Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gha: update to use aws sm #18857

Merged
merged 15 commits into from
Jun 10, 2024
Merged

gha: update to use aws sm #18857

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
d79b2f0
gha: update to actions/checkout@v4
andrewhsu Jun 7, 2024
0be664d
gha: update backport-command to use aws sm
andrewhsu Jun 7, 2024
4573b58
gha: remove old-backports.yml
andrewhsu Jun 7, 2024
d548a72
gha: remove unused packages-created.yml
andrewhsu Jun 7, 2024
316d46e
gha: remove unused render-draft-release-notes.yml
andrewhsu Jun 7, 2024
1755dda
gha: remove unused slack-messages.yml
andrewhsu Jun 7, 2024
71facd4
gha: update backport-on-merge to use aws sm
andrewhsu Jun 7, 2024
f588554
gha: update buildkite-slash-commands to use aws sm
andrewhsu Jun 7, 2024
f420b5f
gha: update cloud-installpack-bk-trigger to use aws sm
andrewhsu Jun 7, 2024
0cad174
gha: update comment_added to use aws sm
andrewhsu Jun 7, 2024
53caee3
gha: update jira_issue_manage to use aws sm
andrewhsu Jun 7, 2024
7fdafd8
gha: update promote to use aws sm
andrewhsu Jun 7, 2024
6a3a892
gha: update slash-commands to use aws sm
andrewhsu Jun 7, 2024
0ac5b2a
gha: update transform-sdk-release to use aws sm
andrewhsu Jun 7, 2024
d7f2c13
gha: update to actions/labeler@v5
andrewhsu Jun 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 31 additions & 17 deletions .github/workflows/backport-command.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,11 +25,25 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v3
uses: actions/checkout@v4

- name: configure aws credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_SM_READONLY_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SM_READONLY_SECRET_ACCESS_KEY }}
aws-region: us-west-2

- name: get secrets from aws sm
uses: aws-actions/aws-secretsmanager-get-secrets@v2
with:
secret-ids: |
,sdlc/prod/github/actions_bot_token
parse-json-secrets: true

- name: Get type of backport (issue or PR)
env:
GITHUB_TOKEN: ${{ secrets.ACTIONS_BOT_TOKEN }}
GITHUB_TOKEN: ${{ env.ACTIONS_BOT_TOKEN }}
CLIENT_PAYLOAD: ${{ toJson(github.event.client_payload) }}
id: get_backport_type
run: $SCRIPT_DIR/get_backport_type.sh
Expand All @@ -39,7 +53,7 @@ jobs:
uses: peter-evans/create-or-update-comment@v1
if: failure()
with:
token: ${{ secrets.ACTIONS_BOT_TOKEN }}
token: ${{ env.ACTIONS_BOT_TOKEN }}
repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
comment-id: ${{ github.event.client_payload.github.payload.comment.id }}
reaction-type: "-1"
Expand All @@ -48,7 +62,7 @@ jobs:
if: failure()
env:
COMMENTED_ON: ${{ steps.get_backport_type.outputs.commented_on }}
GITHUB_TOKEN: ${{ secrets.ACTIONS_BOT_TOKEN }}
GITHUB_TOKEN: ${{ env.ACTIONS_BOT_TOKEN }}
run: $SCRIPT_DIR/post_error.sh
shell: bash

Expand All @@ -62,11 +76,11 @@ jobs:
BACKPORT_BRANCH: ${{ needs.backport-type.outputs.backport_branch }}
steps:
- name: checkout
uses: actions/checkout@v3
uses: actions/checkout@v4

- name: Get user
env:
GITHUB_TOKEN: ${{ secrets.ACTIONS_BOT_TOKEN }}
GITHUB_TOKEN: ${{ env.ACTIONS_BOT_TOKEN }}
id: user
run: |
username=$(gh api user --jq .login)
Expand All @@ -82,7 +96,7 @@ jobs:

- name: Discover and create milestone
env:
GITHUB_TOKEN: ${{ secrets.ACTIONS_BOT_TOKEN }}
GITHUB_TOKEN: ${{ env.ACTIONS_BOT_TOKEN }}
TARGET_MILESTONE: ${{ needs.backport-type.outputs.target_milestone }}
id: create_milestone
run: $SCRIPT_DIR/create_milestone.sh
Expand All @@ -91,7 +105,7 @@ jobs:
- name: Create issue
if: needs.backport-type.outputs.commented_on == 'issue'
env:
GITHUB_TOKEN: ${{ secrets.ACTIONS_BOT_TOKEN }}
GITHUB_TOKEN: ${{ env.ACTIONS_BOT_TOKEN }}
TARGET_MILESTONE: ${{ steps.create_milestone.outputs.milestone }}
ORIG_TITLE: ${{ github.event.client_payload.github.payload.issue.title }}
ORIG_LABELS: ${{ toJson(github.event.client_payload.github.payload.issue.labels) }}
Expand All @@ -104,23 +118,23 @@ jobs:
if: needs.backport-type.outputs.commented_on == 'pr'
env:
BACKPORT_PR_NUMBER: ${{ github.event.client_payload.pull_request.number }}
GITHUB_TOKEN: ${{ secrets.ACTIONS_BOT_TOKEN }}
GITHUB_TOKEN: ${{ env.ACTIONS_BOT_TOKEN }}
id: backport_commits
run: |
backport_commits=$(gh api "repos/$TARGET_FULL_REPO/pulls/$BACKPORT_PR_NUMBER/commits" --jq .[].sha | paste -s -d ' ' -)
echo "backport_commits=$backport_commits" >> $GITHUB_OUTPUT

- uses: actions/checkout@v3
- uses: actions/checkout@v4
if: needs.backport-type.outputs.commented_on == 'pr'
with:
repository: ${{ steps.user.outputs.username }}/${{ steps.user.outputs.repo }}
token: ${{ secrets.ACTIONS_BOT_TOKEN }}
token: ${{ env.ACTIONS_BOT_TOKEN }}
path: ./fork

- name: Backport commits and get details
if: needs.backport-type.outputs.commented_on == 'pr'
env:
GITHUB_TOKEN: ${{ secrets.ACTIONS_BOT_TOKEN }}
GITHUB_TOKEN: ${{ env.ACTIONS_BOT_TOKEN }}
ORIG_TITLE: ${{ github.event.client_payload.github.payload.issue.title }}
BACKPORT_COMMITS: ${{ steps.backport_commits.outputs.backport_commits }}
IS_MERGED: ${{ github.event.client_payload.pull_request.merged }}
Expand All @@ -135,7 +149,7 @@ jobs:
- name: Create pull request
if: needs.backport-type.outputs.commented_on == 'pr'
env:
GITHUB_TOKEN: ${{ secrets.ACTIONS_BOT_TOKEN }}
GITHUB_TOKEN: ${{ env.ACTIONS_BOT_TOKEN }}
TARGET_MILESTONE: ${{ steps.create_milestone.outputs.milestone }}
ORIG_TITLE: ${{ github.event.client_payload.github.payload.issue.title }}
AUTHOR: ${{ github.event.client_payload.pull_request.user.login }}
Expand All @@ -151,7 +165,7 @@ jobs:
- name: Add reaction
uses: peter-evans/create-or-update-comment@v1
with:
token: ${{ secrets.ACTIONS_BOT_TOKEN }}
token: ${{ env.ACTIONS_BOT_TOKEN }}
repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
comment-id: ${{ github.event.client_payload.github.payload.comment.id }}
reaction-type: hooray
Expand All @@ -160,7 +174,7 @@ jobs:
uses: peter-evans/create-or-update-comment@v1
if: failure()
with:
token: ${{ secrets.ACTIONS_BOT_TOKEN }}
token: ${{ env.ACTIONS_BOT_TOKEN }}
repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
comment-id: ${{ github.event.client_payload.github.payload.comment.id }}
reaction-type: "-1"
Expand All @@ -169,14 +183,14 @@ jobs:
if: failure()
env:
COMMENTED_ON: ${{ needs.backport-type.outputs.commented_on }}
GITHUB_TOKEN: ${{ secrets.ACTIONS_BOT_TOKEN }}
GITHUB_TOKEN: ${{ env.ACTIONS_BOT_TOKEN }}
run: $SCRIPT_DIR/post_error.sh
shell: bash

- name: Create Issue On Error
if: failure()
env:
GITHUB_TOKEN: ${{ secrets.ACTIONS_BOT_TOKEN }}
GITHUB_TOKEN: ${{ env.ACTIONS_BOT_TOKEN }}
TARGET_MILESTONE: ${{ steps.create_milestone.outputs.milestone }}
ORIG_TITLE: ${{ github.event.client_payload.github.payload.issue.title }}
ORIG_LABELS: ${{ toJson(github.event.client_payload.github.payload.issue.labels) }}
Expand Down
17 changes: 14 additions & 3 deletions .github/workflows/backport-on-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:

steps:
- name: checkout
uses: actions/checkout@v3
uses: actions/checkout@v4

# Find the PR associated with this push, if there is one.
- uses: jwalton/gh-find-current-pr@v1
Expand All @@ -29,10 +29,21 @@ jobs:
if: success() && steps.findPr.outputs.number
env:
PR: ${{ steps.findPr.outputs.pr }}

- name: configure aws credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_SM_READONLY_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SM_READONLY_SECRET_ACCESS_KEY }}
aws-region: us-west-2
- name: get secrets from aws sm
uses: aws-actions/aws-secretsmanager-get-secrets@v2
with:
secret-ids: |
,sdlc/prod/github/actions_bot_token
parse-json-secrets: true
- name: Backport On Merge
env:
GITHUB_TOKEN: ${{ secrets.ACTIONS_BOT_TOKEN }}
GITHUB_TOKEN: ${{ env.ACTIONS_BOT_TOKEN }}
id: extract_required_backports_from_pr_body
run: $SCRIPT_DIR/backport_on_merge.sh
shell: bash
27 changes: 21 additions & 6 deletions .github/workflows/buildkite-slash-commands.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,31 +17,46 @@ jobs:
run-build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: configure aws credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_SM_READONLY_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SM_READONLY_SECRET_ACCESS_KEY }}
aws-region: us-west-2

- name: get secrets from aws sm
uses: aws-actions/aws-secretsmanager-get-secrets@v2
with:
secret-ids: |
,sdlc/prod/github/actions_bot_token
,sdlc/prod/github/buildkite_token
parse-json-secrets: true

- uses: actions/checkout@v4
with:
repository: redpanda-data/sparse-checkout
token: ${{ secrets.ACTIONS_BOT_TOKEN }}
token: ${{ env.ACTIONS_BOT_TOKEN }}
path: sparse-checkout

- uses: ./sparse-checkout
with:
repository: redpanda-data/vtools
token: ${{ secrets.ACTIONS_BOT_TOKEN }}
token: ${{ env.ACTIONS_BOT_TOKEN }}
patterns: actions
path: ghca

- name: Buildkite slash command action
uses: ./ghca/actions/buildkite-slash-commands
with:
buildkite_token: ${{ secrets.BUILDKITE_TOKEN }}
buildkite_token: ${{ env.BUILDKITE_TOKEN }}
buildkite_org: redpanda
buildkite_pipeline: redpanda
command: ${{ github.event.client_payload.slash_command.command }}

- name: Success reaction
uses: peter-evans/create-or-update-comment@v2
with:
token: ${{ secrets.ACTIONS_BOT_TOKEN }}
token: ${{ env.ACTIONS_BOT_TOKEN }}
repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
comment-id: ${{ github.event.client_payload.github.payload.comment.id }}
reaction-type: hooray
Expand All @@ -50,5 +65,5 @@ jobs:
if: failure()
uses: ./ghca/actions/slash-command-error
with:
token: ${{ secrets.ACTIONS_BOT_TOKEN }}
token: ${{ env.ACTIONS_BOT_TOKEN }}
body: ${{ env.ERROR_MSG }}
23 changes: 19 additions & 4 deletions .github/workflows/cloud-installpack-bk-trigger.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,23 +8,38 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v3
- name: configure aws credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_SM_READONLY_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SM_READONLY_SECRET_ACCESS_KEY }}
aws-region: us-west-2

- name: get secrets from aws sm
uses: aws-actions/aws-secretsmanager-get-secrets@v2
with:
secret-ids: |
,sdlc/prod/github/actions_bot_token
,sdlc/prod/github/buildkite_token
parse-json-secrets: true

- uses: actions/checkout@v4
with:
repository: redpanda-data/sparse-checkout
token: ${{ secrets.ACTIONS_BOT_TOKEN }}
token: ${{ env.ACTIONS_BOT_TOKEN }}
path: sparse-checkout

- uses: ./sparse-checkout
with:
repository: redpanda-data/vtools
token: ${{ secrets.ACTIONS_BOT_TOKEN }}
token: ${{ env.ACTIONS_BOT_TOKEN }}
patterns: actions
path: ghca

- name: Trigger Versions Bump Buildkite Job
uses: ./ghca/actions/buildkite-pipeline-trigger
with:
buildkite_token: ${{ secrets.BUILDKITE_TOKEN }}
buildkite_token: ${{ env.BUILDKITE_TOKEN }}
buildkite_org: redpanda
buildkite_pipeline: ${{ vars.CLOUD_PIPELINE }}
commit: HEAD
Expand Down
16 changes: 14 additions & 2 deletions .github/workflows/comment_added.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,24 @@ jobs:
run: pip install -r ${SCRIPT_DIR}/requirements.txt
- name: install pandoc
run: sudo apt-get update && sudo apt-get install -y pandoc
- name: configure aws credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_SM_READONLY_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SM_READONLY_SECRET_ACCESS_KEY }}
aws-region: us-west-2
- name: get secrets from aws sm
uses: aws-actions/aws-secretsmanager-get-secrets@v2
with:
secret-ids: |
,sdlc/prod/github/jira
parse-json-secrets: true
- name: Add comment to JIRA Issue
if: ${{ !github.event.issue.pull_request }}
env:
SCRIPT_DIR: ${{ github.workspace }}/.github/workflows/scripts
JIRA_TOKEN: ${{ secrets.JIRA_TOKEN }}
JIRA_USER: ${{ secrets.JIRA_USER }}
JIRA_TOKEN: ${{ env.JIRA_TOKEN }}
JIRA_USER: ${{ env.JIRA_USER }}
ISSUE_URL: ${{ github.event.issue.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
ISSUE_COMMENT: ${{ github.event.comment.body }}
Expand Down
16 changes: 14 additions & 2 deletions .github/workflows/jira_issue_manage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,11 +26,23 @@ jobs:
run: pip install -r ${SCRIPT_DIR}/requirements.txt
- name: install pandoc
run: sudo apt-get update && sudo apt-get install -y pandoc
- name: configure aws credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_SM_READONLY_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SM_READONLY_SECRET_ACCESS_KEY }}
aws-region: us-west-2
- name: get secrets from aws sm
uses: aws-actions/aws-secretsmanager-get-secrets@v2
with:
secret-ids: |
,sdlc/prod/github/jira
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assume the empty list before the leading comma means "all IDs" or something? Maybe a comment here would be useful.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that's just how the plugin is documented to be used for environmental variable naming with blank aliases:

If you set parse-json-secrets: true and enter a blank alias, followed by a comma and then the secret ID, the action names the environment variable the same as the parsed JSON keys.

parse-json-secrets: true
- name: Manage JIRA Issue
env:
SCRIPT_DIR: ${{ github.workspace }}/.github/workflows/scripts
JIRA_TOKEN: ${{ secrets.JIRA_TOKEN }}
JIRA_USER: ${{ secrets.JIRA_USER }}
JIRA_TOKEN: ${{ env.JIRA_TOKEN }}
JIRA_USER: ${{ env.JIRA_USER }}
ISSUE_URL: ${{ github.event.issue.html_url }}
ISSUE_TITLE: ${{ github.event.issue.title }}
ISSUE_BODY: ${{ github.event.issue.body }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/lint-cpp.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ jobs:
steps:

- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@v4

- name: Run clang-format
run: |
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/lint-includes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,6 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Run includes check
run: python tools/lint-includes src/v
2 changes: 1 addition & 1 deletion .github/workflows/lint-python.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
steps:

- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@v4

- name: Install yapf
run: pip install yapf==0.40.1
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/lint-sh.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
steps:

- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@v4

- name: Install shfmt
env:
Expand Down
25 changes: 0 additions & 25 deletions .github/workflows/old-backports.yml
View file
Open in desktop

This file was deleted.

Loading
Loading