From 6e93e393514d1bf9a8560eb5a96f936cb2de0966 Mon Sep 17 00:00:00 2001 From: Sourcegraph Date: Tue, 1 Sep 2026 14:57:10 +0000 Subject: [PATCH] ci: use JENKINS_PAT_TOKEN instead of GH_TOKEN PLT-4224 --- .../workflows/frontend-deploy-workflow.yml | 38 +++++++++--------- .../frontend-library-pr-release-workflow.yml | 6 +-- .github/workflows/frontend-pr-workflow.yml | 40 +++++++++---------- .github/workflows/go-lint-workflow.yaml | 4 +- .../graphql-generate-persisted-operations.yml | 4 +- .../frontend-pr-workflow/README.md | 10 ++--- .../frontend-pr-workflow/workflow.yml | 16 ++++---- .../download-build-artifacts/README.md | 2 +- shared-actions/setup-cypress/README.md | 2 +- shared-actions/setup-jarvis/README.md | 8 ++-- .../setup-node-with-cache/README.md | 16 ++++---- shared-actions/setup-playwright/README.md | 2 +- workflow-templates/combine-prs.yml | 2 +- .../frontend-canary-cleanup.yml | 4 +- .../library-checks-and-release.yml | 4 +- workflow-templates/secrets-scan.yml | 2 +- 16 files changed, 80 insertions(+), 80 deletions(-) diff --git a/.github/workflows/frontend-deploy-workflow.yml b/.github/workflows/frontend-deploy-workflow.yml index c8c4d0da..0675c6c7 100644 --- a/.github/workflows/frontend-deploy-workflow.yml +++ b/.github/workflows/frontend-deploy-workflow.yml @@ -341,21 +341,21 @@ jobs: use-asdf: ${{ inputs.use-asdf }} cache-mode: ${{ inputs.cache-mode }} disable-restore-keys: ${{ inputs.disable-restore-keys }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Setup Jarvis uses: Typeform/.github/shared-actions/setup-jarvis@v1 with: jarvis-branch: ${{ inputs.jarvis-branch }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Run pre-build command if: inputs.pre-build-command != '' run: ${{ inputs.pre-build-command }} env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} - name: Clean dist directory @@ -365,7 +365,7 @@ jobs: run: ${{ inputs.build-command }} env: PUBLIC_CDN_URL: ${{ inputs.cdn-url }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} JARVIS_DATADOG_LOGS_ENABLED: ${{ inputs.jarvis-datadog-enabled }} JARVIS_DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY || secrets.DATADOG_API_KEY_FRONTEND_METRICS }} @@ -440,27 +440,27 @@ jobs: use-asdf: ${{ inputs.use-asdf }} cache-mode: ${{ inputs.cache-mode }} disable-restore-keys: ${{ inputs.disable-restore-keys }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Setup Jarvis uses: Typeform/.github/shared-actions/setup-jarvis@v1 with: jarvis-branch: ${{ inputs.jarvis-branch }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Run pre-test command if: inputs.pre-test-command != '' run: ${{ inputs.pre-test-command }} env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} - name: Run unit tests run: ${{ inputs.unit-test-command }} env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} - name: Upload coverage @@ -490,14 +490,14 @@ jobs: use-asdf: ${{ inputs.use-asdf }} cache-mode: ${{ inputs.cache-mode }} disable-restore-keys: ${{ inputs.disable-restore-keys }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Setup Jarvis uses: Typeform/.github/shared-actions/setup-jarvis@v1 with: jarvis-branch: ${{ inputs.jarvis-branch }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Setup Playwright @@ -508,7 +508,7 @@ jobs: if: inputs.pre-test-command != '' run: ${{ inputs.pre-test-command }} env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} - name: Download Build Artifacts @@ -520,7 +520,7 @@ jobs: - name: Run integration tests run: ${{ inputs.integration-test-command }} env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} VRT_APIURL: ${{ secrets.VRT_APIURL }} VRT_APIKEY: ${{ secrets.VRT_APIKEY }} @@ -559,7 +559,7 @@ jobs: wait-on-url: ${{ inputs.cypress-functional-wait-on }} artifact-name: 'cypress-functional-results-${{ github.run_id }}' artifact-retention-days: '7' - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }} package-manager: ${{ inputs.package-manager }} @@ -588,7 +588,7 @@ jobs: vrt-build-id: ${{ github.sha }} artifact-name: 'cypress-visual-results-${{ github.run_id }}' artifact-retention-days: '7' - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }} VRT_APIURL: ${{ secrets.VRT_APIURL }} VRT_APIKEY: ${{ secrets.VRT_APIKEY }} @@ -621,7 +621,7 @@ jobs: vrt-build-id: ${{ github.sha }} artifact-name: "playwright-visual-results-${{ github.run_id }}" artifact-retention-days: "7" - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} VRT_APIURL: ${{ secrets.VRT_APIURL }} VRT_APIKEY: ${{ secrets.VRT_APIKEY }} VRT_PROJECT: ${{ secrets.VRT_PROJECT }} @@ -666,7 +666,7 @@ jobs: - name: Check out Git repository uses: actions/checkout@v6 with: - token: ${{ secrets.GH_TOKEN }} + token: ${{ secrets.JENKINS_PAT_TOKEN }} fetch-depth: 0 - name: Configure Git @@ -681,7 +681,7 @@ jobs: use-asdf: ${{ inputs.use-asdf }} cache-mode: ${{ inputs.cache-mode }} disable-restore-keys: ${{ inputs.disable-restore-keys }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Download Build Artifacts @@ -694,7 +694,7 @@ jobs: uses: Typeform/.github/shared-actions/setup-jarvis@v1 with: jarvis-branch: ${{ inputs.jarvis-branch }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: AWS auth @@ -720,7 +720,7 @@ jobs: # Jarvis debug logging DEBUG: jarvis # GitHub - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} # AWS configuration AWS_REGION: ${{ inputs.aws-region }} diff --git a/.github/workflows/frontend-library-pr-release-workflow.yml b/.github/workflows/frontend-library-pr-release-workflow.yml index 48f0d181..2a1e1e4a 100644 --- a/.github/workflows/frontend-library-pr-release-workflow.yml +++ b/.github/workflows/frontend-library-pr-release-workflow.yml @@ -104,7 +104,7 @@ jobs: uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: node-version: ${{ inputs.node-version }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} - name: Run linters run: ${{ inputs.lint-command }} @@ -122,8 +122,8 @@ jobs: contains(fromJSON(inputs.semantic-release-branches), github.ref_name) run: ${{ inputs.semantic-release-command }} env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} - NPM_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} + NPM_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} # SonarCloud Scan — REMOVED (SonarCloud has been decommissioned). # The `run-sonarcloud`, `sonar-project-key` inputs and `SONAR_CLOUD_TOKEN` diff --git a/.github/workflows/frontend-pr-workflow.yml b/.github/workflows/frontend-pr-workflow.yml index b72b681b..5495970e 100644 --- a/.github/workflows/frontend-pr-workflow.yml +++ b/.github/workflows/frontend-pr-workflow.yml @@ -327,14 +327,14 @@ jobs: use-asdf: ${{ inputs.use-asdf }} cache-mode: ${{ inputs.cache-mode }} disable-restore-keys: ${{ inputs.disable-restore-keys }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Setup Jarvis uses: Typeform/.github/shared-actions/setup-jarvis@v1 with: jarvis-branch: ${{ inputs.jarvis-branch }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} # Runs before linting AND build so that generated files (e.g. GraphQL @@ -344,7 +344,7 @@ jobs: if: inputs.pre-build-command != '' run: ${{ inputs.pre-build-command }} env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} - name: Run linting @@ -360,7 +360,7 @@ jobs: run: ${{ inputs.build-command }} env: PUBLIC_CDN_URL: ${{ inputs.cdn-url }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} JARVIS_DATADOG_LOGS_ENABLED: ${{ inputs.jarvis-datadog-enabled }} JARVIS_DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY || secrets.DATADOG_API_KEY_FRONTEND_METRICS }} @@ -402,27 +402,27 @@ jobs: use-asdf: ${{ inputs.use-asdf }} cache-mode: ${{ inputs.cache-mode }} disable-restore-keys: ${{ inputs.disable-restore-keys }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Setup Jarvis uses: Typeform/.github/shared-actions/setup-jarvis@v1 with: jarvis-branch: ${{ inputs.jarvis-branch }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Run pre-test command if: inputs.pre-test-command != '' run: ${{ inputs.pre-test-command }} env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} - name: Run unit tests run: ${{ inputs.unit-test-command }} env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} - name: Upload coverage @@ -452,21 +452,21 @@ jobs: use-asdf: ${{ inputs.use-asdf }} cache-mode: ${{ inputs.cache-mode }} disable-restore-keys: ${{ inputs.disable-restore-keys }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Setup Jarvis uses: Typeform/.github/shared-actions/setup-jarvis@v1 with: jarvis-branch: ${{ inputs.jarvis-branch }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Run pre-test command if: inputs.pre-test-command != '' run: ${{ inputs.pre-test-command }} env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} - name: Setup Playwright @@ -482,7 +482,7 @@ jobs: - name: Run integration tests run: ${{ inputs.integration-test-command }} env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} VRT_APIURL: ${{ secrets.VRT_APIURL }} VRT_APIKEY: ${{ secrets.VRT_APIKEY }} @@ -520,7 +520,7 @@ jobs: use-asdf: ${{ inputs.use-asdf }} cache-mode: ${{ inputs.cache-mode }} disable-restore-keys: ${{ inputs.disable-restore-keys }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Download Build Artifacts @@ -533,7 +533,7 @@ jobs: uses: Typeform/.github/shared-actions/setup-jarvis@v1 with: jarvis-branch: ${{ inputs.jarvis-branch }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: AWS auth @@ -556,7 +556,7 @@ jobs: ${{ inputs.deploy-command }} env: DEBUG: jarvis - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} TURBO_SCM_BASE: ${{ inputs.turbo-scm-base }} AWS_ASSETS_BUCKET: ${{ inputs.cdn-bucket }} AWS_CLOUDFRONT_DIST: ${{ inputs.cloudfront-dist }} @@ -595,7 +595,7 @@ jobs: contents: read uses: Typeform/.github/.github/workflows/graphql-generate-persisted-operations.yml@v1 secrets: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} # Job 7: Deep Purple E2E Tests deep-purple: @@ -635,7 +635,7 @@ jobs: wait-on-url: ${{ inputs.cypress-functional-wait-on }} artifact-name: 'cypress-functional-results-${{ github.run_id }}' artifact-retention-days: '7' - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }} package-manager: ${{ inputs.package-manager }} @@ -665,7 +665,7 @@ jobs: vrt-build-id: ${{ github.sha }} artifact-name: 'playwright-visual-results-${{ github.run_id }}' artifact-retention-days: '7' - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} VRT_APIURL: ${{ secrets.VRT_APIURL }} VRT_APIKEY: ${{ secrets.VRT_APIKEY }} VRT_PROJECT: ${{ secrets.VRT_PROJECT }} @@ -696,7 +696,7 @@ jobs: vrt-build-id: ${{ github.sha }} artifact-name: 'cypress-visual-results-${{ github.run_id }}' artifact-retention-days: '7' - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }} VRT_APIURL: ${{ secrets.VRT_APIURL }} VRT_APIKEY: ${{ secrets.VRT_APIKEY }} @@ -727,7 +727,7 @@ jobs: - name: Check out Git repository uses: actions/checkout@v6 with: - token: ${{ secrets.GH_TOKEN }} + token: ${{ secrets.JENKINS_PAT_TOKEN }} - name: Push tree-hash marker run: | diff --git a/.github/workflows/go-lint-workflow.yaml b/.github/workflows/go-lint-workflow.yaml index bd173aff..815674d9 100644 --- a/.github/workflows/go-lint-workflow.yaml +++ b/.github/workflows/go-lint-workflow.yaml @@ -62,11 +62,11 @@ jobs: repository: ${{ inputs.golangci-lint-config-repo }} ref: ${{ inputs.golangci-lint-config-repo-ref }} path: ${{ inputs.golangci-lint-config-repo-path }} - token: ${{ secrets.GH_TOKEN }} + token: ${{ secrets.JENKINS_PAT_TOKEN }} - name: Configure git for private modules env: - TOKEN: ${{ secrets.GH_TOKEN }} + TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} run: | git config --global url."https://${TOKEN}:x-oauth-basic@github.com/".insteadOf "https://github.com/" export GOPRIVATE=github.com/Typeform/* diff --git a/.github/workflows/graphql-generate-persisted-operations.yml b/.github/workflows/graphql-generate-persisted-operations.yml index c36a597d..602c2ef1 100644 --- a/.github/workflows/graphql-generate-persisted-operations.yml +++ b/.github/workflows/graphql-generate-persisted-operations.yml @@ -27,7 +27,7 @@ jobs: update-allow-list: runs-on: ["${{ inputs.runner }}"] env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} GRAPHQL_ENDPOINTS: | https://graphqlbff.staging.internal.tfdev.typeform.tf https://graphqlbff.tfprod.internal.typeform.tf @@ -53,7 +53,7 @@ jobs: - name: Set GitHub packages registry run: | - npm config set '//npm.pkg.github.com/:_authToken' ${{ secrets.GH_TOKEN }} + npm config set '//npm.pkg.github.com/:_authToken' ${{ secrets.JENKINS_PAT_TOKEN }} npm config set @typeform:registry https://npm.pkg.github.com/ - name: Check if GraphQL endpoints are reachable diff --git a/reusable-workflows/frontend-pr-workflow/README.md b/reusable-workflows/frontend-pr-workflow/README.md index bf36f614..99f93d67 100644 --- a/reusable-workflows/frontend-pr-workflow/README.md +++ b/reusable-workflows/frontend-pr-workflow/README.md @@ -35,7 +35,7 @@ jobs: cdn-url: 'https://public-assets.typeform.com/demo-app' jarvis-datadog-service: 'demo-app' secrets: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }} ``` @@ -173,7 +173,7 @@ jobs: cdn-url: 'https://public-assets.typeform.com/demo-app' jarvis-datadog-service: 'demo-app' secrets: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} ``` ### Full Configuration @@ -222,7 +222,7 @@ jobs: integration-timeout: 20 deploy-timeout: 10 secrets: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }} ``` @@ -245,7 +245,7 @@ jobs: jarvis-branch: ${{ inputs.jarvis-branch || '' }} # ... other inputs ... secrets: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} ``` ## Project-Specific Configurations @@ -347,7 +347,7 @@ jobs: app-name: 'your-app-name' # ... configure inputs ... secrets: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} ``` ### Step 3: Test on Feature Branch diff --git a/reusable-workflows/frontend-pr-workflow/workflow.yml b/reusable-workflows/frontend-pr-workflow/workflow.yml index d2d723f7..4a69a000 100644 --- a/reusable-workflows/frontend-pr-workflow/workflow.yml +++ b/reusable-workflows/frontend-pr-workflow/workflow.yml @@ -156,14 +156,14 @@ jobs: uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: node-version: ${{ inputs.node-version }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Setup Jarvis uses: Typeform/.github/shared-actions/setup-jarvis@main with: jarvis-branch: ${{ inputs.jarvis-branch }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Clean dist directory @@ -173,7 +173,7 @@ jobs: run: ${{ inputs.build-command }} env: PUBLIC_CDN_URL: ${{ inputs.cdn-url }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} JARVIS_DATADOG_LOGS_ENABLED: ${{ inputs.jarvis-datadog-enabled }} JARVIS_DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }} JARVIS_DATADOG_SITE: datadoghq.com @@ -208,7 +208,7 @@ jobs: uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: node-version: ${{ inputs.node-version }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Run unit tests @@ -238,7 +238,7 @@ jobs: uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: node-version: ${{ inputs.node-version }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Setup Playwright @@ -282,7 +282,7 @@ jobs: uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: node-version: ${{ inputs.node-version }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: Download Build Artifacts @@ -295,7 +295,7 @@ jobs: uses: Typeform/.github/shared-actions/setup-jarvis@main with: jarvis-branch: ${{ inputs.jarvis-branch }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: ${{ inputs.package-manager }} - name: AWS auth @@ -309,7 +309,7 @@ jobs: run: ${{ inputs.deploy-command }} env: DEBUG: jarvis - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} AWS_ASSETS_BUCKET: ${{ inputs.cdn-bucket }} AWS_CLOUDFRONT_DIST: ${{ inputs.cloudfront-dist }} PUBLIC_CDN_URL: ${{ inputs.cdn-url }} diff --git a/shared-actions/download-build-artifacts/README.md b/shared-actions/download-build-artifacts/README.md index caeffed3..98a4d133 100644 --- a/shared-actions/download-build-artifacts/README.md +++ b/shared-actions/download-build-artifacts/README.md @@ -62,7 +62,7 @@ jobs: - uses: actions/checkout@v4 - uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} - run: yarn dist diff --git a/shared-actions/setup-cypress/README.md b/shared-actions/setup-cypress/README.md index 02b4e40f..38c8970e 100644 --- a/shared-actions/setup-cypress/README.md +++ b/shared-actions/setup-cypress/README.md @@ -35,7 +35,7 @@ jobs: uses: Typeform/.github/shared-actions/setup-node-with-cache@v1 with: use-asdf: true - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} - name: Setup Cypress uses: Typeform/.github/shared-actions/setup-cypress@v1 diff --git a/shared-actions/setup-jarvis/README.md b/shared-actions/setup-jarvis/README.md index 754c7c70..d76f59f4 100644 --- a/shared-actions/setup-jarvis/README.md +++ b/shared-actions/setup-jarvis/README.md @@ -17,7 +17,7 @@ Centralized Jarvis setup with support for npm, GitHub branches, and local develo - name: Setup Jarvis uses: Typeform/.github/shared-actions/setup-jarvis@main with: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} ``` ### Testing (GitHub branch) @@ -26,7 +26,7 @@ Centralized Jarvis setup with support for npm, GitHub branches, and local develo uses: Typeform/.github/shared-actions/setup-jarvis@main with: jarvis-branch: 'fix/deployment-timeout' - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} ``` ### Local Development (act) @@ -123,12 +123,12 @@ jobs: - uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} - uses: Typeform/.github/shared-actions/setup-jarvis@main with: jarvis-branch: ${{ env.JARVIS_BRANCH }} - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} - run: yarn dist ``` diff --git a/shared-actions/setup-node-with-cache/README.md b/shared-actions/setup-node-with-cache/README.md index d8a9179d..28600131 100644 --- a/shared-actions/setup-node-with-cache/README.md +++ b/shared-actions/setup-node-with-cache/README.md @@ -22,7 +22,7 @@ Standardized Node.js setup with enhanced yarn/pnpm caching and GitHub packages r uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: node-version: '20' - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} enable-yarn-cache: 'true' ``` @@ -171,14 +171,14 @@ act pull_request -j build ```yaml - uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} ``` ### pnpm Usage ```yaml - uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} package-manager: 'pnpm' cache-mode: 'node_modules-only' # or 'full' for pnpm workspaces ``` @@ -189,14 +189,14 @@ act pull_request -j build - uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: node-version: '18' - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} ``` ### Cache node_modules Only (Faster for Non-Workspace Repos) ```yaml - uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} cache-mode: 'node_modules-only' ``` **Use when**: Your `node_modules` cache is small and you want to skip yarn install entirely on cache hit. Best for non-workspace repos like Chief where the full cache (node_modules + yarn cache) is large. @@ -205,7 +205,7 @@ act pull_request -j build ```yaml - uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} cache-mode: 'yarn-cache-only' ``` **Use when**: You expect frequent cache misses or want to reduce cache restore time. Yarn install will run every time but will be faster because tarballs are cached. @@ -214,7 +214,7 @@ act pull_request -j build ```yaml - uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} disable-restore-keys: 'true' ``` **Use when**: You want to avoid restoring large stale caches. Only exact cache key matches will be restored. @@ -223,7 +223,7 @@ act pull_request -j build ```yaml - uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} enable-yarn-cache: 'false' ``` diff --git a/shared-actions/setup-playwright/README.md b/shared-actions/setup-playwright/README.md index 837ee63d..b97ab16c 100644 --- a/shared-actions/setup-playwright/README.md +++ b/shared-actions/setup-playwright/README.md @@ -96,7 +96,7 @@ jobs: # 1. Setup Node and install dependencies (includes Playwright) - uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} # 2. Setup Playwright browsers (cached) - uses: Typeform/.github/shared-actions/setup-playwright@main diff --git a/workflow-templates/combine-prs.yml b/workflow-templates/combine-prs.yml index 67c25088..d24c65c5 100644 --- a/workflow-templates/combine-prs.yml +++ b/workflow-templates/combine-prs.yml @@ -30,7 +30,7 @@ jobs: uses: Typeform/.github/.github/workflows/combine-prs.yml@v1 # Provide Github token. Note that the default ${{ secrets.GITHUB_TOKEN }} does not trigger automated PR checks. secrets: - githubToken: ${{ secrets.GH_TOKEN }} + githubToken: ${{ secrets.JENKINS_PAT_TOKEN }} # with: # # For public repos run on Github-hosted machine: # runsOn: '["ubuntu-latest"]'' diff --git a/workflow-templates/frontend-canary-cleanup.yml b/workflow-templates/frontend-canary-cleanup.yml index 253546f8..3393eecc 100644 --- a/workflow-templates/frontend-canary-cleanup.yml +++ b/workflow-templates/frontend-canary-cleanup.yml @@ -29,10 +29,10 @@ jobs: - name: Set GitHub packages registry run: | - npm config set '//npm.pkg.github.com/:_authToken' ${{ secrets.GH_TOKEN }} + npm config set '//npm.pkg.github.com/:_authToken' ${{ secrets.JENKINS_PAT_TOKEN }} npm config set @typeform:registry https://npm.pkg.github.com/ env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} - name: Install jarvis run: npm install @typeform/jarvis diff --git a/workflow-templates/library-checks-and-release.yml b/workflow-templates/library-checks-and-release.yml index 2e3d6a04..40e3b61d 100644 --- a/workflow-templates/library-checks-and-release.yml +++ b/workflow-templates/library-checks-and-release.yml @@ -12,7 +12,7 @@ on: - main env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} jobs: main: @@ -29,7 +29,7 @@ jobs: uses: Typeform/.github/shared-actions/setup-node-with-cache@main with: node-version: '20' - GH_TOKEN: ${{ secrets.GH_TOKEN }} + GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} - name: Run linting and tests run: npx npm-run-all -p test lint diff --git a/workflow-templates/secrets-scan.yml b/workflow-templates/secrets-scan.yml index 256cc456..7a70ca99 100644 --- a/workflow-templates/secrets-scan.yml +++ b/workflow-templates/secrets-scan.yml @@ -27,4 +27,4 @@ jobs: docker-registry: ${{ secrets.GITLEAKS_DOCKER_REGISTRY }} docker-username: ${{ secrets.GITLEAKS_DOCKER_USERNAME }} docker-password: ${{ secrets.GITLEAKS_DOCKER_PASSWORD }} - gh-token: ${{ secrets.GH_TOKEN }} + gh-token: ${{ secrets.JENKINS_PAT_TOKEN }}