Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

release: always use service user for git ops #24546

Merged
merged 1 commit into from
Dec 2, 2024
Merged

release: always use service user for git ops #24546

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,8 @@ jobs:
exit 1
fi
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- name: Retrieve Vault-hosted Secrets
if: endsWith(github.repository, '-enterprise')
id: vault
Expand All @@ -65,8 +67,7 @@ jobs:
secrets: |-
kv/data/github/hashicorp/nomad-enterprise/gha ELEVATED_GITHUB_TOKEN ;
- name: Git config token
if: endsWith(github.repository, '-enterprise')
run: git config --global url.'https://${{ env.ELEVATED_GITHUB_TOKEN }}@github.com'.insteadOf 'https://github.com'
run: git config --global url.'https://${{ env.ELEVATED_GITHUB_TOKEN || secrets.ELEVATED_GITHUB_TOKEN }}@github.com'.insteadOf 'https://github.com'
- name: Git config user/name
run: |-
git config --global user.email "[email protected]"
Expand Down Expand Up @@ -215,5 +216,5 @@ jobs:
fi

permissions:
contents: write
contents: read
Comment on lines -218 to +219
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This wasn't mentioned in the PR description. I know we've had to set this field to write in our workflows explicitly previously but that it was unexpected. Why is it safe to change it back now?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this permissions section specifies what the actions-dispensed GITHUB_TOKEN is capable of doing, and we only want it to pull the repo (actions/checkout). for pushes we instead want to use the ELEVATED_GITHUB_TOKEN attached to our bot user.

based on the commit that set this (b23fe72), I suspect we thought it needed to be write because actions/checkout sets github-actions bot token in local git config, which then takes precedence over the global git config that we set using the elevated token.

so to counteract all that, we both set this to read and actions/checkout to persist-credentials: false, so that git config --global takes effect.

id-token: write
Loading