fix: add GHA based nightly workflow for chains#1634
fix: add GHA based nightly workflow for chains#1634anithapriyanatarajan wants to merge 1 commit intotektoncd:mainfrom
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
tekton-robot
added
the
size/L
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| with: | ||
| kubernetes_version: ${{ env.KUBERNETES_VERSION }} | ||
| image_registry_user: ${{ env.IMAGE_REGISTRY_USER }} | ||
| ghcr_token: ${{ secrets.GHCR_TOKEN }} |
There was a problem hiding this comment.
The fix for this would be to add an environment: nightly (key/value) to the job and then configure the repo setting to include these secrets to Settings->Environment->nightly. Instead, would like to get this PR merged,make sure the nightly builds are published as expected following the existing components and then do a follow up PR for the same.
There was a problem hiding this comment.
@anithapriyanatarajan is it possible to setup an environment at org level?
What is the protection that environment provide, will the environment fill the secret only for a specific workflow and avoid the secret being exposed through PRs?
There was a problem hiding this comment.
environments are repository scoped. The advantage is, Secrets defined on the environment are only injected into jobs that declare environment: nightly. A job without that declaration simply cannot access them, even in the same workflow.
As of now, we are consuming the secret from org setting I believe. So if we are inclined for this environment approach, I will update the PR or we will have a follow up PR. Thank you
| kubernetes_version: ${{ env.KUBERNETES_VERSION }} | ||
| image_registry_user: ${{ env.IMAGE_REGISTRY_USER }} | ||
| ghcr_token: ${{ secrets.GHCR_TOKEN }} | ||
| oci_api_key: ${{ secrets.OCI_API_KEY }} |
There was a problem hiding this comment.
The fix for this would be to add an environment: nightly (key/value) to the job and then configure the repo setting to include these secrets to Settings->Environment->nightly. Instead, would like to get this PR merged,make sure the nightly builds are published as expected following the existing components and then do a follow up PR for the same.
| image_registry_user: ${{ env.IMAGE_REGISTRY_USER }} | ||
| ghcr_token: ${{ secrets.GHCR_TOKEN }} | ||
| oci_api_key: ${{ secrets.OCI_API_KEY }} | ||
| oci_fingerprint: ${{ secrets.OCI_FINGERPRINT }} |
There was a problem hiding this comment.
The fix for this would be to add an environment: nightly (key/value) to the job and then configure the repo setting to include these secrets to Settings->Environment->nightly. Instead, would like to get this PR merged,make sure the nightly builds are published as expected following the existing components and then do a follow up PR for the same.
| ghcr_token: ${{ secrets.GHCR_TOKEN }} | ||
| oci_api_key: ${{ secrets.OCI_API_KEY }} | ||
| oci_fingerprint: ${{ secrets.OCI_FINGERPRINT }} | ||
| oci_tenancy_ocid: ${{ secrets.OCI_TENANCY_OCID }} |
There was a problem hiding this comment.
same as above
| oci_api_key: ${{ secrets.OCI_API_KEY }} | ||
| oci_fingerprint: ${{ secrets.OCI_FINGERPRINT }} | ||
| oci_tenancy_ocid: ${{ secrets.OCI_TENANCY_OCID }} | ||
| oci_user_ocid: ${{ secrets.OCI_USER_OCID }} |
There was a problem hiding this comment.
same as above
anithapriyanatarajan
force-pushed
the
fix-nightly
branch
from
55092d6 to
deec487
Compare
|
/kind misc |
tekton-robot
added
the
kind/misc
Signed-off-by: Anitha Natarajan <anataraj@redhat.com>
anithapriyanatarajan
force-pushed
the
fix-nightly
branch
from
deec487 to
e6723f2
Compare
4 participants
Changes
PR to include nightly build workflows for chains repo to publish the manifests to oracle cloud buckets.
Submitter Checklist
As the author of this PR, please check off the items in this checklist:
functionality, content, code)
Release Notes