Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci: Use deploy SSH key to push #366

Merged
merged 2 commits into from
Feb 20, 2023
Merged

ci: Use deploy SSH key to push #366

merged 2 commits into from
Feb 20, 2023

Conversation

radeksimko
Copy link
Member

@radeksimko radeksimko commented Feb 20, 2023

Since we have branch protection enabled and we need to push new commit as part of the release into the protected branch (main), we run into some limitations as far as how this can be handled in GitHub Actions.

I have already generated the deploy key and added to the repo + added the private part as a secret.

This should provide a reasonable balance between convenience and security, since we can easily rotate the deploy key in the context of the repository (rather than under a separate bot GH account) and still keep the key scoped to the repository.
The new time-scoped granular PATs would probably be even more secure, but the rotation workflow seems painfully manual.

Hopefully GitHub will eventually come up with some way of allowing the workflow token to bypass the branch protection and then we will have the best solution where no manual key/token management is needed and the token only has the necessary scope as per permission block in the workflow YAML file.

@hashicorp hashicorp deleted a comment from hashicorp-cla Feb 20, 2023
@radeksimko radeksimko requested a review from kmoe February 20, 2023 14:17
@radeksimko radeksimko marked this pull request as ready for review February 20, 2023 14:17
Copy link
Member

@kmoe kmoe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving assuming test passed (bot was able to push to protected branch)

@radeksimko radeksimko merged commit 1acf3e1 into main Feb 20, 2023
@radeksimko radeksimko deleted the ci-ssh-auth branch February 20, 2023 14:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants