Repository navigation
feat(arc): let the App setup write the App Secret and remove the key - #14
Merged
Merged
Conversation
With github_runner_arc_app_setup_write_secret, phase 2 of playbooks/github_app_setup.yml writes github_app_id, github_app_installation_id and github_app_private_key into the App Secret once the App is installed, then removes the key file unless github_runner_arc_app_setup_keep_private_key keeps it. The Secret goes into github_runner_arc_app_setup_secret_namespaces under github_runner_arc_app_setup_secret_name, or by default into the organisation's profile namespaces under its app_secret_name. The cluster is reached and the namespaces created before the one-time code is used. github_runner_arc_app_setup_command names the phase 2 command in the form and in phase 1's instructions, so a playbook wrapping the flow names itself. The code exchange is now no_log, since its response holds the private key that -v used to print; GitHub's error is reported by a separate task instead.
Mearman
marked this pull request as ready for review
September 26, 2026 03:34
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
🎉 This PR is included in version 1.2.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #11
With
github_runner_arc_app_setup_write_secret: true, the second run ofplaybooks/github_app_setup.ymlwrites the App Secret once the App is installed. The Secret has the three keys the role's install reads,github_app_id,github_app_installation_idandgithub_app_private_key. After writing it, the run deletes the key file unlessgithub_runner_arc_app_setup_keep_private_keyis set. The Secret goes intogithub_runner_arc_app_setup_secret_namespacesundergithub_runner_arc_app_setup_secret_name. When those aren't set, it goes into the namespaces of the organisation's scale-set profiles ingithub_runner_arc_orgs, under itsapp_secret_name(<org>-github-appby default), matching what the install expects. The run reaches the cluster throughgithub_runner_arc_kubeconfig_pathand creates those namespaces before it uses the one-time code, so a broken cluster path only costs a rerun. If the run stops before the Secret is written, for example because nobody installed the App in time, the key file is left so the App can still be finished without a new code.github_runner_arc_app_setup_commandis the phase 2 command shown in the rendered form and in phase 1's instructions. The role adds the code and key path to it. By default it's the same command as before. A playbook that wraps the flow sets it to its own command, so the form tells the person to run the wrapper and not the collection's playbook. The README has an example wrapper.It never prints the private key now. The code exchange wasn't
no_log, so its error would be visible, but that meant-vprinted the key from the successful response. The exchange is nowno_log, and a separate task reports GitHub's status and message when the exchange fails.Nothing changes by default: writing the Secret is off, and the default command renders the same form as before.
tests/unit/test_app_setup.pyruns phase 1 of the real playbook (no GitHub or cluster involved) and checks the default form text, a wrapper's command in the form and the instructions, the keep-key wording, where the Secret would go (explicit namespaces, or the org's profiles), and that asking to write the Secret with nowhere to put it fails in phase 1. Phase 2 can't run without a real manifest code, so the Secret write and key removal aren't exercised by a test. They use the samekubernetes.core.k8sandfiletasks the rest of the role uses.arc.yml --check --diffagainst a fleet gave the same task list and result as v1.1.0.