Skip to content

[skip-changelog] use OIDC to retrieve the credentials #901

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 27, 2024
Merged

[skip-changelog] use OIDC to retrieve the credentials #901

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 26 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,6 @@ env:
PROJECT_NAME: arduino-create-agent
TARGET: "/CreateAgent/Stable/"
VERSION_TARGET: "arduino-create-static/agent-metadata/"
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
Comment on lines -13 to -14
Copy link
Contributor Author

@umbynos umbynos Feb 15, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • TODO remove these from the secrets

AWS_REGION: "us-east-1" # or https://github.com/aws/aws-cli/issues/5623
KEYCHAIN: "sign.keychain"
KEYCHAIN_PASSWORD: keychainpassword # Arbitrary password for a keychain that exists only for the duration of the job, so not secret
Expand Down Expand Up @@ -129,6 +127,13 @@ jobs:
- name: Create autoupdate files for win32
run: go-selfupdate -platform windows-${{ matrix.arch }} ${{ env.PROJECT_NAME }}${{ matrix.ext }} ${TAG_VERSION}
if: matrix.arch == '386' && matrix.os == 'windows-2019' && steps.prerelease.outputs.IS_PRE != 'true'

- name: configure aws credentials
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
Copy link
Contributor Author

@umbynos umbynos Feb 15, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This has been added to the environment production

role-session-name: "github_${{ env.PROJECT_NAME }}"
aws-region: ${{ env.AWS_REGION }}

- name: Upload autoupdate files to Arduino downloads servers
run: |
Expand Down Expand Up @@ -316,6 +321,13 @@ jobs:
run: |
gon -log-level=debug -log-json "${{ env.GON_CONFIG_PATH }}"
- name: configure aws credentials
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
role-session-name: "github_${{ env.PROJECT_NAME }}"
aws-region: ${{ env.AWS_REGION }}

- name: Upload autoupdate bundle to Arduino downloads servers
run: aws s3 cp ArduinoCreateAgent.app_${{ matrix.arch }}_notarized.zip s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.TARGET }}${GITHUB_REF/refs\/tags\//}/ # the version should be created in th the build job
if: ${{ needs.build.outputs.prerelease != 'true' }}
Expand Down Expand Up @@ -523,7 +535,11 @@ jobs:

create-release:
runs-on: ubuntu-20.04
environment: production
needs: [build, package, generate-sign-dmg]
permission:
contents: write
id-token: write # This is required for requesting the JWT

steps:
- name: Checkout
Expand Down Expand Up @@ -594,6 +610,14 @@ jobs:
file_glob: true # If set to true, the file argument can be a glob pattern
file: release/*


- name: configure aws credentials
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
role-session-name: "github_${{ env.PROJECT_NAME }}"
aws-region: ${{ env.AWS_REGION }}

- name: Upload release files on Arduino downloads servers
run: aws s3 sync release/ s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.TARGET }}
if: ${{ needs.build.outputs.prerelease != 'true' }}
Expand Down