Skip to content

Commit 5ca5ab7

Browse files
svcnemo-autobotsvcnemo-autobot
authored
ci: AUT-1408 replace cicd PAT with GitHub App tokens (#5415)
Signed-off-by: svcnemo-autobot <svcnemo-autobot@nvidia.com>
1 parent b5aa2ec commit 5ca5ab7

2 files changed

Lines changed: 91 additions & 16 deletions

File tree

‎.github/actions/test-template/action.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,8 @@ inputs:
4343
description: "Has Azure credentials"
4444
required: false
4545
default: "false"
46-
PAT:
47-
description: "GitHub Personal Access Token"
46+
github-token:
47+
description: "GitHub token"
4848
required: true
4949
container-image:
5050
description: "Container image to use for test"
@@ -159,7 +159,7 @@ runs:
159159
160160
docker exec -t nemo_container_${{ github.run_id }} bash -c '
161161
set -e
162-
export GH_TOKEN=${{ inputs.PAT }}
162+
export GH_TOKEN=${{ inputs.github-token }}
163163
164164
timeout $(( ${{ inputs.timeout }} * 60 ))s bash tests/${{ inputs.is_unit_test == 'true' && 'unit_tests' || format('functional_tests/launch_scripts/{0}', inputs.script_dir) }}/${{ inputs.script }}.sh || EXIT_CODE=$?
165165

‎.github/workflows/cicd-main.yml‎

Lines changed: 88 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -523,8 +523,6 @@ jobs:
523523
tags: |
524524
${{ matrix.registry }}/megatron-bridge:${{ steps.cache_keys.outputs.key }}
525525
${{ matrix.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
526-
secrets: |
527-
GH_TOKEN=${{ secrets.PAT }}
528526
529527
cicd-import-check:
530528
if: |
@@ -580,13 +578,20 @@ jobs:
580578
submodules: recursive
581579
ref: ${{ needs.configure.outputs.merge_sha }}
582580

581+
- name: Generate GitHub App token
582+
id: app-token
583+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
584+
with:
585+
app-id: ${{ vars.BOT_ID }}
586+
private-key: ${{ secrets.BOT_KEY }}
587+
583588
- name: main
584589
uses: ./.github/actions/test-template
585590
with:
586591
script: Launch_Unit_Tests_Core
587592
timeout: 18
588593
is_unit_test: "true"
589-
PAT: ${{ secrets.PAT }}
594+
github-token: ${{ steps.app-token.outputs.token }}
590595
container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
591596
test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
592597
runner: ${{ needs.pre-flight.outputs.runner_prefix }}
@@ -614,13 +619,20 @@ jobs:
614619
submodules: recursive
615620
ref: ${{ needs.configure.outputs.merge_sha }}
616621

622+
- name: Generate GitHub App token
623+
id: app-token
624+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
625+
with:
626+
app-id: ${{ vars.BOT_ID }}
627+
private-key: ${{ secrets.BOT_KEY }}
628+
617629
- name: main
618630
uses: ./.github/actions/test-template
619631
with:
620632
script: Launch_Unit_Tests_Diffusion
621633
timeout: 18
622634
is_unit_test: "true"
623-
PAT: ${{ secrets.PAT }}
635+
github-token: ${{ steps.app-token.outputs.token }}
624636
container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
625637
test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
626638
runner: ${{ needs.pre-flight.outputs.runner_prefix }}
@@ -716,13 +728,20 @@ jobs:
716728
submodules: recursive
717729
ref: ${{ needs.configure.outputs.merge_sha }}
718730

731+
- name: Generate GitHub App token
732+
id: app-token
733+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
734+
with:
735+
app-id: ${{ vars.BOT_ID }}
736+
private-key: ${{ secrets.BOT_KEY }}
737+
719738
- name: main
720739
uses: ./.github/actions/test-template
721740
with:
722741
script: ${{ matrix.script }}
723742
timeout: ${{ fromJSON(matrix.timeout || '30') }}
724743
is_unit_test: "false"
725-
PAT: ${{ secrets.PAT }}
744+
github-token: ${{ steps.app-token.outputs.token }}
726745
container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
727746
test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
728747
runner: ${{ matrix.runner }}
@@ -757,13 +776,20 @@ jobs:
757776
submodules: recursive
758777
ref: ${{ needs.configure.outputs.merge_sha }}
759778

779+
- name: Generate GitHub App token
780+
id: app-token
781+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
782+
with:
783+
app-id: ${{ vars.BOT_ID }}
784+
private-key: ${{ secrets.BOT_KEY }}
785+
760786
- name: main
761787
uses: ./.github/actions/test-template
762788
with:
763789
script: ${{ matrix.script }}
764790
timeout: ${{ fromJSON(matrix.timeout || '30') }}
765791
is_unit_test: "false"
766-
PAT: ${{ secrets.PAT }}
792+
github-token: ${{ steps.app-token.outputs.token }}
767793
container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
768794
test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
769795
runner: ${{ matrix.runner }}
@@ -798,13 +824,20 @@ jobs:
798824
submodules: recursive
799825
ref: ${{ needs.configure.outputs.merge_sha }}
800826

827+
- name: Generate GitHub App token
828+
id: app-token
829+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
830+
with:
831+
app-id: ${{ vars.BOT_ID }}
832+
private-key: ${{ secrets.BOT_KEY }}
833+
801834
- name: main
802835
uses: ./.github/actions/test-template
803836
with:
804837
script: ${{ matrix.script }}
805838
timeout: ${{ fromJSON(matrix.timeout || '30') }}
806839
is_unit_test: "false"
807-
PAT: ${{ secrets.PAT }}
840+
github-token: ${{ steps.app-token.outputs.token }}
808841
container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
809842
test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
810843
runner: ${{ matrix.runner }}
@@ -829,14 +862,21 @@ jobs:
829862
submodules: recursive
830863
ref: ${{ needs.configure.outputs.merge_sha }}
831864

865+
- name: Generate GitHub App token
866+
id: app-token
867+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
868+
with:
869+
app-id: ${{ vars.BOT_ID }}
870+
private-key: ${{ secrets.BOT_KEY }}
871+
832872
- name: main
833873
uses: ./.github/actions/test-template
834874
with:
835875
script_dir: h100/flaky
836876
script: ${{ matrix.script }}
837877
timeout: ${{ fromJSON(matrix.timeout || '30') }}
838878
is_unit_test: "false"
839-
PAT: ${{ secrets.PAT }}
879+
github-token: ${{ steps.app-token.outputs.token }}
840880
container-image: ${{ needs.pre-flight.outputs.registry }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
841881
test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
842882
runner: ${{ matrix.runner }}
@@ -935,6 +975,13 @@ jobs:
935975
submodules: recursive
936976
ref: ${{ needs.configure.outputs.merge_sha }}
937977

978+
- name: Generate GitHub App token
979+
id: app-token
980+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
981+
with:
982+
app-id: ${{ vars.BOT_ID }}
983+
private-key: ${{ secrets.BOT_KEY }}
984+
938985
- name: main
939986
uses: ./.github/actions/test-template
940987
with:
@@ -946,7 +993,7 @@ jobs:
946993
azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
947994
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
948995
azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
949-
PAT: ${{ secrets.PAT }}
996+
github-token: ${{ steps.app-token.outputs.token }}
950997
container-image: ${{ env.container-registry-gb200 }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
951998
test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
952999
runner: ${{ matrix.runner }}
@@ -984,6 +1031,13 @@ jobs:
9841031
submodules: recursive
9851032
ref: ${{ needs.configure.outputs.merge_sha }}
9861033

1034+
- name: Generate GitHub App token
1035+
id: app-token
1036+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
1037+
with:
1038+
app-id: ${{ vars.BOT_ID }}
1039+
private-key: ${{ secrets.BOT_KEY }}
1040+
9871041
- name: main
9881042
uses: ./.github/actions/test-template
9891043
with:
@@ -995,7 +1049,7 @@ jobs:
9951049
azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
9961050
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
9971051
azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
998-
PAT: ${{ secrets.PAT }}
1052+
github-token: ${{ steps.app-token.outputs.token }}
9991053
container-image: ${{ env.container-registry-gb200 }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
10001054
test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
10011055
runner: ${{ matrix.runner }}
@@ -1033,6 +1087,13 @@ jobs:
10331087
submodules: recursive
10341088
ref: ${{ needs.configure.outputs.merge_sha }}
10351089

1090+
- name: Generate GitHub App token
1091+
id: app-token
1092+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
1093+
with:
1094+
app-id: ${{ vars.BOT_ID }}
1095+
private-key: ${{ secrets.BOT_KEY }}
1096+
10361097
- name: main
10371098
uses: ./.github/actions/test-template
10381099
with:
@@ -1044,7 +1105,7 @@ jobs:
10441105
azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
10451106
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
10461107
azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
1047-
PAT: ${{ secrets.PAT }}
1108+
github-token: ${{ steps.app-token.outputs.token }}
10481109
container-image: ${{ env.container-registry-gb200 }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
10491110
test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
10501111
runner: ${{ matrix.runner }}
@@ -1070,6 +1131,13 @@ jobs:
10701131
submodules: recursive
10711132
ref: ${{ needs.configure.outputs.merge_sha }}
10721133

1134+
- name: Generate GitHub App token
1135+
id: app-token
1136+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
1137+
with:
1138+
app-id: ${{ vars.BOT_ID }}
1139+
private-key: ${{ secrets.BOT_KEY }}
1140+
10731141
- name: main
10741142
uses: ./.github/actions/test-template
10751143
with:
@@ -1081,7 +1149,7 @@ jobs:
10811149
azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
10821150
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
10831151
azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
1084-
PAT: ${{ secrets.PAT }}
1152+
github-token: ${{ steps.app-token.outputs.token }}
10851153
container-image: ${{ env.container-registry-gb200 }}/megatron-bridge:${{ needs.configure.outputs.merge_sha }}
10861154
test-data-path: ${{ needs.pre-flight.outputs.test_data_path }}
10871155
runner: ${{ matrix.runner }}
@@ -1176,10 +1244,17 @@ jobs:
11761244
|| needs.configure.outputs.perf_scripts_only == 'true'
11771245
)
11781246
steps:
1247+
- name: Generate GitHub App token
1248+
id: app-token
1249+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
1250+
with:
1251+
app-id: ${{ vars.BOT_ID }}
1252+
private-key: ${{ secrets.BOT_KEY }}
1253+
11791254
- name: Generate fake coverage report
11801255
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
11811256
with:
1182-
github-token: ${{ secrets.PAT }}
1257+
github-token: ${{ steps.app-token.outputs.token }}
11831258
script: |
11841259
await github.rest.repos.createCommitStatus({
11851260
owner: context.repo.owner,

0 commit comments

Comments
 (0)