Skip to content

Copy CLI signing secrets to release environment #1652

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BYK merged 1 commit into from
Oct 1, 2026
Merged

Copy CLI signing secrets to release environment #1652

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 16 additions & 43 deletions .github/workflows/migrate-toolkit-settings.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
name: Migrate toolkit settings
name: Migrate Toolkit CLI signing secrets

on:
workflow_dispatch:
Expand All @@ -19,74 +19,47 @@ jobs:
environment: production
env:
GH_TOKEN: ${{ secrets.SENTRY_MCP_MIGRATION_PAT }}
TARGET_REPOSITORY: getsentry/sentry-mcp
TARGET_REPOSITORY: getsentry/toolkit
TARGET_REPOSITORY_ID: '957245447'
AI_GATEWAY_API_KEY: ${{ secrets.AI_GATEWAY_API_KEY }}
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
SENTRY_CLIENT_ID: ${{ vars.SENTRY_CLIENT_ID }}
APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
APPLE_CERT_DATA: ${{ secrets.APPLE_CERT_DATA }}
APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
steps:
- name: Validate migration inputs
- name: Validate target and signing inputs
shell: bash
run: |
set -euo pipefail
: "${GH_TOKEN:?SENTRY_MCP_MIGRATION_PAT is not configured}"
: "${AI_GATEWAY_API_KEY:?AI_GATEWAY_API_KEY is not configured}"
: "${ANTHROPIC_API_KEY:?ANTHROPIC_API_KEY is not configured}"
: "${OPENROUTER_API_KEY:?OPENROUTER_API_KEY is not configured}"
: "${SENTRY_CLIENT_ID:?SENTRY_CLIENT_ID is not configured}"
: "${APPLE_API_KEY:?APPLE_API_KEY is not configured}"
: "${APPLE_CERT_DATA:?APPLE_CERT_DATA is not configured}"
: "${APPLE_CERT_PASSWORD:?APPLE_CERT_PASSWORD is not configured}"
: "${APPLE_TEAM_ID:?APPLE_TEAM_ID is not configured}"
: "${SENTRY_AUTH_TOKEN:?SENTRY_AUTH_TOKEN is not configured}"

test "$(gh api "repos/${TARGET_REPOSITORY}" --jq .id)" = "${TARGET_REPOSITORY_ID}"
test "$(gh api "repos/${TARGET_REPOSITORY}/environments/cli-release" --jq '.deployment_branch_policy | "\(.protected_branches):\(.custom_branch_policies)"')" = 'false:true'
test "$(gh api "repos/${TARGET_REPOSITORY}/environments/cli-release/deployment-branch-policies" --jq '[.branch_policies[] | "\(.type):\(.name)"] | join(",")')" = 'branch:release/cli/*'

- name: Create destination production environment
shell: bash
run: |
set -euo pipefail
jq -n '{deployment_branch_policy: {
protected_branches: true,
custom_branch_policies: false
}}' | gh api --method PUT "repos/${TARGET_REPOSITORY}/environments/production" --input - >/dev/null

- name: Copy repository settings
- name: Copy CLI release signing secrets
shell: bash
run: |
set -euo pipefail
set +x
printf '%s' "${AI_GATEWAY_API_KEY}" | gh secret set AI_GATEWAY_API_KEY --repo "${TARGET_REPOSITORY}" --app actions
printf '%s' "${ANTHROPIC_API_KEY}" | gh secret set ANTHROPIC_API_KEY --repo "${TARGET_REPOSITORY}" --app actions
printf '%s' "${OPENROUTER_API_KEY}" | gh secret set OPENROUTER_API_KEY --repo "${TARGET_REPOSITORY}" --app actions
printf '%s' "${SENTRY_CLIENT_ID}" | gh variable set SENTRY_CLIENT_ID --repo "${TARGET_REPOSITORY}"
printf '%s' "${APPLE_API_KEY}" | gh secret set APPLE_API_KEY --repo "${TARGET_REPOSITORY}" --env cli-release --app actions
printf '%s' "${APPLE_CERT_DATA}" | gh secret set APPLE_CERT_DATA --repo "${TARGET_REPOSITORY}" --env cli-release --app actions
printf '%s' "${APPLE_CERT_PASSWORD}" | gh secret set APPLE_CERT_PASSWORD --repo "${TARGET_REPOSITORY}" --env cli-release --app actions
printf '%s' "${APPLE_TEAM_ID}" | gh secret set APPLE_TEAM_ID --repo "${TARGET_REPOSITORY}" --env cli-release --app actions
printf '%s' "${SENTRY_AUTH_TOKEN}" | gh secret set SENTRY_AUTH_TOKEN --repo "${TARGET_REPOSITORY}" --env cli-release --app actions

- name: Copy production environment secrets
- name: Verify CLI release signing secret names
shell: bash
run: |
set -euo pipefail
set +x
printf '%s' "${APPLE_API_KEY}" | gh secret set APPLE_API_KEY --repo "${TARGET_REPOSITORY}" --env production --app actions
printf '%s' "${APPLE_CERT_DATA}" | gh secret set APPLE_CERT_DATA --repo "${TARGET_REPOSITORY}" --env production --app actions
printf '%s' "${APPLE_CERT_PASSWORD}" | gh secret set APPLE_CERT_PASSWORD --repo "${TARGET_REPOSITORY}" --env production --app actions
printf '%s' "${APPLE_TEAM_ID}" | gh secret set APPLE_TEAM_ID --repo "${TARGET_REPOSITORY}" --env production --app actions
printf '%s' "${SENTRY_AUTH_TOKEN}" | gh secret set SENTRY_AUTH_TOKEN --repo "${TARGET_REPOSITORY}" --env production --app actions

- name: Verify destination setting names
shell: bash
run: |
set -euo pipefail
test "$(gh api "repos/${TARGET_REPOSITORY}/environments/production" --jq '.deployment_branch_policy | "\(.protected_branches):\(.custom_branch_policies)"')" = 'true:false'
diff -u \
<(printf '%s\n' AI_GATEWAY_API_KEY ANTHROPIC_API_KEY OPENROUTER_API_KEY | sort) \
<(gh secret list --repo "${TARGET_REPOSITORY}" --json name --jq '.[].name' | grep -E '^(AI_GATEWAY_API_KEY|ANTHROPIC_API_KEY|OPENROUTER_API_KEY)$' | sort)
test "$(gh variable get SENTRY_CLIENT_ID --repo "${TARGET_REPOSITORY}" --json name --jq .name)" = SENTRY_CLIENT_ID
test "$(gh api "repos/${TARGET_REPOSITORY}" --jq .id)" = "${TARGET_REPOSITORY_ID}"
test "$(gh api "repos/${TARGET_REPOSITORY}/environments/cli-release" --jq '.deployment_branch_policy | "\(.protected_branches):\(.custom_branch_policies)"')" = 'false:true'
test "$(gh api "repos/${TARGET_REPOSITORY}/environments/cli-release/deployment-branch-policies" --jq '[.branch_policies[] | "\(.type):\(.name)"] | join(",")')" = 'branch:release/cli/*'
diff -u \
<(printf '%s\n' APPLE_API_KEY APPLE_CERT_DATA APPLE_CERT_PASSWORD APPLE_TEAM_ID SENTRY_AUTH_TOKEN | sort) \
<(gh secret list --repo "${TARGET_REPOSITORY}" --env production --json name --jq '.[].name' | grep -E '^(APPLE_API_KEY|APPLE_CERT_DATA|APPLE_CERT_PASSWORD|APPLE_TEAM_ID|SENTRY_AUTH_TOKEN)$' | sort)
<(gh secret list --repo "${TARGET_REPOSITORY}" --env cli-release --json name --jq '.[].name' | grep -E '^(APPLE_API_KEY|APPLE_CERT_DATA|APPLE_CERT_PASSWORD|APPLE_TEAM_ID|SENTRY_AUTH_TOKEN)$' | sort)
Loading