Use GITHUB_TOKEN in GitHub Actions #46
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Historically we've used `NUGET_KEY` and `LBHPACKAGESTOKEN` for read and write access to our NuGet package repository on GitHub. These are Personal Access Tokens, and historically have not had an expiry date set. GitHub Actions provides a better way of accessing GitHub package registries (and other resources): `GITHUB_TOKEN`. This is generated and managed by GitHub actions, and provides appropriate access for an Action based on the repository it's in, for example it can write packages that the repository has write/maintain access to, but no others. This is also recommended by the docs: > If you're using a registry that supports granular permissions, and your workflow is using a personal access token to authenticate to the registry, then we highly recommend you update your workflow to use the GITHUB_TOKEN. > ~ from https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions#authenticating-to-package-registries-with-granular-permissions This change switches both `LBHPACKAGESTOKEN` and `NUGET_KEY` to `GITHUB_TOKEN` and removes unnecessary references to `LBHPACKAGESTOKEN` where the secret isn't being used. There should be no effect on GitHub Actions, but this change allows us to deprecate and remove `NUGET_KEY` and `LBHPACKAGESTOKEN`.
As per https://github.blog/changelog/2024-04-10-github-hosted-runner-images-deprecation-notice-docker-compose-v1/, I saw build failures in github action along the lines of: docker-compose: command not found
Docker's documentation [suggests](https://docs.docker.com/reference/dockerfile/#arg) not to use build arguments to pass secrets, so this change updates the `Dockerfile` to use [secret mounts](https://docs.docker.com/build/building/secrets/#secret-mounts), and the recommended way to [manage secrets in docker compose](https://docs.docker.com/compose/how-tos/use-secrets/).
spikeheap
requested review from
LBHMKeyworth,
LBHSPreston and
a team
as code owners
Duslerke
approved these changes
Oct 9, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This change removes two environment variables from CI which have been used to carry credentials to publish/read packages to our GitHub Packages NuGet registry:
LBHPACKAGESTOKENNUGET_KEYLBHPACKAGESTOKENcontinues to be used for local development.What is the problem we're trying to solve?
Historically we've published packages from our local machines, which requires a token to authenticate with the GitHub Packages NuGet Registry. Now we use CI to publish packages there is a GitHub-managed token we can use instead..
This change removes both
LBHPACKAGESTOKENandNUGET_KEYtokens from the GitHub Actions workflow, replacing them where needed with the managedGITHUB_TOKENtoken that's automatically made available to all jobs.In order to keep the local development/management experience the same, references to
LBHPACKAGESTOKENhave been kept as-is in the Docker and Docker Compose setup.Additional improvement to Docker/Docker Compose secrets
Docker's documentation suggests not to use build arguments to pass secrets, so this PR also updates the
Dockerfileto use secret mounts, and the recommended way to manage secrets in docker compose.How to review this change
This change mirrors a couple we've already reviewed:
Checklist
Follow up actions after merging PR