.yaml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@ jobs:
4141
date: ${{ inputs.date }}
4242
script: ci/test_cpp.sh
4343
sha: ${{ inputs.sha }}
44-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
4544
conda-python-tests:
4645
secrets: inherit
4746
uses: rapidsai/shared-workflows/.github/workflows/conda-python-tests.yaml@main
@@ -51,7 +50,6 @@ jobs:
5150
date: ${{ inputs.date }}
5251
script: ci/test_python.sh
5352
sha: ${{ inputs.sha }}
54-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
5553
conda-java-tests:
5654
secrets: inherit
5755
uses: rapidsai/shared-workflows/.github/workflows/custom-job.yaml@main
@@ -72,7 +70,6 @@ jobs:
7270
arch: "amd64"
7371
container_image: "rapidsai/ci-conda:26.04-cuda${{ matrix.cuda_version }}-ubuntu24.04-py3.13"
7472
script: "ci/test_java.sh"
75-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN
7673
wheel-tests-cuvs:
7774
secrets: inherit
7875
uses: rapidsai/shared-workflows/.github/workflows/wheels-test.yaml@main
@@ -82,4 +79,3 @@ jobs:
8279
date: ${{ inputs.date }}
8380
sha: ${{ inputs.sha }}
8481
script: ci/test_wheel_cuvs.sh
85-
sccache-dist-token-secret-name: GIST_REPO_READ_ORG_GITHUB_TOKEN

0 commit comments

Comments
 (0)