Fix gpg key #68
Fix gpg key #68
Conversation
WalkthroughThe pull request updates the GitHub Actions workflow for Helm Chart Preview Build, specifically targeting the Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🔭 Outside diff range comments (1)
.github/workflows/chart-preview.yml (1)
Line range hint
79-127: Consider reducing code duplication in build steps.The build steps for Plane-CE and Plane-Enterprise are identical except for the chart repository name. This duplication increases maintenance overhead and the risk of inconsistencies.
Consider creating a reusable composite action or shell script:
# .github/actions/build-chart/action.yml name: 'Build Helm Chart' inputs: chart-repo: required: true type: string runs: using: "composite" steps: - shell: bash env: EXPORT_DIR: ${{env.PREVIEW_BUILD_FOLDER}} CR_KEY: ${{ env.GPG_KEY_NAME }} CR_PASSPHRASE_FILE: ${{env.GNUPGHOME}}/gpg-passphrase CR_KEYRING: ${{env.GNUPGHOME}}/secring.gpg run: | flatBranchName=$(echo "${{ github.ref_name}}" | sed 's/\//\-/g') sed -i "s/name: ${{ inputs.chart-repo }}/name: ${{ env.CHART_PREFIX }}-${{ inputs.chart-repo }}/" charts/${{ inputs.chart-repo }}/Chart.yaml sed -i "s/description: .*/description: ${flatBranchName}/g" charts/${{ inputs.chart-repo }}/Chart.yaml helm package --sign --key "$CR_KEY" --keyring $CR_KEYRING --passphrase-file "$CR_PASSPHRASE_FILE" charts/${{ inputs.chart-repo }} -u -d $EXPORT_DIR/${{ inputs.chart-repo }}/charts cp charts/${{ inputs.chart-repo }}/README.md $EXPORT_DIR/${{ inputs.chart-repo }}/${{ inputs.chart-repo }}.md helm repo index $EXPORT_DIR/${{ inputs.chart-repo }}Then use it like this:
- id: build-plane-ce if: ${{ env.BUILD_PLANE_CE == 'true' }} name: Build Plane-CE working-directory: code env: EXPORT_DIR: ${{env.PREVIEW_BUILD_FOLDER}} CHART_REPO: plane-ce CR_KEY: ${{ env.GPG_KEY_NAME }} CR_PASSPHRASE_FILE: ${{env.GNUPGHOME}}/gpg-passphrase CR_KEYRING: ${{env.GNUPGHOME}}/secring.gpg run: | flatBranchName=$(echo "${{ github.ref_name}}" | sed 's/\//\-/g') ... + id: build-plane-ce + if: ${{ env.BUILD_PLANE_CE == 'true' }} + name: Build Plane-CE + uses: ./.github/actions/build-chart + with: + chart-repo: plane-ce
🧹 Nitpick comments (2)
.github/workflows/chart-preview.yml (2)
Line range hint
52-77: Consider using gpg-preset-passphrase instead of storing passphrase in file.While the GPG configuration is generally well-structured, storing the passphrase in a file (even temporarily) could pose a security risk. Consider using
gpg-preset-passphrasefrom gpg-agent for a more secure approach.Here's an alternative approach:
- echo "${{env.GPG_PASSPHRASE}}" > ${{env.CR_PASSPHRASE_FILE}} + # Use gpg-preset-passphrase instead + echo "allow-preset-passphrase" >> ${{env.GNUPGHOME}}/gpg-agent.conf + /usr/lib/gnupg2/gpg-preset-passphrase --preset "${{ env.GPG_KEY_NAME }}" <<< "${{ env.GPG_PASSPHRASE }}"
Line range hint
129-166: Optimize AWS CLI installation.Installing AWS CLI during runtime adds overhead to each workflow run. Consider using the official AWS CLI action instead.
Replace the pip installation with the official action:
- pip install awscli - aws s3 cp ${{env.PREVIEW_BUILD_FOLDER}} s3://${{env.AWS_BUCKET}}/${{ env.HELM_SUB_FOLDER }} --recursive + - name: Configure AWS Credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-access-key-id: ${{ secrets.HELM_PREVIEW_AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.HELM_PREVIEW_AWS_SECRET_ACCESS_KEY }} + aws-region: ${{ vars.HELM_PREVIEW_AWS_REGION }} + + - name: Upload to S3 + uses: aws-actions/aws-cli@v1 + with: + args: s3 cp ${{env.PREVIEW_BUILD_FOLDER}} s3://${{env.AWS_BUCKET}}/${{ env.HELM_SUB_FOLDER }} --recursive
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/chart-preview.yml(1 hunks)
🔇 Additional comments (1)
.github/workflows/chart-preview.yml (1)
34-34: LGTM! Good practice to pin the Ubuntu version.
Using ubuntu-22.04 instead of ubuntu-latest provides better stability and reproducibility for the workflow. This is an LTS release which ensures long-term support and security updates.
Changed build the image from
ubuntu-latesttoubuntu-22.04.Summary by CodeRabbit
New Features
Chores
ubuntu-latesttoubuntu-22.04.