From d2d8dd5147bee6a890648b60eca78b60c84aebe6 Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Fri, 9 Oct 2026 12:38:31 -0700 Subject: [PATCH 1/2] chore(gocd): expose App credentials to image deploy jobs --- gocd/templates/pipelines/chartcuterie.libsonnet | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/gocd/templates/pipelines/chartcuterie.libsonnet b/gocd/templates/pipelines/chartcuterie.libsonnet index eaa5f81..7d04824 100644 --- a/gocd/templates/pipelines/chartcuterie.libsonnet +++ b/gocd/templates/pipelines/chartcuterie.libsonnet @@ -27,6 +27,9 @@ local deploy_canary(region) = function(region) { environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', // SENTRY_REGION is used by the dev-infra scripts to connect to GKE SENTRY_REGION: region, }, @@ -47,10 +50,6 @@ function(region) { checks: { timeout: 1200, elastic_profile_id: 'chartcuterie', - environment_variables: { - GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', - GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', - }, tasks: [ gocdtasks.script(importstr '../bash/check-github-runs.sh'), ], From a4cf8b85cd6adcf401a795b7dbc4238a37aa99ec Mon Sep 17 00:00:00 2001 From: joshuarli Date: Fri, 9 Oct 2026 13:53:45 -0700 Subject: [PATCH 2/2] fix(gocd): scope workflow credentials to deployment jobs --- gocd/templates/pipelines/chartcuterie.libsonnet | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/gocd/templates/pipelines/chartcuterie.libsonnet b/gocd/templates/pipelines/chartcuterie.libsonnet index 7d04824..cb65338 100644 --- a/gocd/templates/pipelines/chartcuterie.libsonnet +++ b/gocd/templates/pipelines/chartcuterie.libsonnet @@ -11,6 +11,9 @@ local deploy_canary(region) = timeout: 600, elastic_profile_id: 'chartcuterie', environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', LABEL_SELECTOR: 'service=chartcuterie,env=canary', }, tasks: [ @@ -27,9 +30,6 @@ local deploy_canary(region) = function(region) { environment_variables: { - // k8s-deploy dispatches deployment workflows using GitHub App credentials. - GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', - GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', // SENTRY_REGION is used by the dev-infra scripts to connect to GKE SENTRY_REGION: region, }, @@ -50,6 +50,10 @@ function(region) { checks: { timeout: 1200, elastic_profile_id: 'chartcuterie', + environment_variables: { + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', + }, tasks: [ gocdtasks.script(importstr '../bash/check-github-runs.sh'), ], @@ -66,6 +70,9 @@ function(region) { timeout: 600, elastic_profile_id: 'chartcuterie', environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', LABEL_SELECTOR: 'service=chartcuterie', }, tasks: [