Add Icinga secrets to beaker job

[bastelfreak]

To access Icinga EL repos, we need basic authentication. Vox Pupuli has test secrets. This relates to voxpupuli/puppet-icingadb#51

[ekohl]

I'd like to avoid this if possible. Can't we set the env vars in the job itself?

Edit: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables#defining-environment-variables-for-a-single-workflow documents how to set them at the top level. I'd expect that to work. We'll just need to fiddle with modulesync to make it possible.

[ekohl]

https://docs.github.com/en/actions/sharing-automations/reusing-workflows#limitations states:

Any environment variables set in an env context defined at the workflow level in the caller workflow are not propagated to the called workflow. For more information, see Store information in variables and Accessing contextual information about workflow runs.

So that's pretty limiting. However, I still think we shouldn't introduce repo specific changes into gha-puppet. At this point I struggle to figure out how.

[bastelfreak]

At this point I struggle to figure out how.

I had the same issues. I don't like the current approach, but I wasn't able to find an alternative.

[ekohl]

I wonder if we can somehow pass a hash so we don't need to special case it

[ekohl]

Linking back from IRC: we have the BEAKER_FACTER_* env vars. Those would be good to support.

Perhaps we can implement something more generic in metadata2gha to expose more env vars into Beaker, similar to --beaker-facter but something that doesn't end up in the testing matrix name etc.