chore(ci): migrate to gha-setup-credentials v3 and latest FEDX gha-* actions - #52
Closed
matthewnitschke-wk wants to merge 1 commit into
Closed
matthewnitschke-wk wants to merge 1 commit into
matthewnitschke-wk wants to merge 1 commit into
Conversation
Bump FEDX gha-* actions to their latest releases and replace the monolithic gha-setup-credentials v2 action with the v3 opt-in sub-actions, adding id-token: write where it was missing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migrates this repository's GitHub Actions onto gha-setup-credentials v3, following the FEDX migration guide.
What changed
FEDX actions pinned to their latest releases —
gha-dart@v3.0.6,gha-ts@v1.0.3,gha-semver-audit@v3.0.3,gha-utils@v1.0.3,gha-scip@v1.0.1.Redundant credential steps removed. Any job that already runs
gha-dart/setup-dartorgha-ts/setup-nodegets its credentials from those actions, so the siblinggha-setup-credentials@v2.xstep was deleted. Leaving one in place fails withunix_listener: cannot bind to path /tmp/ssh_agent.sock: Address already in use.Remaining
gha-setup-credentials@v2.xsteps replaced with the v3 opt-in sub-actions that thesurrounding job appears to need —
gitalways, plusjavascript,docker,python, or an explicitkeys:list where the job shows a matching usage. The JavaScript package manager is taken from thecommands the job runs, falling back to the repository's lockfile. Any
if:condition on the originalstep is carried over to each replacement step. v2 configured everything automatically; v3 configures
nothing unless asked.
id-token: writeadded where it was missing — v3 no longer declares the OIDC permission itself,and without it jobs fail with
Unable to get ACTIONS_ID_TOKEN_REQUEST_URL.Please review carefully
Step 3 is inferred from what each job visibly does, so it can under- or over-provision. v3 is opt-in, and a job that silently relied on a v2 credential will now fail. Please confirm each affected job has what it needs:
Workiva/gha-setup-credentials/docker@v3.0.3— building, pulling, or pushing images.registry:defaults to
docker.workiva.net; also supportsdrydock.workiva.net,drydock-prod.workiva.net,dhi.io, andmcr.microsoft.com.Workiva/gha-setup-credentials/python@v3.0.3— runningpiporuv. -Workiva/gha-setup-credentials@v3.0.3withkeys:— reading any Vault-backed variable such asFEF_GH_TOKEN,SRC_ACCESS_TOKEN,BTR_JIRA_TOKEN, orLD_ACCESS_TOKEN. These are no longerexported automatically, and an unrecognized name fails the action outright.
Any v2-only inputs (
disable-ssh,js-package-manager,npmrc,docker-user,vault-url, ...) were dropped, since none of them exist in v3.Created by Sourcegraph agentic batch change.