Skip to content

CI: redeploy ok-dspace on pushes to clarin-v7 #175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kosarko merged 4 commits into from
Jul 23, 2026
Merged

CI: redeploy ok-dspace on pushes to clarin-v7 #175

Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d336e85
CI: redeploy the ok-dspace test environment on pushes to the default …
kosarko Jul 22, 2026
9029e18
Address review: name what this job actually does
kosarko Jul 22, 2026
94eb17a
Address review: drop unneeded token permissions from the dispatch job
kosarko Jul 22, 2026
e11f62f
Address review: dispatch with gh instead of a third-party action
kosarko Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 34 additions & 8 deletions .github/workflows/docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,11 +62,37 @@ jobs:
REDEPLOY_SANDBOX_URL: ${{ secrets.REDEPLOY_SANDBOX_URL }}
REDEPLOY_DEMO_URL: ${{ secrets.REDEPLOY_DEMO_URL }}

# deploy:
# needs: dspace-angular
# uses: ufal/dspace-angular/.github/workflows/deploy.yml@clarin-v7
# if: ${{ github.event_name != 'pull_request' }}
# with:
# INSTANCE: '5'
# IMPORT: false
# secrets: inherit
###########################################################################
# Notify ufal/dspace-k8s of a new build, for the ok-dspace test environment
###########################################################################
# Replaces the old commented-out deploy stub, which targeted the dataquest
# docker-compose instances (dev-5/dev-8) we no longer have access to.
#
# Runs only for pushes to `clarin-v7` - currently the default branch, named
# explicitly here because that is exactly what the guard below matches - and
# only after the image this environment consumes has actually been pushed.
#
# This job records a new version; it does not deploy. It sends a
# repository_dispatch to ufal/dspace-k8s, which pins the tag to git, and a
# reconciler inside that cluster applies it. No deployment step and no cluster
# credential exists in this repository, or anywhere in GitHub.
deploy-ok-dspace:
if: github.repository == 'ufal/dspace-angular' && github.event_name == 'push' && github.ref_name == 'clarin-v7'
# dspace-angular-dist, NOT dspace-angular: the latter builds the '-dev'
# suffixed image, while the overlay runs the unsuffixed dist image.
needs: [dspace-angular-dist]
runs-on: ubuntu-latest
# This job authenticates with a PAT and never uses GITHUB_TOKEN, so it needs
# none of the workflow-level permissions. Dropping them limits what a
# compromised third-party action could reach from here.
permissions: {}
steps:
Comment thread
kosarko marked this conversation as resolved.
- name: Notify ufal/dspace-k8s
uses: peter-evans/repository-dispatch@v4

@kosarko kosarko Jul 23, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

don't use and action, hand roll it with curl (or gh cli if possible)

@kosarko kosarko Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done — gh it is, since ubuntu-latest ships both gh (2.96.0) and jq (1.7.1), so no download is needed either.

- name: Notify ufal/dspace-k8s
  env:
    GH_TOKEN: ${{ secrets.OK_DSPACE_DEPLOY_TOKEN }}
    SHA: ${{ github.sha }}
  run: |
    set -euo pipefail
    jq -n --arg sha "${SHA}" \
      '{event_type: "deploy-ok-dspace",
        client_payload: {component: "frontend", sha: $sha}}' \
      | gh api -X POST repos/ufal/dspace-k8s/dispatches --input -

The payload is built by jq from an --arg rather than interpolated into a JSON string literal, so the value is a JSON string by construction instead of by careful quoting. Verified the emitted payload carries the same fields and values the action was sending, so nothing changes on the receiving end in pin-ok-dspace.yml. (Same JSON, not the same bytes — jq pretty-prints where the action sent compact; the API parses either.) gh api exits non-zero on an HTTP error, so a rejected dispatch still fails the job.

The real gain is that the PAT is no longer in the environment of third-party code for the sake of one POST. I also fixed the permissions: {} comment, which justified itself by "limits what a compromised third-party action could reach" — there is no longer one. Least privilege still applies, just for the plain reason that this job authenticates with the PAT and never touches GITHUB_TOKEN.

actionlint with shellcheck is clean.

with:
# Fine-grained PAT, scoped to ufal/dspace-k8s only, Contents: write
# (what POST /repos/{owner}/{repo}/dispatches requires).
token: ${{ secrets.OK_DSPACE_DEPLOY_TOKEN }}
repository: ufal/dspace-k8s
event-type: deploy-ok-dspace
client-payload: '{"component":"frontend","sha":"${{ github.sha }}"}'
Loading