From cdaafb021287f28ef019333de039bf364036d9e5 Mon Sep 17 00:00:00 2001 From: Nancy Huang <205217630+naanci@users.noreply.github.com> Date: Sat, 15 Aug 2026 17:29:53 -0400 Subject: [PATCH 1/3] TAN-36: changes made to read CI secrets from process.env instead of decrypted .env.ci files --- .github/composite/setup-ci/action.yml | 8 ++++++ .github/scripts/auto-approval/index.ts | 5 ++-- .github/scripts/build-image/index.ts | 5 ++-- .../build-image/internal/standup-bot.ts | 6 ++--- .github/scripts/deploy/index.ts | 7 +++-- .github/scripts/notion/index.ts | 7 ++--- .../redeploy/internal/standup-bot/index.ts | 6 ++--- .github/scripts/test/run-backend-tests.ts | 5 ++-- .github/scripts/test/run-e2e-tests.ts | 6 ++--- .github/scripts/test/run-frontend-tests.ts | 5 ++-- .github/workflows/ai-command.yml | 6 ++--- .github/workflows/ai-review.yml | 9 +++---- .github/workflows/ci-cd.yml | 27 +++++++------------ .github/workflows/copy-command.yml | 3 +-- .github/workflows/deploy-command.yml | 18 +++++-------- .github/workflows/e2e.yml | 3 +-- .github/workflows/help-command.yml | 3 +-- .github/workflows/pr-verifications.yml | 3 +-- .github/workflows/slash.yml | 6 ++--- 19 files changed, 53 insertions(+), 85 deletions(-) diff --git a/.github/composite/setup-ci/action.yml b/.github/composite/setup-ci/action.yml index 6e236f41d..eaa82097f 100644 --- a/.github/composite/setup-ci/action.yml +++ b/.github/composite/setup-ci/action.yml @@ -12,10 +12,18 @@ inputs: description: "GitHub token used to send message" required: false default: ${{ github.token }} + SECRETS: + description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars." + required: false runs: using: "composite" steps: + - name: Setup CI + uses: ./.github/composite/setup-ci + with: + SECRETS: ${{ toJSON(secrets) }} + - name: Export GitHub Token shell: bash run: echo "GH_TOKEN=${{ inputs.GITHUB_TOKEN }}" >> $GITHUB_ENV diff --git a/.github/scripts/auto-approval/index.ts b/.github/scripts/auto-approval/index.ts index 675b39418..5a28d5089 100644 --- a/.github/scripts/auto-approval/index.ts +++ b/.github/scripts/auto-approval/index.ts @@ -1,6 +1,5 @@ import type { RestEndpointMethodTypes } from "@octokit/rest"; -import { getEnvVariables } from "load-secrets/env/load"; import { checkNotionPrAndGetTask } from "notion/pr"; import { getNotionClient } from "notion/sdk"; import { Octokit } from "octokit"; @@ -34,7 +33,7 @@ const { .strict() .parse(); -function parseCiEnv(ciEnv: Record) { +function parseCiEnv(ciEnv: Record) { const notionDbId = (() => { const v = ciEnv["NOTION_TASK_DB_ID"]; if (!v) { @@ -57,7 +56,7 @@ function parseCiEnv(ciEnv: Record) { }; } -const { notionDbId, notionSecret } = parseCiEnv(await getEnvVariables(["ci"])); +const { notionDbId, notionSecret } = parseCiEnv(process.env); const notionClient = getNotionClient(notionSecret); const taskAndPr = await checkNotionPrAndGetTask(notionClient, prId, notionDbId); diff --git a/.github/scripts/build-image/index.ts b/.github/scripts/build-image/index.ts index 458157e5f..d249d70ae 100644 --- a/.github/scripts/build-image/index.ts +++ b/.github/scripts/build-image/index.ts @@ -40,8 +40,7 @@ const serverProfiles = environment === "staging" ? "stg" : "prod"; async function main() { try { - const ciEnv = await getEnvVariables(["ci"]); - const { dockerHubPat } = parseCiEnv(ciEnv); + const { dockerHubPat } = parseCiEnv(process.env); const localDbEnv = await db.start(); const ciAppEnv = await getEnvVariables(["ci-app"]); @@ -126,7 +125,7 @@ async function main() { } } -function parseCiEnv(ciEnv: Record) { +function parseCiEnv(ciEnv: Record) { const dockerHubPat = (() => { const v = ciEnv["DOCKER_HUB_PAT"]; if (!v) { diff --git a/.github/scripts/build-image/internal/standup-bot.ts b/.github/scripts/build-image/internal/standup-bot.ts index 6b3405133..44227c1d6 100644 --- a/.github/scripts/build-image/internal/standup-bot.ts +++ b/.github/scripts/build-image/internal/standup-bot.ts @@ -1,5 +1,4 @@ import { $ } from "bun"; -import { getEnvVariables } from "load-secrets/env/load"; import yargs from "yargs"; import { hideBin } from "yargs/helpers"; @@ -27,8 +26,7 @@ const { dockerUpload, getGhaOutput, githubOutputFile } = await yargs( .parse(); async function main() { - const ciEnv = await getEnvVariables(["ci"]); - const { dockerHubPat } = parseCiEnv(ciEnv); + const { dockerHubPat } = parseCiEnv(process.env); // copy old tz format from build-image.sh const timestamp = new Date() @@ -94,7 +92,7 @@ async function main() { } } -function parseCiEnv(ciEnv: Record) { +function parseCiEnv(ciEnv: Record) { const dockerHubPat = (() => { const v = ciEnv["DOCKER_HUB_PAT"]; if (!v) { diff --git a/.github/scripts/deploy/index.ts b/.github/scripts/deploy/index.ts index 15de5e56d..d49ca1918 100644 --- a/.github/scripts/deploy/index.ts +++ b/.github/scripts/deploy/index.ts @@ -1,7 +1,7 @@ import type { Environment } from "@tahminator/pipeline"; import type { Type } from "types"; -import { GitHubClient, Utils } from "@tahminator/pipeline"; +import { GitHubClient } from "@tahminator/pipeline"; import yargs from "yargs"; import { hideBin } from "yargs/helpers"; @@ -24,8 +24,7 @@ const { environment, newTagVersion, type } = await yargs(hideBin(process.argv)) .parse(); async function main() { - const ciEnv = await Utils.getEnvVariables(["ci"]); - const { ghPat } = parseCiEnv(ciEnv); + const { ghPat } = parseCiEnv(process.env); const ghClient = new GitHubClient(ghPat); if (type === "web") { @@ -51,7 +50,7 @@ async function main() { } } -function parseCiEnv(ciEnv: Record) { +function parseCiEnv(ciEnv: Record) { const ghPat = (() => { const v = ciEnv["GH_PAT"]; if (!v) { diff --git a/.github/scripts/notion/index.ts b/.github/scripts/notion/index.ts index 3587b25c3..ce37f70eb 100644 --- a/.github/scripts/notion/index.ts +++ b/.github/scripts/notion/index.ts @@ -1,4 +1,3 @@ -import { getEnvVariables } from "load-secrets/env/load"; import { _checkCommits } from "notion/commits"; import { checkNotionPrAndGetTask } from "notion/pr"; import { _validateNotionTask } from "notion/pr/validate-ticket"; @@ -42,9 +41,7 @@ const { async function main() { console.log(`GET_GHA_OUTPUT=${getGhaOutput}`); - const { notionDbId, notionSecret } = parseCiEnv( - await getEnvVariables(["ci"]), - ); + const { notionDbId, notionSecret } = parseCiEnv(process.env); const client = getNotionClient(notionSecret); const { taskId, taskContent, task, taskPublicUrl } = @@ -72,7 +69,7 @@ async function main() { } } -function parseCiEnv(ciEnv: Record) { +function parseCiEnv(ciEnv: Record) { const notionDbId = (() => { const v = ciEnv["NOTION_TASK_DB_ID"]; if (!v) { diff --git a/.github/scripts/redeploy/internal/standup-bot/index.ts b/.github/scripts/redeploy/internal/standup-bot/index.ts index 12274da87..d25d1b356 100644 --- a/.github/scripts/redeploy/internal/standup-bot/index.ts +++ b/.github/scripts/redeploy/internal/standup-bot/index.ts @@ -11,9 +11,7 @@ async function main() { // await $`git-crypt unlock`; const { bearerAuth, serverUrl, projectUuid, serverUuid } = parseCiEnv( - await getEnvVariables(["ci"], { - baseDir: "internal", - }), + process.env, ); const client = await initClient(bearerAuth, serverUrl); @@ -74,7 +72,7 @@ async function main() { } } -function parseCiEnv(ciEnv: Record) { +function parseCiEnv(ciEnv: Record) { const bearerAuth = (() => { const v = ciEnv["COOLIFY_BEARER_AUTH"]; if (!v) { diff --git a/.github/scripts/test/run-backend-tests.ts b/.github/scripts/test/run-backend-tests.ts index 4c078b7d6..7548c88a8 100644 --- a/.github/scripts/test/run-backend-tests.ts +++ b/.github/scripts/test/run-backend-tests.ts @@ -44,8 +44,7 @@ async function main() { await $$`./mvnw clean verify -Dspring.profiles.active=ci`; if (shouldUploadCoverage) { - const ciEnv = await getEnvVariables(["ci"]); - const { sonarToken } = parseCiEnv(ciEnv); + const { sonarToken } = parseCiEnv(process.env); await uploadBackendTests(sonarToken); } } finally { @@ -55,7 +54,7 @@ async function main() { } } -function parseCiEnv(ciEnv: Record) { +function parseCiEnv(ciEnv: Record) { const sonarToken = (() => { const v = ciEnv["SONAR_TOKEN"]; if (!v) { diff --git a/.github/scripts/test/run-e2e-tests.ts b/.github/scripts/test/run-e2e-tests.ts index 6f73b39d5..fa9b63552 100644 --- a/.github/scripts/test/run-e2e-tests.ts +++ b/.github/scripts/test/run-e2e-tests.ts @@ -20,9 +20,7 @@ const { actionUrl, skipDiscordMessage } = await yargs(hideBin(process.argv)) .parse(); async function main() { - const { discordToken, discordChannelId } = parseCiEnv( - await getEnvVariables(["ci"]), - ); + const { discordToken, discordChannelId } = parseCiEnv(process.env); try { const ciAppEnv = await getEnvVariables(["ci-app"]); @@ -81,7 +79,7 @@ main() process.exit(1); }); -function parseCiEnv(env: Record) { +function parseCiEnv(env: Record) { const discordToken = env["DISCORD_TOKEN"]; if (!discordToken) { throw new Error("Missing DISCORD_TOKEN from .env.ci"); diff --git a/.github/scripts/test/run-frontend-tests.ts b/.github/scripts/test/run-frontend-tests.ts index 6d53421d2..3aca02e51 100644 --- a/.github/scripts/test/run-frontend-tests.ts +++ b/.github/scripts/test/run-frontend-tests.ts @@ -30,8 +30,7 @@ async function main() { await $$`pnpm --dir js run test`; if (shouldUploadCoverage) { - const ciEnv = await getEnvVariables(["ci"]); - const { sonarToken } = parseCiEnv(ciEnv); + const { sonarToken } = parseCiEnv(process.env); await uploadFrontendTests(sonarToken); } @@ -41,7 +40,7 @@ async function main() { } } -function parseCiEnv(ciEnv: Record) { +function parseCiEnv(ciEnv: Record) { const sonarToken = (() => { const v = ciEnv["SONAR_TOKEN"]; if (!v) { diff --git a/.github/workflows/ai-command.yml b/.github/workflows/ai-command.yml index 80c021c1d..845f4dbf2 100644 --- a/.github/workflows/ai-command.yml +++ b/.github/workflows/ai-command.yml @@ -61,14 +61,12 @@ jobs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Load secrets uses: ./.github/composite/load-secrets with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} UNLOAD_ENVIRONMENTS: ci - name: Post /review command diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml index 9fd324022..7b9ef2ce1 100644 --- a/.github/workflows/ai-review.yml +++ b/.github/workflows/ai-review.yml @@ -58,14 +58,12 @@ jobs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Load secrets uses: ./.github/composite/load-secrets with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} UNLOAD_ENVIRONMENTS: ci - name: Run composite workflow @@ -73,8 +71,7 @@ jobs: id: notion_check with: PR_ID: ${{ github.event.number || github.event.issue.number }} - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} GET_GHA_OUTPUT: "true" VALIDATE_TICKET: "false" diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index b6c0344cd..7134c392a 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -61,8 +61,7 @@ jobs: - name: Run workflow uses: ./.github/composite/test/backend-test with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} frontendTests: name: Frontend Tests @@ -76,8 +75,7 @@ jobs: - name: Run workflow uses: ./.github/composite/test/frontend-test with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} testBuildImage: name: Build Test Docker Image @@ -93,8 +91,7 @@ jobs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Set up pnpm uses: pnpm/action-setup@v5 @@ -140,8 +137,7 @@ jobs: - name: Run workflow uses: ./.github/composite/build-image/internal/standup-bot with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} DOCKER_UPLOAD: false validateDBSchema: @@ -156,8 +152,7 @@ jobs: - name: Run workflow uses: ./.github/composite/validate-db with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} buildImage: name: Build Docker Image & Upload to Registry @@ -174,8 +169,7 @@ jobs: uses: ./.github/composite/build-image with: environment: production - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} buildStandupBotImage: name: Build codebloom-standup-bot Docker Image & Upload to Registry @@ -190,8 +184,7 @@ jobs: - name: Run workflow uses: ./.github/composite/build-image/internal/standup-bot with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} redeploy: name: Redeploy on DigitalOcean @@ -208,8 +201,7 @@ jobs: - name: Run workflow uses: ./.github/composite/redeploy with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} # redeployStandupBot: # name: Redeploy codebloom-standup-bot on Coolify @@ -226,5 +218,4 @@ jobs: # - name: Run workflow # uses: ./.github/composite/redeploy/internal/standup-bot # with: - # GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - # GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + # SECRETS: ${{ toJSON(secrets) }} diff --git a/.github/workflows/copy-command.yml b/.github/workflows/copy-command.yml index bf802fc33..1a726214c 100644 --- a/.github/workflows/copy-command.yml +++ b/.github/workflows/copy-command.yml @@ -56,8 +56,7 @@ jobs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Set up OpenJDK 25 uses: actions/setup-java@v5 diff --git a/.github/workflows/deploy-command.yml b/.github/workflows/deploy-command.yml index b97ccde82..b87f6fff7 100644 --- a/.github/workflows/deploy-command.yml +++ b/.github/workflows/deploy-command.yml @@ -111,14 +111,12 @@ jobs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Load secrets uses: ./.github/composite/load-secrets with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} UNLOAD_ENVIRONMENTS: ci - name: Log in to Docker Hub @@ -151,8 +149,7 @@ jobs: - name: Run workflow uses: ./.github/composite/test/frontend-pre-test with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} backendPreTest: name: Backend Compile Test @@ -185,8 +182,7 @@ jobs: - name: Run workflow uses: ./.github/composite/validate-db with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} ENVIRONMENT: staging SHA: ${{ needs.getPRHead.outputs.sha }} @@ -213,8 +209,7 @@ jobs: uses: ./.github/composite/build-image with: ENVIRONMENT: staging - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} redeploy: name: Redeploy on DigitalOcean @@ -232,8 +227,7 @@ jobs: - name: Run workflow uses: ./.github/composite/redeploy with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} ENVIRONMENT: staging SHA: ${{ needs.getPRHead.outputs.sha }} diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 5c0052bfa..32465f3f8 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -23,8 +23,7 @@ jobs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Set up pnpm uses: pnpm/action-setup@v5 diff --git a/.github/workflows/help-command.yml b/.github/workflows/help-command.yml index 00616e2c4..e4c3407ed 100644 --- a/.github/workflows/help-command.yml +++ b/.github/workflows/help-command.yml @@ -20,8 +20,7 @@ jobs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Run script shell: bash diff --git a/.github/workflows/pr-verifications.yml b/.github/workflows/pr-verifications.yml index e03580eac..45f67bfc2 100644 --- a/.github/workflows/pr-verifications.yml +++ b/.github/workflows/pr-verifications.yml @@ -34,5 +34,4 @@ jobs: # id: notion_check # with: # PR_ID: ${{ github.event.number }} -# GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} -# GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} +# SECRETS: ${{ toJSON(secrets) }} diff --git a/.github/workflows/slash.yml b/.github/workflows/slash.yml index d66c9c3af..18727c2a4 100644 --- a/.github/workflows/slash.yml +++ b/.github/workflows/slash.yml @@ -51,8 +51,7 @@ jobs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Run script run: bun run .github/scripts/load-slash-commands --get-gha-output=true @@ -61,8 +60,7 @@ jobs: - name: Load secrets uses: ./.github/composite/load-secrets with: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} UNLOAD_ENVIRONMENTS: ci - name: Slash Command Dispatch From e095321677b0aeacaa6c283795459a02e010d1e2 Mon Sep 17 00:00:00 2001 From: Nancy Huang <205217630+naanci@users.noreply.github.com> Date: Sat, 15 Aug 2026 18:58:30 -0400 Subject: [PATCH 2/3] TAN-36: error call fix --- .github/composite/setup-ci/action.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/composite/setup-ci/action.yml b/.github/composite/setup-ci/action.yml index eaa82097f..92a34199d 100644 --- a/.github/composite/setup-ci/action.yml +++ b/.github/composite/setup-ci/action.yml @@ -19,11 +19,6 @@ inputs: runs: using: "composite" steps: - - name: Setup CI - uses: ./.github/composite/setup-ci - with: - SECRETS: ${{ toJSON(secrets) }} - - name: Export GitHub Token shell: bash run: echo "GH_TOKEN=${{ inputs.GITHUB_TOKEN }}" >> $GITHUB_ENV From 4af1f6c1b1b16b71f1d54001e2daf13ca0734794 Mon Sep 17 00:00:00 2001 From: Nancy Huang <205217630+naanci@users.noreply.github.com> Date: Sat, 15 Aug 2026 19:17:30 -0400 Subject: [PATCH 3/3] TAN-36: changed secret call in composite folder --- .github/composite/build-image/action.yml | 3 +-- .../build-image/internal/standup-bot/action.yml | 3 +-- .github/composite/deploy-standup-bot/action.yaml | 3 +-- .github/composite/notion-checks/action.yml | 3 +-- .github/composite/redeploy/action.yml | 3 +-- .../redeploy/internal/standup-bot/action.yml | 3 +-- .github/composite/test/backend-test/action.yml | 12 ++++-------- .github/composite/test/frontend-pre-test/action.yml | 3 +-- .github/composite/test/frontend-test/action.yml | 3 +-- .github/composite/validate-db/action.yml | 3 +-- 10 files changed, 13 insertions(+), 26 deletions(-) diff --git a/.github/composite/build-image/action.yml b/.github/composite/build-image/action.yml index 52052de53..75e46eadb 100644 --- a/.github/composite/build-image/action.yml +++ b/.github/composite/build-image/action.yml @@ -27,8 +27,7 @@ runs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Set up pnpm uses: pnpm/action-setup@v5 diff --git a/.github/composite/build-image/internal/standup-bot/action.yml b/.github/composite/build-image/internal/standup-bot/action.yml index 4232fa653..dcd277668 100644 --- a/.github/composite/build-image/internal/standup-bot/action.yml +++ b/.github/composite/build-image/internal/standup-bot/action.yml @@ -24,8 +24,7 @@ runs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Set up OpenJDK 25 uses: actions/setup-java@v5 diff --git a/.github/composite/deploy-standup-bot/action.yaml b/.github/composite/deploy-standup-bot/action.yaml index ea18f44a2..e1ff01a42 100644 --- a/.github/composite/deploy-standup-bot/action.yaml +++ b/.github/composite/deploy-standup-bot/action.yaml @@ -19,8 +19,7 @@ runs: id: build-image uses: ./.github/composite/build-image/internal/standup-bot with: - GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Deploy standup-bot image tag shell: bash diff --git a/.github/composite/notion-checks/action.yml b/.github/composite/notion-checks/action.yml index 2d506d33c..eb801b380 100644 --- a/.github/composite/notion-checks/action.yml +++ b/.github/composite/notion-checks/action.yml @@ -31,8 +31,7 @@ runs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Run script id: run_script diff --git a/.github/composite/redeploy/action.yml b/.github/composite/redeploy/action.yml index 3076545a5..ef6df6c6c 100644 --- a/.github/composite/redeploy/action.yml +++ b/.github/composite/redeploy/action.yml @@ -22,8 +22,7 @@ runs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Set up pnpm uses: pnpm/action-setup@v5 diff --git a/.github/composite/redeploy/internal/standup-bot/action.yml b/.github/composite/redeploy/internal/standup-bot/action.yml index 7eae77290..a552bc2a4 100644 --- a/.github/composite/redeploy/internal/standup-bot/action.yml +++ b/.github/composite/redeploy/internal/standup-bot/action.yml @@ -15,8 +15,7 @@ runs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Expose GitHub Runtime uses: crazy-max/ghaction-github-runtime@v4 diff --git a/.github/composite/test/backend-test/action.yml b/.github/composite/test/backend-test/action.yml index 79d26f443..a5a0356e8 100644 --- a/.github/composite/test/backend-test/action.yml +++ b/.github/composite/test/backend-test/action.yml @@ -2,12 +2,9 @@ name: "Backend test" description: "Run backend tests" inputs: - GPG_PRIVATE_KEY: - description: "GPG Private Key" - required: true - GPG_PASSPHRASE: - description: "GPG Passphrase" - required: true + SECRETS: + description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars." + required: false UPLOAD_TEST_COV: description: "Boolean indicating whether tests should be uploaded to our code coverage provider or not." required: false @@ -19,8 +16,7 @@ runs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Set up pnpm uses: pnpm/action-setup@v5 diff --git a/.github/composite/test/frontend-pre-test/action.yml b/.github/composite/test/frontend-pre-test/action.yml index 369a62619..8b0ae7aff 100644 --- a/.github/composite/test/frontend-pre-test/action.yml +++ b/.github/composite/test/frontend-pre-test/action.yml @@ -15,8 +15,7 @@ runs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Set up OpenJDK 25 uses: actions/setup-java@v5 diff --git a/.github/composite/test/frontend-test/action.yml b/.github/composite/test/frontend-test/action.yml index 61bf09067..906daa33b 100644 --- a/.github/composite/test/frontend-test/action.yml +++ b/.github/composite/test/frontend-test/action.yml @@ -19,8 +19,7 @@ runs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Set up pnpm uses: pnpm/action-setup@v5 diff --git a/.github/composite/validate-db/action.yml b/.github/composite/validate-db/action.yml index 70fb3a18a..58b304716 100644 --- a/.github/composite/validate-db/action.yml +++ b/.github/composite/validate-db/action.yml @@ -22,8 +22,7 @@ runs: - name: Setup CI uses: ./.github/composite/setup-ci with: - GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }} + SECRETS: ${{ toJSON(secrets) }} - name: Set up OpenJDK 25 uses: actions/setup-java@v5