Skip to content

Commit 8309044

Browse files
ncooke3ncooke3
authored
[Infra] Update release/prerelease workflows with new access tokens (#15069)
1 parent f1d7e52 commit 8309044

File tree

4 files changed

+56
-215
lines changed

4 files changed

+56
-215
lines changed

‎.github/workflows/prerelease.yml

Lines changed: 29 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'workflow_dispatch'
2626
runs-on: macos-15
2727
env:
28-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
28+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
2929
local_repo: specstesting
3030
podspec_repo_branch: main
3131
outputs:
@@ -47,14 +47,9 @@ jobs:
4747
scripts/release_testing_setup.sh prerelease_testing
4848
env:
4949
BOT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
50-
- name: Get token
51-
run: |
52-
scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
53-
prerelease-testing-token.txt "$bot_token_secret"
5450
- name: Clean spec repo
5551
run: |
56-
ossbotaccess=`cat prerelease-testing-token.txt`
57-
git clone --quiet https://${ossbotaccess}@github.com/Firebase/SpecsTesting.git "${local_repo}"
52+
git clone --quiet https://${botaccess}@github.com/Firebase/SpecsTesting.git "${local_repo}"
5853
cd "${local_repo}"
5954
# Remove all unhidden dirs, i.e. all podspec dir from the spec repo.
6055
rm -Rf -- */
@@ -91,7 +86,7 @@ jobs:
9186
if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'workflow_dispatch'
9287
runs-on: macos-15
9388
env:
94-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
89+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
9590
local_repo: specstesting
9691
local_sdk_repo_dir: /tmp/test/firebase-ios-sdk
9792
targeted_pod: FirebaseCore
@@ -101,13 +96,8 @@ jobs:
10196
with:
10297
name: firebase-ios-sdk
10398
path: ${{ env.local_sdk_repo_dir }}
104-
- name: Get token
105-
run: |
106-
scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
107-
bot-access.txt "$bot_token_secret"
10899
- name: Update SpecsTesting repo
109100
run: |
110-
botaccess=`cat bot-access.txt`
111101
cd scripts/create_spec_repo/
112102
swift build
113103
pod repo add --silent "${local_repo}" https://"$botaccess"@github.com/Firebase/SpecsTesting.git
@@ -120,9 +110,7 @@ jobs:
120110
--include-pods "${targeted_pod}" --keep-repo
121111
- name: Clean Artifacts
122112
if: ${{ always() }}
123-
run: |
124-
pod repo remove "${local_repo}"
125-
rm -rf bot-access.txt
113+
run: pod repo remove "${local_repo}"
126114

127115
buildup_SpecsTesting_repo:
128116
needs: [buildup_SpecsTesting_repo_FirebaseCore, specs_checking]
@@ -133,7 +121,7 @@ jobs:
133121
fail-fast: false
134122
matrix: ${{fromJson(needs.specs_checking.outputs.matrix)}}
135123
env:
136-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
124+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
137125
local_repo: specstesting
138126
local_sdk_repo_dir: /tmp/test/firebase-ios-sdk
139127
targeted_pod: ${{ matrix.podspec }}
@@ -143,14 +131,9 @@ jobs:
143131
with:
144132
name: firebase-ios-sdk
145133
path: ${{ env.local_sdk_repo_dir }}
146-
- name: Get token
147-
run: |
148-
scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
149-
bot-access.txt "$bot_token_secret"
150134
- name: Update SpecsTesting repo
151135
run: |
152136
[[ ${{ matrix.allowwarnings }} == true ]] && ALLOWWARNINGS=true
153-
botaccess=`cat bot-access.txt`
154137
cd scripts/create_spec_repo/
155138
swift build
156139
pod repo add --silent "${local_repo}" https://"$botaccess"@github.com/Firebase/SpecsTesting.git
@@ -166,26 +149,20 @@ jobs:
166149
--keep-repo ${ALLOWWARNINGS:+--allow-warnings}
167150
- name: Clean Artifacts
168151
if: ${{ always() }}
169-
run: |
170-
pod repo remove "${local_repo}"
171-
rm -rf bot-access.txt
152+
run: pod repo remove "${local_repo}"
172153

173154
update_SpecsTesting_repo:
174155
# Don't run on private repo unless it is a PR.
175156
if: github.repository == 'Firebase/firebase-ios-sdk' && github.event.pull_request.merged == true
176157
runs-on: macos-15
177158
env:
178-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
159+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
179160
local_repo: specstesting
180161
podspec_repo_branch: main
181162
steps:
182163
- uses: actions/checkout@v4
183164
with:
184165
fetch-depth: 0
185-
- name: Get token
186-
run: |
187-
scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
188-
bot-access.txt "$bot_token_secret"
189166
- name: Update SpecsTesting repo setup
190167
run: |
191168
# Update/create a nightly tag to the head of the main branch.
@@ -195,7 +172,6 @@ jobs:
195172
BOT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
196173
- name: Push updated podspecs
197174
run: |
198-
botaccess=`cat bot-access.txt`
199175
# Changes in post submit tests will be fetched by getting diff between
200176
# the HEAD and HEAD^ of the main branch.
201177
common_commit=$(git rev-parse HEAD^)
@@ -226,20 +202,15 @@ jobs:
226202
env:
227203
plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
228204
signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
229-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
205+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
230206
runs-on: macos-15
231207
steps:
232208
- uses: actions/checkout@v4
233209
- uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
234-
- name: Get token
235-
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
236-
bot-access.txt "$bot_token_secret"
237210
- name: Setup testing repo and quickstart
238211
env:
239212
LEGACY: true
240-
run: |
241-
botaccess=`cat bot-access.txt`
242-
BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh abtesting prerelease_testing
213+
run: BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh abtesting prerelease_testing
243214
- name: Install Secret GoogleService-Info.plist
244215
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-abtesting.plist.gpg \
245216
quickstart-ios/abtesting/GoogleService-Info.plist "$plist_secret"
@@ -265,20 +236,15 @@ jobs:
265236
env:
266237
plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
267238
signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
268-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
239+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
269240
runs-on: macos-15
270241
steps:
271242
- uses: actions/checkout@v4
272243
- uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
273-
- name: Get token
274-
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
275-
bot-access.txt "$bot_token_secret"
276244
- name: Xcode
277245
run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
278246
- name: Setup testing repo and quickstart
279-
run: |
280-
botaccess=`cat bot-access.txt`
281-
BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh Authentication prerelease_testing
247+
run: BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh Authentication prerelease_testing
282248
- name: Install Secret GoogleService-Info.plist
283249
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-auth.plist.gpg \
284250
quickstart-ios/authentication/GoogleService-Info.plist "$plist_secret"
@@ -300,22 +266,17 @@ jobs:
300266
env:
301267
plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
302268
signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
303-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
269+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
304270
testing_repo_dir: "/tmp/test/"
305271
testing_repo: "firebase-ios-sdk"
306272
runs-on: macos-15
307273
steps:
308274
- uses: actions/checkout@v4
309275
- uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
310-
- name: Get token
311-
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
312-
bot-access.txt "$bot_token_secret"
313276
- name: Setup testing repo and quickstart
314277
env:
315278
LEGACY: true
316-
run: |
317-
botaccess=`cat bot-access.txt`
318-
BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh Crashlytics prerelease_testing
279+
run: BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh Crashlytics prerelease_testing
319280
- name: Install Secret GoogleService-Info.plist
320281
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-crashlytics.plist.gpg \
321282
quickstart-ios/crashlytics/GoogleService-Info.plist "$plist_secret"
@@ -346,20 +307,15 @@ jobs:
346307
env:
347308
plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
348309
signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
349-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
310+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
350311
testing_repo_dir: "/tmp/test/"
351312
testing_repo: "firebase-ios-sdk"
352313
runs-on: macos-15
353314
steps:
354315
- uses: actions/checkout@v4
355316
- uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
356-
- name: Get token
357-
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
358-
bot-access.txt "$bot_token_secret"
359317
- name: Setup testing repo and quickstart
360-
run: |
361-
botaccess=`cat bot-access.txt`
362-
BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh database prerelease_testing
318+
run: BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh database prerelease_testing
363319
- name: Install Secret GoogleService-Info.plist
364320
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-database.plist.gpg \
365321
quickstart-ios/database/GoogleService-Info.plist "$plist_secret"
@@ -383,20 +339,15 @@ jobs:
383339
env:
384340
plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
385341
signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
386-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
342+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
387343
testing_repo_dir: "/tmp/test/"
388344
testing_repo: "firebase-ios-sdk"
389345
runs-on: macos-15
390346
steps:
391347
- uses: actions/checkout@v4
392348
- uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
393-
- name: Get token
394-
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
395-
bot-access.txt "$bot_token_secret"
396349
- name: Setup testing repo and quickstart
397-
run: |
398-
botaccess=`cat bot-access.txt`
399-
BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh firestore prerelease_testing
350+
run: BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh firestore prerelease_testing
400351
- name: Install Secret GoogleService-Info.plist
401352
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-firestore.plist.gpg \
402353
quickstart-ios/firestore/GoogleService-Info.plist "$plist_secret"
@@ -420,7 +371,7 @@ jobs:
420371
# env:
421372
# plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
422373
# signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
423-
# bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
374+
# botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
424375
# testing_repo_dir: "/tmp/test/"
425376
# testing_repo: "firebase-ios-sdk"
426377
# LEGACY: true
@@ -429,13 +380,8 @@ jobs:
429380
# steps:
430381
# - uses: actions/checkout@v4
431382
# - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
432-
# - name: Get token
433-
# run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
434-
# bot-access.txt "$bot_token_secret"
435383
# - name: Setup testing repo and quickstart
436-
# run: |
437-
# botaccess=`cat bot-access.txt`
438-
# BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh functions prerelease_testing
384+
# run: BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh functions prerelease_testing
439385
# - name: install secret googleservice-info.plist
440386
# run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-functions.plist.gpg \
441387
# quickstart-ios/functions/GoogleService-Info.plist "$plist_secret"
@@ -463,20 +409,15 @@ jobs:
463409
env:
464410
plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
465411
signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
466-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
412+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
467413
testing_repo_dir: "/tmp/test/"
468414
testing_repo: "firebase-ios-sdk"
469415
runs-on: macos-15
470416
steps:
471417
- uses: actions/checkout@v4
472418
- uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
473-
- name: Get token
474-
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
475-
bot-access.txt "$bot_token_secret"
476419
- name: Setup testing repo and quickstart
477-
run: |
478-
botaccess=`cat bot-access.txt`
479-
BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh inappmessaging prerelease_testing
420+
run: BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh inappmessaging prerelease_testing
480421
- name: install secret googleservice-info.plist
481422
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-inappmessaging.plist.gpg \
482423
quickstart-ios/inappmessaging/GoogleService-Info.plist "$plist_secret"
@@ -502,20 +443,15 @@ jobs:
502443
env:
503444
plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
504445
signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
505-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
446+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
506447
testing_repo_dir: "/tmp/test/"
507448
testing_repo: "firebase-ios-sdk"
508449
runs-on: macos-15
509450
steps:
510451
- uses: actions/checkout@v4
511452
- uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
512-
- name: Get token
513-
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
514-
bot-access.txt "$bot_token_secret"
515453
- name: Setup testing repo and quickstart
516-
run: |
517-
botaccess=`cat bot-access.txt`
518-
BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh messaging prerelease_testing
454+
run: BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh messaging prerelease_testing
519455
- name: Install Secret GoogleService-Info.plist
520456
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-messaging.plist.gpg \
521457
quickstart-ios/messaging/GoogleService-Info.plist "$plist_secret"
@@ -541,18 +477,13 @@ jobs:
541477
env:
542478
plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
543479
signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
544-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
480+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
545481
runs-on: macos-15
546482
steps:
547483
- uses: actions/checkout@v4
548484
- uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
549-
- name: Get token
550-
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
551-
bot-access.txt "$bot_token_secret"
552485
- name: Setup testing repo and quickstart
553-
run: |
554-
botaccess=`cat bot-access.txt`
555-
BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh config prerelease_testing
486+
run: BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh config prerelease_testing
556487
- name: Install Secret GoogleService-Info.plist
557488
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-config.plist.gpg \
558489
quickstart-ios/config/GoogleService-Info.plist "$plist_secret"
@@ -574,21 +505,16 @@ jobs:
574505
env:
575506
plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
576507
signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
577-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
508+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
578509
testing_repo_dir: "/tmp/test/"
579510
testing_repo: "firebase-ios-sdk"
580511
LEGACY: true
581512
runs-on: macos-15
582513
steps:
583514
- uses: actions/checkout@v4
584515
- uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
585-
- name: Get token
586-
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
587-
bot-access.txt "$bot_token_secret"
588516
- name: Setup testing repo and quickstart
589-
run: |
590-
botaccess=`cat bot-access.txt`
591-
BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh storage prerelease_testing
517+
run: BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh storage prerelease_testing
592518
- name: Install Secret GoogleService-Info.plist
593519
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-storage.plist.gpg \
594520
quickstart-ios/storage/GoogleService-Info.plist "$plist_secret"
@@ -610,20 +536,15 @@ jobs:
610536
env:
611537
plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
612538
signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
613-
bot_token_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
539+
botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
614540
testing_repo_dir: "/tmp/test/"
615541
testing_repo: "firebase-ios-sdk"
616542
runs-on: macos-15
617543
steps:
618544
- uses: actions/checkout@v4
619545
- uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
620-
- name: Get token
621-
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/prerelease-testing-token.txt.gpg \
622-
bot-access.txt "$bot_token_secret"
623546
- name: Setup testing repo and quickstart
624-
run: |
625-
botaccess=`cat bot-access.txt`
626-
BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh Performance prerelease_testing
547+
run: BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh Performance prerelease_testing
627548
- name: Install Secret GoogleService-Info.plist
628549
run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-performance.plist.gpg \
629550
quickstart-ios/performance/GoogleService-Info.plist "$plist_secret"

0 commit comments

Comments
 (0)