From 459976d353f6bf17726d19e8ba1364c5d7cc6ffc Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Fri, 9 Oct 2026 12:38:53 -0700 Subject: [PATCH 1/2] chore(gocd): expose App credentials to image deploy jobs --- gocd/templates/libs/utils.libsonnet | 4 ---- gocd/templates/pipelines/objectstore.libsonnet | 3 +++ 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/gocd/templates/libs/utils.libsonnet b/gocd/templates/libs/utils.libsonnet index 58c47685..ca4fd70d 100644 --- a/gocd/templates/libs/utils.libsonnet +++ b/gocd/templates/libs/utils.libsonnet @@ -17,10 +17,6 @@ local gocdtasks = import 'github.com/getsentry/gocd-jsonnet/libs/gocd-tasks.libs fetch_materials: true, jobs: { checks: { - environment_variables: { - GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', - GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', - }, timeout: 1800, elastic_profile_id: 'objectstore', tasks: [ diff --git a/gocd/templates/pipelines/objectstore.libsonnet b/gocd/templates/pipelines/objectstore.libsonnet index ace219f8..3088063a 100644 --- a/gocd/templates/pipelines/objectstore.libsonnet +++ b/gocd/templates/pipelines/objectstore.libsonnet @@ -118,6 +118,9 @@ local deploy_primary(region) = [ function(region) { environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', SENTRY_REGION: region, }, group: 'objectstore', From 4c5e8cf4cdeed227760d772cfc010b1e18009174 Mon Sep 17 00:00:00 2001 From: joshuarli Date: Fri, 9 Oct 2026 13:54:03 -0700 Subject: [PATCH 2/2] fix(gocd): scope workflow credentials to deployment jobs --- gocd/templates/libs/utils.libsonnet | 4 ++++ gocd/templates/pipelines/objectstore.libsonnet | 11 ++++++++--- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/gocd/templates/libs/utils.libsonnet b/gocd/templates/libs/utils.libsonnet index ca4fd70d..58c47685 100644 --- a/gocd/templates/libs/utils.libsonnet +++ b/gocd/templates/libs/utils.libsonnet @@ -17,6 +17,10 @@ local gocdtasks = import 'github.com/getsentry/gocd-jsonnet/libs/gocd-tasks.libs fetch_materials: true, jobs: { checks: { + environment_variables: { + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', + }, timeout: 1800, elastic_profile_id: 'objectstore', tasks: [ diff --git a/gocd/templates/pipelines/objectstore.libsonnet b/gocd/templates/pipelines/objectstore.libsonnet index 3088063a..d174bcfc 100644 --- a/gocd/templates/pipelines/objectstore.libsonnet +++ b/gocd/templates/pipelines/objectstore.libsonnet @@ -58,6 +58,9 @@ local deploy_canary(region) = timeout: 300, elastic_profile_id: 'objectstore', environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', K8S_ENVIRONMENT: 'canary', }, tasks: [ @@ -107,6 +110,11 @@ local deploy_primary(region) = [ deploy: { timeout: 300, elastic_profile_id: 'objectstore', + environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', + }, tasks: [ gocdtasks.script(importstr '../bash/deploy.sh'), ], @@ -118,9 +126,6 @@ local deploy_primary(region) = [ function(region) { environment_variables: { - // k8s-deploy dispatches deployment workflows using GitHub App credentials. - GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', - GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', SENTRY_REGION: region, }, group: 'objectstore',