@ada-support/web-storage 1.4.4 → 1.4.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,87 @@
|
|
|
1
|
+
# One-time migration: copy web-storage's CI Actions secrets into the shared `api`
|
|
2
|
+
# Doppler project, so the migrated monorepo workflows can fetch them over OIDC
|
|
3
|
+
# (see .github/workflows/web-storage-{deploy-html,notify-people}.yml).
|
|
4
|
+
#
|
|
5
|
+
# WHERE TO RUN: commit and run this in the STANDALONE `AdaSupport/web-storage`
|
|
6
|
+
# repo. The source secrets it reads are only readable there — running it in the
|
|
7
|
+
# monorepo would read empty values (the guard below blocks that). Trigger it
|
|
8
|
+
# manually from the Actions tab (workflow_dispatch), confirm success in the
|
|
9
|
+
# Doppler dashboard, then delete this workflow and the DOPPLER_TOKEN secret.
|
|
10
|
+
#
|
|
11
|
+
# MIGRATED: the 5 repo-level AWS/CloudFront secrets, plus SLACK_WEBHOOK_URL
|
|
12
|
+
# (org-level, but readable in this repo's workflow context — notify-people now
|
|
13
|
+
# fetches it from Doppler too).
|
|
14
|
+
#
|
|
15
|
+
# EXCLUDED on purpose (do NOT migrate):
|
|
16
|
+
# - NPM_TOKEN -> publish now uses npm OIDC trusted publishing.
|
|
17
|
+
# - JIRA_* / TEMP_JIRA -> the dependabot-jira workflow was dropped.
|
|
18
|
+
# - SONAR_TOKEN -> not used by any migrated workflow.
|
|
19
|
+
#
|
|
20
|
+
# NAMING: values are written to Doppler with a `WEB_STORAGE_` prefix (e.g.
|
|
21
|
+
# WEB_STORAGE_CLOUDFRONT_DISTRIBUTION_ID) to avoid collisions in the shared `api`
|
|
22
|
+
# project. The consuming workflow reads them as steps.doppler.outputs.WEB_STORAGE_*.
|
|
23
|
+
#
|
|
24
|
+
# PREREQUISITE: a Doppler token with WRITE access to api/ci_github_actions,
|
|
25
|
+
# stored as the `DOPPLER_TOKEN` Actions secret on this repo (remove it after).
|
|
26
|
+
|
|
27
|
+
name: "Migrate web-storage repo secrets to Doppler (one-time)"
|
|
28
|
+
|
|
29
|
+
on:
|
|
30
|
+
workflow_dispatch:
|
|
31
|
+
|
|
32
|
+
jobs:
|
|
33
|
+
migrate:
|
|
34
|
+
runs-on: ubuntu-latest
|
|
35
|
+
env:
|
|
36
|
+
DOPPLER_PROJECT: api
|
|
37
|
+
DOPPLER_CONFIG: ci_github_actions
|
|
38
|
+
DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }}
|
|
39
|
+
ADA_STATIC_CDN_PROD_ACCESS_KEY_ID: ${{ secrets.ADA_STATIC_CDN_PROD_ACCESS_KEY_ID }}
|
|
40
|
+
ADA_STATIC_CDN_PROD_SECRET_ACCESS_KEY: ${{ secrets.ADA_STATIC_CDN_PROD_SECRET_ACCESS_KEY }}
|
|
41
|
+
CLOUDFRONT_DISTRIBUTION_ID: ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }}
|
|
42
|
+
CLOUDFRONT_INVALIDATION_ACCESS_KEY_ID: ${{ secrets.CLOUDFRONT_INVALIDATION_ACCESS_KEY_ID }}
|
|
43
|
+
CLOUDFRONT_INVALIDATION_SECRET_KEY: ${{ secrets.CLOUDFRONT_INVALIDATION_SECRET_KEY }}
|
|
44
|
+
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
|
|
45
|
+
steps:
|
|
46
|
+
- name: Install Doppler CLI
|
|
47
|
+
uses: dopplerhq/cli-action@v3
|
|
48
|
+
|
|
49
|
+
- name: Guard — refuse to run without the source secrets present
|
|
50
|
+
run: |
|
|
51
|
+
set -euo pipefail
|
|
52
|
+
if [ -z "${DOPPLER_TOKEN:-}" ]; then
|
|
53
|
+
echo "::error::DOPPLER_TOKEN is not set — add a Doppler token with write access to api/ci_github_actions."
|
|
54
|
+
exit 1
|
|
55
|
+
fi
|
|
56
|
+
missing=0
|
|
57
|
+
for name in \
|
|
58
|
+
ADA_STATIC_CDN_PROD_ACCESS_KEY_ID \
|
|
59
|
+
ADA_STATIC_CDN_PROD_SECRET_ACCESS_KEY \
|
|
60
|
+
CLOUDFRONT_DISTRIBUTION_ID \
|
|
61
|
+
CLOUDFRONT_INVALIDATION_ACCESS_KEY_ID \
|
|
62
|
+
CLOUDFRONT_INVALIDATION_SECRET_KEY \
|
|
63
|
+
SLACK_WEBHOOK_URL; do
|
|
64
|
+
if [ -z "${!name:-}" ]; then
|
|
65
|
+
echo "::error::$name is empty — are you running this in AdaSupport/web-storage?"
|
|
66
|
+
missing=1
|
|
67
|
+
fi
|
|
68
|
+
done
|
|
69
|
+
[ "$missing" -eq 0 ] || exit 1
|
|
70
|
+
|
|
71
|
+
- name: Push repo-level secrets to Doppler (api / ci_github_actions)
|
|
72
|
+
run: |
|
|
73
|
+
set -euo pipefail
|
|
74
|
+
for name in \
|
|
75
|
+
ADA_STATIC_CDN_PROD_ACCESS_KEY_ID \
|
|
76
|
+
ADA_STATIC_CDN_PROD_SECRET_ACCESS_KEY \
|
|
77
|
+
CLOUDFRONT_DISTRIBUTION_ID \
|
|
78
|
+
CLOUDFRONT_INVALIDATION_ACCESS_KEY_ID \
|
|
79
|
+
CLOUDFRONT_INVALIDATION_SECRET_KEY \
|
|
80
|
+
SLACK_WEBHOOK_URL; do
|
|
81
|
+
echo "Setting WEB_STORAGE_$name in $DOPPLER_PROJECT/$DOPPLER_CONFIG"
|
|
82
|
+
# Value piped via stdin so it never appears in argv/process list.
|
|
83
|
+
# Read from the unprefixed GitHub secret, write with the WEB_STORAGE_ prefix.
|
|
84
|
+
printf '%s' "${!name}" | doppler secrets set "WEB_STORAGE_$name" \
|
|
85
|
+
--project "$DOPPLER_PROJECT" --config "$DOPPLER_CONFIG" --silent
|
|
86
|
+
done
|
|
87
|
+
echo "Done. Verify in the Doppler dashboard, then delete this workflow and the DOPPLER_TOKEN secret."
|