mirror of
https://github.com/ModernRelay/omnigraph.git
synced 2026-06-09 01:35:18 +02:00
8086a0099c
On a public repo, Actions variables are not masked in workflow logs.
The AWS role ARN and artifact bucket name embed the AWS account ID —
not catastrophic, but norm-preserving to keep them out of public logs.
Switch all four values (region, role, project, bucket) from
`${{ vars.* }}` to `${{ secrets.* }}`. When secrets are passed via
`with:` to a reusable workflow, GitHub's masking still applies because
the value is added to the run's mask list as soon as the secret
reference is resolved.
Followup to #33 — should have landed as secrets from the start.
59 lines
2.2 KiB
YAML
59 lines
2.2 KiB
YAML
name: Package
|
|
|
|
# Builds both the default and aws-feature omnigraph-server images and pushes
|
|
# them to ECR. Invoked manually via workflow_dispatch — not wired to tags or
|
|
# main pushes today.
|
|
#
|
|
# Prerequisites:
|
|
# - Repo secrets AWS_REGION, AWS_ROLE_TO_ASSUME, AWS_CODEBUILD_PACKAGE_PROJECT,
|
|
# AWS_ARTIFACT_BUCKET are set. Stored as secrets (not variables) so the
|
|
# AWS account ID embedded in the role ARN and bucket name stays masked in
|
|
# public workflow logs.
|
|
# - The shared workflow at ModernRelay/.github supports the `features` and
|
|
# `image_tag_suffix` inputs (ModernRelay/.github PR #2 or later).
|
|
#
|
|
# Each invocation produces two ECR tags per source commit:
|
|
# - <source_sha> (default features)
|
|
# - <source_sha>-aws (--features aws)
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
source_ref:
|
|
description: Git ref to package (branch, tag, or SHA). Defaults to the workflow's own ref.
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
|
|
jobs:
|
|
package_default:
|
|
name: Package default build
|
|
uses: ModernRelay/.github/.github/workflows/omnigraph-package.yml@main
|
|
permissions:
|
|
id-token: write
|
|
contents: read
|
|
attestations: write
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
source_ref: ${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
|
|
aws_region: ${{ secrets.AWS_REGION }}
|
|
aws_role_to_assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
|
|
aws_codebuild_package_project: ${{ secrets.AWS_CODEBUILD_PACKAGE_PROJECT }}
|
|
aws_artifact_bucket: ${{ secrets.AWS_ARTIFACT_BUCKET }}
|
|
|
|
package_aws:
|
|
name: Package aws-feature build
|
|
uses: ModernRelay/.github/.github/workflows/omnigraph-package.yml@main
|
|
permissions:
|
|
id-token: write
|
|
contents: read
|
|
attestations: write
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
source_ref: ${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
|
|
aws_region: ${{ secrets.AWS_REGION }}
|
|
aws_role_to_assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
|
|
aws_codebuild_package_project: ${{ secrets.AWS_CODEBUILD_PACKAGE_PROJECT }}
|
|
aws_artifact_bucket: ${{ secrets.AWS_ARTIFACT_BUCKET }}
|
|
features: aws
|
|
image_tag_suffix: "-aws"
|