From 06902ed16cd544daaf6b9b6f034352c45550f1a4 Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Fri, 9 Oct 2026 12:38:37 -0700 Subject: [PATCH 1/2] chore(gocd): expose App credentials to image deploy jobs --- gocd/templates/pipelines/taskbroker.libsonnet | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/gocd/templates/pipelines/taskbroker.libsonnet b/gocd/templates/pipelines/taskbroker.libsonnet index 702ac67d..ec9c0c59 100644 --- a/gocd/templates/pipelines/taskbroker.libsonnet +++ b/gocd/templates/pipelines/taskbroker.libsonnet @@ -7,10 +7,6 @@ local checks_stage = { checks: { timeout: 20, elastic_profile_id: 'taskbroker', - environment_variables: { - GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', - GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', - }, tasks: [ gocdtasks.script(importstr '../bash/check-github-runs.sh'), ], @@ -77,6 +73,9 @@ local deployPrimaryStage = { function(region) { environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', // SENTRY_REGION is used by the dev-infra scripts to connect to GKE SENTRY_REGION: region, }, From d51b44dbc3eca7a231310861cd84c9ab01e98381 Mon Sep 17 00:00:00 2001 From: joshuarli Date: Fri, 9 Oct 2026 13:53:50 -0700 Subject: [PATCH 2/2] fix(gocd): scope workflow credentials to deployment jobs --- gocd/templates/pipelines/taskbroker.libsonnet | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/gocd/templates/pipelines/taskbroker.libsonnet b/gocd/templates/pipelines/taskbroker.libsonnet index ec9c0c59..5f182b1b 100644 --- a/gocd/templates/pipelines/taskbroker.libsonnet +++ b/gocd/templates/pipelines/taskbroker.libsonnet @@ -7,6 +7,10 @@ local checks_stage = { checks: { timeout: 20, elastic_profile_id: 'taskbroker', + environment_variables: { + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', + }, tasks: [ gocdtasks.script(importstr '../bash/check-github-runs.sh'), ], @@ -41,6 +45,9 @@ local deploy_canary_stage(region) = timeout: 30, elastic_profile_id: 'taskbroker', environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', LABEL_SELECTOR: 'service=taskbroker,env=canary', }, tasks: [ @@ -61,6 +68,9 @@ local deployPrimaryStage = { timeout: 40, elastic_profile_id: 'taskbroker', environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', LABEL_SELECTOR: 'service=taskbroker', }, tasks: [ @@ -73,9 +83,6 @@ local deployPrimaryStage = { function(region) { environment_variables: { - // k8s-deploy dispatches deployment workflows using GitHub App credentials. - GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', - GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', // SENTRY_REGION is used by the dev-infra scripts to connect to GKE SENTRY_REGION: region, },