From 315a86d396376c3a5b5d203c9b7896e4cdea28bf Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Tue, 28 Jul 2026 16:31:09 +0000 Subject: [PATCH] fix(ci): replace configure-aws-credentials with direct env vars MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The aws-actions/configure-aws-credentials@v4 action failed on the Gitea runner with 'Credentials could not be loaded' — the action couldn't load the secrets in the Gitea Actions context. Replaced with direct env var exports (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION) on each step that needs AWS access. This is simpler and works reliably with Gitea Actions. Also removed the id-token: write permission (not needed without the configure-aws-credentials action's OIDC flow). ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci--- --- .gitea/workflows/modules-lifecycle.yml | 42 ++++++++++++++----------- .github/workflows/modules-lifecycle.yml | 42 ++++++++++++++----------- 2 files changed, 48 insertions(+), 36 deletions(-) diff --git a/.gitea/workflows/modules-lifecycle.yml b/.gitea/workflows/modules-lifecycle.yml index d9a8812..ce797b8 100644 --- a/.gitea/workflows/modules-lifecycle.yml +++ b/.gitea/workflows/modules-lifecycle.yml @@ -17,7 +17,6 @@ on: workflow_dispatch: permissions: - id-token: write contents: read jobs: @@ -36,13 +35,16 @@ jobs: echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list sudo apt-get update && sudo apt-get install -y terraform=1.9.* - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - aws-region: us-east-1 - access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} - secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} + run: | + echo "AWS_ACCESS_KEY_ID=${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}" >> $GITHUB_ENV + echo "AWS_SECRET_ACCESS_KEY=${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}" >> $GITHUB_ENV + echo "AWS_DEFAULT_REGION=us-east-1" >> $GITHUB_ENV - name: Apply platform VPC working-directory: terraform/platform + env: + AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: us-east-1 run: | terraform init -input=false -lock=false terraform apply -auto-approve -lock=false @@ -68,17 +70,23 @@ jobs: wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list sudo apt-get update && sudo apt-get install -y terraform=1.9.* - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - aws-region: us-east-1 - access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} - secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} - name: Apply (simple) + env: + AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: us-east-1 run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/simple.yml" - name: Modify (complex) + env: + AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: us-east-1 run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/complex.yml" - name: Destroy + env: + AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: us-east-1 run: bash scripts/run_platform.sh --destroy "modules/l1/${{ matrix.module }}/examples/complex.yml" # Cleanup: destroy the platform VPC (always runs, even if lifecycle fails) @@ -97,14 +105,12 @@ jobs: wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list sudo apt-get update && sudo apt-get install -y terraform=1.9.* - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - aws-region: us-east-1 - access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} - secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} - name: Destroy platform VPC working-directory: terraform/platform + env: + AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: us-east-1 run: | terraform init -input=false -lock=false terraform destroy -auto-approve -lock=false \ No newline at end of file diff --git a/.github/workflows/modules-lifecycle.yml b/.github/workflows/modules-lifecycle.yml index d9a8812..ce797b8 100644 --- a/.github/workflows/modules-lifecycle.yml +++ b/.github/workflows/modules-lifecycle.yml @@ -17,7 +17,6 @@ on: workflow_dispatch: permissions: - id-token: write contents: read jobs: @@ -36,13 +35,16 @@ jobs: echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list sudo apt-get update && sudo apt-get install -y terraform=1.9.* - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - aws-region: us-east-1 - access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} - secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} + run: | + echo "AWS_ACCESS_KEY_ID=${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}" >> $GITHUB_ENV + echo "AWS_SECRET_ACCESS_KEY=${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}" >> $GITHUB_ENV + echo "AWS_DEFAULT_REGION=us-east-1" >> $GITHUB_ENV - name: Apply platform VPC working-directory: terraform/platform + env: + AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: us-east-1 run: | terraform init -input=false -lock=false terraform apply -auto-approve -lock=false @@ -68,17 +70,23 @@ jobs: wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list sudo apt-get update && sudo apt-get install -y terraform=1.9.* - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - aws-region: us-east-1 - access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} - secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} - name: Apply (simple) + env: + AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: us-east-1 run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/simple.yml" - name: Modify (complex) + env: + AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: us-east-1 run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/complex.yml" - name: Destroy + env: + AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: us-east-1 run: bash scripts/run_platform.sh --destroy "modules/l1/${{ matrix.module }}/examples/complex.yml" # Cleanup: destroy the platform VPC (always runs, even if lifecycle fails) @@ -97,14 +105,12 @@ jobs: wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list sudo apt-get update && sudo apt-get install -y terraform=1.9.* - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - aws-region: us-east-1 - access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} - secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} - name: Destroy platform VPC working-directory: terraform/platform + env: + AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: us-east-1 run: | terraform init -input=false -lock=false terraform destroy -auto-approve -lock=false \ No newline at end of file