Skip to content

Commit

Permalink
Add test action to reproduce issue in normal PR. (#5943)
Browse files Browse the repository at this point in the history
Signed-off-by: Michael Nelson <[email protected]>

<!--
Before you open the request please review the following guidelines and
tips to help it be more easily integrated:

 - Describe the scope of your change - i.e. what the change does.
 - Describe any known limitations with your change.
- Please run any tests or examples that can exercise your modified code.

 Thank you for contributing!
 -->

### Description of the change

<!-- Describe the scope of your change - i.e. what the change does. -->
I used this PR to debug why the installation of the GPG key was failing.
The process I used was:
1. list the files written to disk in the `installGPGKeys` command (`ls
-al /tmp/*.key`) which showed that they had the incorrect size,
2. print out the `head -n1` of each (which is just the `-----BEGIN PGP
PRIVATE KEY BLOCK-----`) (had to also base64 it to avoid it being
correctly redacted as it should).

This showed clearly that, since I updated the secrets, the GPG data was
in fact not being written to disk. After some experimenting, and reading
the [GH documentation for secrets in
actions](https://docs.github.com/en/actions/security-guides/encrypted-secrets#using-encrypted-secrets-in-a-workflow)
I realised that the issue could be because these secrets are being
passed unquoted to the `installGPGKeys` bash function.

Rather than correctly quoting them, I instead removed these cmd-line
args from the function so that the env vars can be used more safely (as
mentioned in the linked GH doc above, including secrets as cmdline args
should be avoided anyway).

This fixed the problem in my tests. Now to see if it's the only issue in
CI :)

### Benefits

<!-- What benefits will be realized by the code change? -->

### Possible drawbacks

<!-- Describe any known limitations with your change -->

### Applicable issues

<!-- Enter any applicable Issues here (You can reference an issue using
#) -->

- fixes #

### Additional information

<!-- If there's anything else that's important and relevant to your pull
request, mention that information here.-->

Signed-off-by: Michael Nelson <[email protected]>
  • Loading branch information
absoludity authored Feb 2, 2023
1 parent 8dc2e1e commit 669fbc4
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 7 deletions.
4 changes: 2 additions & 2 deletions .github/workflows/kubeapps-general.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -605,7 +605,7 @@ jobs:
installGithubCLI ${GITHUB_VERSION}
installSemver ${SEMVER_VERSION}
installGPGKey ${GPG_KEY_PUBLIC} ${GPG_KEY_PRIVATE} ${CI_BOT_GPG} ${CI_BOT_EMAIL}
installGPGKey
- name: "Install SSH key: Forked Charts Deploy Key"
uses: shimataro/ssh-key-action@v2
with:
Expand Down Expand Up @@ -663,7 +663,7 @@ jobs:
installGithubCLI ${GITHUB_VERSION}
installSemver ${SEMVER_VERSION}
installGPGKey ${GPG_KEY_PUBLIC} ${GPG_KEY_PRIVATE} ${CI_BOT_GPG} ${CI_BOT_EMAIL}
installGPGKey
- name: "Install SSH key: Forked Charts Deploy Key"
uses: shimataro/ssh-key-action@v2
with:
Expand Down
5 changes: 0 additions & 5 deletions script/lib/libcitools.sh
Original file line number Diff line number Diff line change
Expand Up @@ -62,11 +62,6 @@ function installSemver() {
# Returns: None
########################################################################################################################
function installGPGKey() {
GPG_KEY_PUBLIC=${1:?GPG public key not provided}
GPG_KEY_PRIVATE=${2:?GPG private key not provided}
CI_BOT_GPG=${3:?CI BOT GPG key not provided}
CI_BOT_EMAIL=${4:?CI BOT EMAIL not provided}

info "Installing the GPG KEY"
# Creating the files from the GPG_KEY_PUBLIC and GPG_KEY_PRIVATE env vars
echo -e "${GPG_KEY_PUBLIC}" > /tmp/public.key
Expand Down

0 comments on commit 669fbc4

Please sign in to comment.