[gha] Add optional git permissions

.github/actions/gar-auth/action.yaml

@@ -5,6 +5,9 @@ inputs:
     required: true
   GCP_SERVICE_ACCOUNT_EMAIL:
     required: true
+  GIT_CREDENTIALS:
+    description: "Optional credentials to pass to git"
+    required: false
 
 runs:
   using: composite
@@ -24,3 +27,10 @@ runs:
         registry: us-west1-docker.pkg.dev
         username: oauth2accesstoken
         password: ${{ steps.auth.outputs.access_token }}
+
+    - name: Setup git credentials
+      if: inputs.GIT_CREDENTIALS != ''
+      shell: bash
+      run: |
+        git config --global credential.helper store
+        echo "${{ inputs.GIT_CREDENTIALS }}" > ~/.git-credentials

.github/actions/rust-setup/action.yaml

@@ -1,3 +1,8 @@
+inputs:
+  GIT_CREDENTIALS:
+    description: "Optional credentials to pass to git"
+    required: false
+
 runs:
   using: composite
   steps:
@@ -15,3 +20,9 @@ runs:
       run: scripts/dev_setup.sh -b -r
     - run: echo "/home/runner/.cargo/bin" | tee -a $GITHUB_PATH
       shell: bash
+    - name: Setup git credentials
+      if: inputs.GIT_CREDENTIALS != ''
+      shell: bash
+      run: |
+        git config --global credential.helper store
+        echo "${{ inputs.GIT_CREDENTIALS }}" > ~/.git-credentials

.github/workflows/copy-images-to-dockerhub.yaml

@@ -28,6 +28,7 @@ jobs:
         with:
           GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
           GCP_SERVICE_ACCOUNT_EMAIL: ${{ secrets.GCP_SERVICE_ACCOUNT_EMAIL }}
+          GIT_CREDENTIALS: ${{ secrets.GIT_CREDENTIALS }}
 
       - name: Login to ECR
         uses: docker/login-action@49ed152c8eca782a232dede0303416e8f356c37b # pin@v2

.github/workflows/docker-rust-build.yaml

@@ -47,6 +47,7 @@ jobs:
         with:
           GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
           GCP_SERVICE_ACCOUNT_EMAIL: ${{ secrets.GCP_SERVICE_ACCOUNT_EMAIL }}
+          GIT_CREDENTIALS: ${{ secrets.GIT_CREDENTIALS }}
 
       - name: Login to ECR
         uses: docker/login-action@49ed152c8eca782a232dede0303416e8f356c37b # pin@v2
@@ -65,3 +66,4 @@ jobs:
           PROFILE: ${{ env.PROFILE }}
           FEATURES: ${{ env.FEATURES }}
           BUILD_ADDL_TESTING_IMAGES: ${{ env.BUILD_ADDL_TESTING_IMAGES }}
+          GIT_CREDENTIALS: ${{ secrets.GIT_CREDENTIALS }}

.github/workflows/lint-test.yaml

@@ -92,6 +92,8 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - uses: ./.github/actions/rust-setup
+        with:
+          GIT_CREDENTIALS: ${{ secrets.GIT_CREDENTIALS }}
       - uses: pre-commit/[email protected]
       - run: cargo install cargo-sort
       - run: scripts/rust_lint.sh --check
@@ -103,6 +105,8 @@ jobs:
         with:
           fetch-depth: 0 # get all the history because cargo xtest --change-since origin/main requires it.
       - uses: ./.github/actions/rust-setup
+        with:
+          GIT_CREDENTIALS: ${{ secrets.GIT_CREDENTIALS }}
       - run: cargo test --locked --doc --workspace --exclude aptos-node-checker
 
   rust-unit-test:
@@ -112,6 +116,8 @@ jobs:
         with:
           fetch-depth: 0 # get all the history because cargo xtest --change-since origin/main requires it.
       - uses: ./.github/actions/rust-setup
+        with:
+          GIT_CREDENTIALS: ${{ secrets.GIT_CREDENTIALS }}
       - run: docker run --detach -p 5432:5432 cimg/postgres:14.2
       - uses: taiki-e/[email protected]
         with:
@@ -125,6 +131,8 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - uses: ./.github/actions/rust-setup
+        with:
+          GIT_CREDENTIALS: ${{ secrets.GIT_CREDENTIALS }}
       - run: docker run --detach -p 5432:5432 cimg/postgres:14.2
       - uses: taiki-e/[email protected]
         with:
@@ -152,6 +160,8 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - uses: ./.github/actions/rust-setup
+        with:
+          GIT_CREDENTIALS: ${{ secrets.GIT_CREDENTIALS }}
       - run: cargo test --locked --features check-vm-features -p aptos-node
 
   python-lint-test:

.github/workflows/sdk-release.yaml

@@ -47,6 +47,7 @@ jobs:
         with:
           GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
           GCP_SERVICE_ACCOUNT_EMAIL: ${{ secrets.GCP_SERVICE_ACCOUNT_EMAIL }}
+          GIT_CREDENTIALS: ${{ secrets.GIT_CREDENTIALS }}
 
       - uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # pin@v3
         with:

docker/docker-bake-rust-all.hcl

@@ -18,6 +18,8 @@ variable "GIT_SHA" {}
 
 variable "GIT_BRANCH" {}
 
+variable "GIT_CREDENTIALS" {}
+
 variable "GIT_TAG" {}
 
 variable "BUILT_VIA_BUILDKIT" {}
@@ -89,6 +91,7 @@ target "_common" {
     GIT_SHA            = "${GIT_SHA}"
     GIT_BRANCH         = "${GIT_BRANCH}"
     GIT_TAG            = "${GIT_TAG}"
+    GIT_CREDENTIALS    = "${GIT_CREDENTIALS}"
     BUILD_DATE         = "${BUILD_DATE}"
     BUILT_VIA_BUILDKIT = "true"
   }

docker/docker-bake-rust-all.sh

@@ -14,13 +14,15 @@ set -ex
 export GIT_SHA=$(git rev-parse HEAD)
 export GIT_BRANCH=$(git symbolic-ref --short HEAD)
 export GIT_TAG=$(git tag -l --contains HEAD)
+export GIT_CREDENTIALS="${GIT_CREDENTIALS:-}"
 export BUILD_DATE="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
 export BUILT_VIA_BUILDKIT="true"
 export NORMALIZED_GIT_BRANCH_OR_PR=$(printf "$TARGET_CACHE_ID" | sed -e 's/[^a-zA-Z0-9]/-/g')
 
 export PROFILE=${PROFILE:-release}
 export FEATURES=${FEATURES:-""}
 export NORMALIZED_FEATURES_LIST=$(printf "$FEATURES" | sed -e 's/[^a-zA-Z0-9]/_/g')
+
 if [ "$PROFILE" = "release" ]; then
   # Do not prefix image tags if we're building the default profile "release"
   profile_prefix=""

docker/rust-all.Dockerfile

@@ -37,8 +37,12 @@ ARG PROFILE
 ENV PROFILE ${PROFILE}
 ARG FEATURES
 ENV FEATURES ${FEATURES}
+ARG GIT_CREDENTIALS
+ENV GIT_CREDENTIALS ${GIT_CREDENTIALS}
 
+RUN GIT_CREDENTIALS="$GIT_CREDENTIALS" git config --global credential.helper store && echo "${GIT_CREDENTIALS}" > ~/.git-credentials
 RUN PROFILE=$PROFILE FEATURES=$FEATURES docker/build-rust-all.sh && rm -rf $CARGO_HOME && rm -rf target
+RUN rm -rf ~/.git-credentials
 
 ### Validator Image ###
 FROM debian-base AS validator