From 7d21665f7d8e5eb380bfde4a3a6ed195091d39e3 Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Fri, 9 Oct 2026 12:38:47 -0700 Subject: [PATCH 1/2] chore(gocd): expose App credentials to image deploy jobs --- gocd/templates/pipelines/usage-accountant.libsonnet | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/gocd/templates/pipelines/usage-accountant.libsonnet b/gocd/templates/pipelines/usage-accountant.libsonnet index d1a9b88..9e00773 100644 --- a/gocd/templates/pipelines/usage-accountant.libsonnet +++ b/gocd/templates/pipelines/usage-accountant.libsonnet @@ -7,6 +7,9 @@ local gocdtasks = import 'github.com/getsentry/gocd-jsonnet/libs/gocd-tasks.libs // - https://www.notion.so/sentry/GoCD-New-Service-Quickstart-6d8db7a6964049b3b0e78b8a4b52e25d function(region) { environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', SENTRY_REGION: region, }, lock_behavior: 'unlockWhenFinished', @@ -26,11 +29,6 @@ function(region) { checks: { timeout: 1800, elastic_profile_id: 'usage-accountant', - environment_variables: { - // Required for checkruns2. - GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', - GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', - }, tasks: [ gocdtasks.script(importstr '../bash/check-github.sh'), ], From 65e414612f7811db30f08ec0e9ee54eb12acb51e Mon Sep 17 00:00:00 2001 From: joshuarli Date: Fri, 9 Oct 2026 13:53:58 -0700 Subject: [PATCH 2/2] fix(gocd): scope workflow credentials to deployment jobs --- gocd/templates/pipelines/usage-accountant.libsonnet | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/gocd/templates/pipelines/usage-accountant.libsonnet b/gocd/templates/pipelines/usage-accountant.libsonnet index 9e00773..94b2b55 100644 --- a/gocd/templates/pipelines/usage-accountant.libsonnet +++ b/gocd/templates/pipelines/usage-accountant.libsonnet @@ -7,9 +7,6 @@ local gocdtasks = import 'github.com/getsentry/gocd-jsonnet/libs/gocd-tasks.libs // - https://www.notion.so/sentry/GoCD-New-Service-Quickstart-6d8db7a6964049b3b0e78b8a4b52e25d function(region) { environment_variables: { - // k8s-deploy dispatches deployment workflows using GitHub App credentials. - GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', - GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', SENTRY_REGION: region, }, lock_behavior: 'unlockWhenFinished', @@ -29,6 +26,11 @@ function(region) { checks: { timeout: 1800, elastic_profile_id: 'usage-accountant', + environment_variables: { + // Required for checkruns2. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', + }, tasks: [ gocdtasks.script(importstr '../bash/check-github.sh'), ], @@ -43,6 +45,11 @@ function(region) { deploy: { timeout: 1200, elastic_profile_id: 'usage-accountant', + environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', + }, tasks: [ gocdtasks.script(importstr '../bash/deploy.sh'), ],