Skip to content
This repository was archived by the owner on Mar 21, 2026. It is now read-only.

misc(gha): expose action cache url and runtime as secrets - #2964

Merged
glegendre01 merged 11 commits into
mainfrom
gha_sccache_use_secrets
Nov 17, 2025
Merged

glegendre01 merged 11 commits into
mainfrom
gha_sccache_use_secrets

Conversation

@mfuntowicz

Copy link
Copy Markdown
Member

Avoid leaking token and cache url

@mfuntowicz
mfuntowicz requested a review from Narsil January 29, 2025 09:30
id: aws-creds
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502
with:
role-to-assume: ${{ secrets.AWS_ROLE_GITHUB_BUILDX_CACHE }}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WE still had issues with those for release, isn't that why we remvoed it altogether ?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i increased the session time, but the run tests is failing now.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not about session time, it's also that the role couldn't be assumed on anything else than PRs.
Where we need to run the CI for building and pushing also on tags/main and basically any kind of branch.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So adding this crippled the release process.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we can allow all branches if you need ?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's currently filtering on theses : refs/heads/main + refs/tags/v*

@mfuntowicz

Copy link
Copy Markdown
Member Author

Maybe we should split the two scopes that we are addressing here:

  • Focus this PR on making GHA argument secrets and not ENV
  • Open a second PR to address the flakyness of AWS S3 stuff

wdyt @Narsil, @glegendre01 ?

@Ryans-ui Ryans-ui left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1

Removed an unused mount for actions_cache_url in the Dockerfile.

@drbh drbh left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@glegendre01
glegendre01 merged commit 85790a1 into main Nov 17, 2025
26 of 31 checks passed
@glegendre01
glegendre01 deleted the gha_sccache_use_secrets branch November 17, 2025 09:50
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants