Skip to content

ci: install baton via get-baton action #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
luisina-santos merged 2 commits into from
Aug 27, 2026
Merged

ci: install baton via get-baton action #52

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b15aec8
ci: install baton via get-baton action instead of conductorone/baton …
luisina-santos Aug 27, 2026
580e302
ci: drop explanatory comment on baton install step
luisina-santos Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 6 additions & 12 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,17 +127,11 @@ jobs:
- name: Build baton-ipa
run: go build ./cmd/baton-ipa

# scripts/get-baton.sh resolves the release through an unauthenticated API
# call, which is rate limited on shared runner IPs. Use the workflow token.
- name: Install baton
env:
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
gh release download --repo ConductorOne/baton \
--pattern 'baton-*-linux-amd64.tar.gz' --output baton.tar.gz --clobber
tar xzf baton.tar.gz
./baton --version
uses: ConductorOne/github-workflows/actions/get-baton@v4

@github-actions github-actions Bot Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Suggestion: This commit drops the comment explaining why the get-baton action replaced the conductorone/baton release download (that CLI trails baton-sdk and fails with c1z: invalid file on this connector's output). Without it, the next person hitting a baton install problem in CI has no signal against swapping back to scripts/get-baton.sh, which still downloads that same incompatible release. Consider keeping a one-line version of the rationale here.


- name: Check baton version
run: baton --version

# CXP-842 regression guard. Every assertion below is a grant or
# entitlement the connector can only produce by resolving an LDAP DN from
Expand All @@ -159,7 +153,7 @@ jobs:

assert_grant() {
local entitlement="$1" principal="$2"
if ! ./baton grants --file=sync.c1z --entitlement="$entitlement" --output-format=json \
if ! baton grants --file=sync.c1z --entitlement="$entitlement" --output-format=json \
| jq --exit-status --arg p "$principal" \
'any(.grants[]?; .principal.id.resource == $p)' >/dev/null; then
echo "::error::no grant of '$entitlement' to '$principal'"
Expand All @@ -170,7 +164,7 @@ jobs:

assert_entitlement() {
local entitlement="$1"
if ! ./baton entitlements --file=sync.c1z --output-format=json \
if ! baton entitlements --file=sync.c1z --output-format=json \
| jq --exit-status --arg id "$entitlement" \
'any(.entitlements[]?; .entitlement.id == $id)' >/dev/null; then
echo "::error::entitlement '$entitlement' was not synced"
Expand Down
Loading