From aee2c5a916db02f17b502994855d9604e22ab039 Mon Sep 17 00:00:00 2001 From: Burak Yigit Kaya Date: Thu, 1 Oct 2026 11:49:06 +0000 Subject: [PATCH] Copy CLI signing secrets to release environment Co-Authored-By: GPT-6 Sol --- .../workflows/migrate-toolkit-settings.yml | 59 +++++-------------- 1 file changed, 16 insertions(+), 43 deletions(-) diff --git a/.github/workflows/migrate-toolkit-settings.yml b/.github/workflows/migrate-toolkit-settings.yml index 2c55db73d..0685d6467 100644 --- a/.github/workflows/migrate-toolkit-settings.yml +++ b/.github/workflows/migrate-toolkit-settings.yml @@ -1,4 +1,4 @@ -name: Migrate toolkit settings +name: Migrate Toolkit CLI signing secrets on: workflow_dispatch: @@ -19,27 +19,19 @@ jobs: environment: production env: GH_TOKEN: ${{ secrets.SENTRY_MCP_MIGRATION_PAT }} - TARGET_REPOSITORY: getsentry/sentry-mcp + TARGET_REPOSITORY: getsentry/toolkit TARGET_REPOSITORY_ID: '957245447' - AI_GATEWAY_API_KEY: ${{ secrets.AI_GATEWAY_API_KEY }} - ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} - OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} - SENTRY_CLIENT_ID: ${{ vars.SENTRY_CLIENT_ID }} APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} APPLE_CERT_DATA: ${{ secrets.APPLE_CERT_DATA }} APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }} APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} steps: - - name: Validate migration inputs + - name: Validate target and signing inputs shell: bash run: | set -euo pipefail : "${GH_TOKEN:?SENTRY_MCP_MIGRATION_PAT is not configured}" - : "${AI_GATEWAY_API_KEY:?AI_GATEWAY_API_KEY is not configured}" - : "${ANTHROPIC_API_KEY:?ANTHROPIC_API_KEY is not configured}" - : "${OPENROUTER_API_KEY:?OPENROUTER_API_KEY is not configured}" - : "${SENTRY_CLIENT_ID:?SENTRY_CLIENT_ID is not configured}" : "${APPLE_API_KEY:?APPLE_API_KEY is not configured}" : "${APPLE_CERT_DATA:?APPLE_CERT_DATA is not configured}" : "${APPLE_CERT_PASSWORD:?APPLE_CERT_PASSWORD is not configured}" @@ -47,46 +39,27 @@ jobs: : "${SENTRY_AUTH_TOKEN:?SENTRY_AUTH_TOKEN is not configured}" test "$(gh api "repos/${TARGET_REPOSITORY}" --jq .id)" = "${TARGET_REPOSITORY_ID}" + test "$(gh api "repos/${TARGET_REPOSITORY}/environments/cli-release" --jq '.deployment_branch_policy | "\(.protected_branches):\(.custom_branch_policies)"')" = 'false:true' + test "$(gh api "repos/${TARGET_REPOSITORY}/environments/cli-release/deployment-branch-policies" --jq '[.branch_policies[] | "\(.type):\(.name)"] | join(",")')" = 'branch:release/cli/*' - - name: Create destination production environment - shell: bash - run: | - set -euo pipefail - jq -n '{deployment_branch_policy: { - protected_branches: true, - custom_branch_policies: false - }}' | gh api --method PUT "repos/${TARGET_REPOSITORY}/environments/production" --input - >/dev/null - - - name: Copy repository settings + - name: Copy CLI release signing secrets shell: bash run: | set -euo pipefail set +x - printf '%s' "${AI_GATEWAY_API_KEY}" | gh secret set AI_GATEWAY_API_KEY --repo "${TARGET_REPOSITORY}" --app actions - printf '%s' "${ANTHROPIC_API_KEY}" | gh secret set ANTHROPIC_API_KEY --repo "${TARGET_REPOSITORY}" --app actions - printf '%s' "${OPENROUTER_API_KEY}" | gh secret set OPENROUTER_API_KEY --repo "${TARGET_REPOSITORY}" --app actions - printf '%s' "${SENTRY_CLIENT_ID}" | gh variable set SENTRY_CLIENT_ID --repo "${TARGET_REPOSITORY}" + printf '%s' "${APPLE_API_KEY}" | gh secret set APPLE_API_KEY --repo "${TARGET_REPOSITORY}" --env cli-release --app actions + printf '%s' "${APPLE_CERT_DATA}" | gh secret set APPLE_CERT_DATA --repo "${TARGET_REPOSITORY}" --env cli-release --app actions + printf '%s' "${APPLE_CERT_PASSWORD}" | gh secret set APPLE_CERT_PASSWORD --repo "${TARGET_REPOSITORY}" --env cli-release --app actions + printf '%s' "${APPLE_TEAM_ID}" | gh secret set APPLE_TEAM_ID --repo "${TARGET_REPOSITORY}" --env cli-release --app actions + printf '%s' "${SENTRY_AUTH_TOKEN}" | gh secret set SENTRY_AUTH_TOKEN --repo "${TARGET_REPOSITORY}" --env cli-release --app actions - - name: Copy production environment secrets + - name: Verify CLI release signing secret names shell: bash run: | set -euo pipefail - set +x - printf '%s' "${APPLE_API_KEY}" | gh secret set APPLE_API_KEY --repo "${TARGET_REPOSITORY}" --env production --app actions - printf '%s' "${APPLE_CERT_DATA}" | gh secret set APPLE_CERT_DATA --repo "${TARGET_REPOSITORY}" --env production --app actions - printf '%s' "${APPLE_CERT_PASSWORD}" | gh secret set APPLE_CERT_PASSWORD --repo "${TARGET_REPOSITORY}" --env production --app actions - printf '%s' "${APPLE_TEAM_ID}" | gh secret set APPLE_TEAM_ID --repo "${TARGET_REPOSITORY}" --env production --app actions - printf '%s' "${SENTRY_AUTH_TOKEN}" | gh secret set SENTRY_AUTH_TOKEN --repo "${TARGET_REPOSITORY}" --env production --app actions - - - name: Verify destination setting names - shell: bash - run: | - set -euo pipefail - test "$(gh api "repos/${TARGET_REPOSITORY}/environments/production" --jq '.deployment_branch_policy | "\(.protected_branches):\(.custom_branch_policies)"')" = 'true:false' - diff -u \ - <(printf '%s\n' AI_GATEWAY_API_KEY ANTHROPIC_API_KEY OPENROUTER_API_KEY | sort) \ - <(gh secret list --repo "${TARGET_REPOSITORY}" --json name --jq '.[].name' | grep -E '^(AI_GATEWAY_API_KEY|ANTHROPIC_API_KEY|OPENROUTER_API_KEY)$' | sort) - test "$(gh variable get SENTRY_CLIENT_ID --repo "${TARGET_REPOSITORY}" --json name --jq .name)" = SENTRY_CLIENT_ID + test "$(gh api "repos/${TARGET_REPOSITORY}" --jq .id)" = "${TARGET_REPOSITORY_ID}" + test "$(gh api "repos/${TARGET_REPOSITORY}/environments/cli-release" --jq '.deployment_branch_policy | "\(.protected_branches):\(.custom_branch_policies)"')" = 'false:true' + test "$(gh api "repos/${TARGET_REPOSITORY}/environments/cli-release/deployment-branch-policies" --jq '[.branch_policies[] | "\(.type):\(.name)"] | join(",")')" = 'branch:release/cli/*' diff -u \ <(printf '%s\n' APPLE_API_KEY APPLE_CERT_DATA APPLE_CERT_PASSWORD APPLE_TEAM_ID SENTRY_AUTH_TOKEN | sort) \ - <(gh secret list --repo "${TARGET_REPOSITORY}" --env production --json name --jq '.[].name' | grep -E '^(APPLE_API_KEY|APPLE_CERT_DATA|APPLE_CERT_PASSWORD|APPLE_TEAM_ID|SENTRY_AUTH_TOKEN)$' | sort) + <(gh secret list --repo "${TARGET_REPOSITORY}" --env cli-release --json name --jq '.[].name' | grep -E '^(APPLE_API_KEY|APPLE_CERT_DATA|APPLE_CERT_PASSWORD|APPLE_TEAM_ID|SENTRY_AUTH_TOKEN)$' | sort)