From 467f2c3a355517b2991a1b76fb3d61962f8b5ae5 Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Tue, 25 Aug 2026 18:51:42 -0700 Subject: [PATCH 1/4] chore(gocd): use GitHub App credentials --- gocd/templates/pipelines/snuba-py.libsonnet | 3 ++- gocd/templates/pipelines/snuba-rs.libsonnet | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/gocd/templates/pipelines/snuba-py.libsonnet b/gocd/templates/pipelines/snuba-py.libsonnet index 43b8a3bf9e..2327d7aa0b 100644 --- a/gocd/templates/pipelines/snuba-py.libsonnet +++ b/gocd/templates/pipelines/snuba-py.libsonnet @@ -161,7 +161,8 @@ function(region) { environment_variables: { SENTRY_REGION: region, // Required for checkruns. - GITHUB_TOKEN: '{{SECRET:[devinfra-github][token]}}', + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', GOCD_ACCESS_TOKEN: '{{SECRET:[devinfra][gocd_access_token]}}', }, lock_behavior: 'unlockWhenFinished', diff --git a/gocd/templates/pipelines/snuba-rs.libsonnet b/gocd/templates/pipelines/snuba-rs.libsonnet index 61d7fcd3d7..aa3e61fc8c 100644 --- a/gocd/templates/pipelines/snuba-rs.libsonnet +++ b/gocd/templates/pipelines/snuba-rs.libsonnet @@ -137,7 +137,8 @@ function(region) { environment_variables: { SENTRY_REGION: region, // Required for checkruns. - GITHUB_TOKEN: '{{SECRET:[devinfra-github][token]}}', + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', GOCD_ACCESS_TOKEN: '{{SECRET:[devinfra][gocd_access_token]}}', }, lock_behavior: 'unlockWhenFinished', From 3b8265034f3005e39ddecd701f0e2a5fd3c65f6d Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Thu, 27 Aug 2026 10:38:52 -0700 Subject: [PATCH 2/4] use checkruns2 for GitHub App credentials --- gocd/templates/bash/check-github.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gocd/templates/bash/check-github.sh b/gocd/templates/bash/check-github.sh index 891b2584ac..b3cda1f45a 100644 --- a/gocd/templates/bash/check-github.sh +++ b/gocd/templates/bash/check-github.sh @@ -1,6 +1,6 @@ #!/bin/bash -checks-githubactions-checkruns \ +checks-githubactions-checkruns2 \ --timeout-mins 60 \ getsentry/snuba \ ${GO_REVISION_SNUBA_REPO} \ From fe0891fecc1abac1258b7483cf117f8347e94b8f Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Thu, 27 Aug 2026 10:40:57 -0700 Subject: [PATCH 3/4] clarify checkruns2 App credential usage --- gocd/templates/pipelines/snuba-py.libsonnet | 2 +- gocd/templates/pipelines/snuba-rs.libsonnet | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/gocd/templates/pipelines/snuba-py.libsonnet b/gocd/templates/pipelines/snuba-py.libsonnet index 2327d7aa0b..7837aee955 100644 --- a/gocd/templates/pipelines/snuba-py.libsonnet +++ b/gocd/templates/pipelines/snuba-py.libsonnet @@ -160,7 +160,7 @@ local deploy_canary_stage(region) = function(region) { environment_variables: { SENTRY_REGION: region, - // Required for checkruns. + // Required for checkruns2. GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', GOCD_ACCESS_TOKEN: '{{SECRET:[devinfra][gocd_access_token]}}', diff --git a/gocd/templates/pipelines/snuba-rs.libsonnet b/gocd/templates/pipelines/snuba-rs.libsonnet index aa3e61fc8c..65462b1b29 100644 --- a/gocd/templates/pipelines/snuba-rs.libsonnet +++ b/gocd/templates/pipelines/snuba-rs.libsonnet @@ -136,7 +136,7 @@ local deploy_canary_stage(region) = function(region) { environment_variables: { SENTRY_REGION: region, - // Required for checkruns. + // Required for checkruns2. GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', GOCD_ACCESS_TOKEN: '{{SECRET:[devinfra][gocd_access_token]}}', From 097f435b8754ea35ddc7bf9446d34d29fc5961d4 Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Thu, 27 Aug 2026 10:52:31 -0700 Subject: [PATCH 4/4] fix CI toolchain versions --- .github/workflows/validate-pipelines.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/validate-pipelines.yml b/.github/workflows/validate-pipelines.yml index 22c46f0833..00688ec7df 100644 --- a/.github/workflows/validate-pipelines.yml +++ b/.github/workflows/validate-pipelines.yml @@ -50,6 +50,7 @@ jobs: id_token_include_email: true - uses: getsentry/action-gocd-jsonnet@2a32414fa9e58a46d1afea9cbfa7b77a928678e2 # v1.1.1 with: + go-version: "1.25" jb-install: true jsonnet-dir: gocd/templates generated-dir: gocd/generated-pipelines