Simplify actions/lp-snap-build to be reusable
#14601
Conversation
simondeziel
force-pushed
the
lp-snap-action
branch
from
4e10faa to
df5f551
Compare
simondeziel
changed the title
actions/lp-snap-build to be reusableactions/lp-snap-build to be reusable
simondeziel
force-pushed
the
lp-snap-action
branch
from
df5f551 to
a4d1a2c
Compare
tomponline
left a comment
tomponline
left a comment
There was a problem hiding this comment.
Does passing the secret to the action cause it to be logged somewhere as the input to the actions?
Since this is the official recommended way, I hope not. From what I've read, we should see this obfuscated with |
Can you check on your own fork with a test secret in a workflow and double check, as dont want that ssh key published. |
simondeziel
force-pushed
the
lp-snap-action
branch
from
2392f70 to
8b4ed46
Compare
|
Proper obfuscation happens (https://github.com/simondeziel/lxd/actions/runs/12243790782/job/34154120501) so the GH doc is accurate. |
simondeziel
force-pushed
the
lp-snap-action
branch
from
8b4ed46 to
1432be7
Compare
Signed-off-by: Simon Deziel <[email protected]>
Signed-off-by: Simon Deziel <[email protected]>
simondeziel
force-pushed
the
lp-snap-action
branch
from
1432be7 to
ce24b8d
Compare
|
@tomponline PTAL |
tomponline
left a comment
tomponline
left a comment
There was a problem hiding this comment.
What was the reason we cant move the call to lxd-snapscraft and the commit, push etc into the action as well?
2 participants
I had not properly looked at all the possible variation of the
Trigger Launchpad snap buildstep that all our repos and branches have. This step being repo/branch specific, it's hard to push it to a generic action.As such, go back a little and keep the actual build trigger and some git interaction parts out of the action.
This also changes how the action gets access to the private SSH key as actions don't have access to the
secretscontext as seen in https://github.com/canonical/lxd/actions/runs/12201759238/job/34050919117