Keep publish secrets scoped to specific steps #92
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Actually, we can do even better here and keep them scoped to the specific steps maybe. |
rossabaker
approved these changes
Jan 23, 2022
This reverts commit f3f3fdc.
|
Huh. I must have broke the workflows? |
armanbilge
commented
Jan 23, 2022
.github/workflows/ci.yml
Outdated
| @@ -132,17 +128,26 @@ jobs: | |||
| rm targets.tar | |||
|
|
|||
| - name: Import signing key | |||
| if: env.PGP_SECRET != '' && env.PGP_PASSPHRASE == '' | |||
| if: secrets.PGP_SECRET != '' && secrets.PGP_PASSPHRASE == '' | |||
There was a problem hiding this comment.
Secrets can't be used in conditionals. I'm not sure if we can use env here if we only set it for this step (not sure what happens first).
|
Not 100% convinced but let's see what happens on main. |
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently, they are available in the entire workflow. This adds a new setting
githubWorkflowPublishEnvthat allows us to scope these secrets to only the publish job which should be the only place they are used.Technically a breaking change if someone was relying on the old global scoping.