Skip to content

Commit 345dd7b

Browse files
committed
Give build workflow step access to required deployment environment
Certain operations in the "Arduino IDE" GitHub Actions workflow use GitHub Actions "secrets" which are defined in the repository's administrative settings. These secrets will typically not be defined when the workflow is run in a fork. However, the workflow's base functionality, the automated building of the application, does not require secrets. Since that base functionality alone is very useful to contributors (either to validate relevant changes to the application and infrastructure, or to generate tester builds) who are performing development work in a fork. For this reason, the workflow is configured to only perform the secret-dependent operations when the required secrets have been defined in the repository settings. One such operation is publishing the generated builds to Amazon S3, which Arduino uses to host files for distribution. This operation depends on the "AWS_ROLE_ARN" secret. As a security measure, this secret is defined inside a deployment environment (named "production"). GitHub Actions workflow jobs can only use secrets from deployment environments which they have been explicitly configured to have access to. At the time the workflow was originally developed, GitHub did not have the deployment environment feature, and so the workflow was not configured to use environments. The switch to using a deployment environment for this secret was made only recently, and when that was done, the workflow job that checks whether the secret is defined was not configured to have access to the "production" environment. This caused the workflow to think it was running in a context where that secret is not defined even when the secret is in fact defined. The bug caused the workflow to always spuriously skip the "publish" job which publishes nightly builds of Arduino IDE, and the "publish release" step which publishes production releases. The bug is fixed by configuring the "build-type-determination" job so that it has access to the "production" environment.
1 parent 875b42b commit 345dd7b

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

.github/workflows/build.yml

+1
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@ jobs:
172172
is-nightly: ${{ steps.determination.outputs.is-nightly }}
173173
channel-name: ${{ steps.determination.outputs.channel-name }}
174174
publish-to-s3: ${{ steps.determination.outputs.publish-to-s3 }}
175+
environment: production
175176
permissions: {}
176177
steps:
177178
- name: Determine the type of build

0 commit comments

Comments
 (0)