FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

chore: add CI secrets manager (via synth) (#271) · steffnay/python-bigquery@fe54cb7 · GitHub

/ python-bigquery Public
forked from googleapis/python-bigquery

Commit fe54cb7

Browse files
yoshi-automation
authored
chore: add CI secrets manager (via synth) (googleapis#271)
This PR was generated using Autosynth. 🌈 Synth log will be available here: https://source.cloud.google.com/results/invocations/5da1d2aa-a963-44d1-952a-3ed428de6719/targets - [ ] To automatically regenerate this PR, check this box. Source-Link: googleapis/synthtool@27f4406 Source-Link: googleapis/synthtool@dba48bb Source-Link: googleapis/synthtool@257fda1 Source-Link: googleapis/synthtool@ffcee79 Source-Link: googleapis/synthtool@d302f93
1 parent c75e9cd commit fe54cb7

6 files changed

Lines changed: 86 additions & 47 deletions

File tree

‎.kokoro/populate-secrets.sh‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/bin/bash
2+
# Copyright 2020 Google LLC.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
set -eo pipefail
17+
18+
function now { date +"%Y-%m-%d %H:%M:%S" | tr -d '\n' ;}
19+
function msg { println "$*" >&2 ;}
20+
function println { printf '%s\n' "$(now) $*" ;}
21+
22+
23+
# Populates requested secrets set in SECRET_MANAGER_KEYS from service account:
24+
# kokoro-trampoline@cloud-devrel-kokoro-resources.iam.gserviceaccount.com
25+
SECRET_LOCATION="${KOKORO_GFILE_DIR}/secret_manager"
26+
msg "Creating folder on disk for secrets: ${SECRET_LOCATION}"
27+
mkdir -p ${SECRET_LOCATION}
28+
for key in $(echo ${SECRET_MANAGER_KEYS} | sed "s/,/ /g")
29+
do
30+
msg "Retrieving secret ${key}"
31+
docker run --entrypoint=gcloud \
32+
--volume=${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR} \
33+
gcr.io/google.com/cloudsdktool/cloud-sdk \
34+
secrets versions access latest \
35+
--project cloud-devrel-kokoro-resources \
36+
--secret ${key} > \
37+
"${SECRET_LOCATION}/${key}"
38+
if [[ $? == 0 ]]; then
39+
msg "Secret written to ${SECRET_LOCATION}/${key}"
40+
else
41+
msg "Error retrieving secret ${key}"
42+
fi
43+
done

‎.kokoro/release/common.cfg‎

Lines changed: 13 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -23,42 +23,18 @@ env_vars: {
2323
value: "github/python-bigquery/.kokoro/release.sh"
2424
}
2525

26-
# Fetch the token needed for reporting release status to GitHub
27-
before_action {
28-
fetch_keystore {
29-
keystore_resource {
30-
keystore_config_id: 73713
31-
keyname: "yoshi-automation-github-key"
32-
}
33-
}
34-
}
35-
36-
# Fetch PyPI password
37-
before_action {
38-
fetch_keystore {
39-
keystore_resource {
40-
keystore_config_id: 73713
41-
keyname: "google_cloud_pypi_password"
42-
}
43-
}
44-
}
45-
46-
# Fetch magictoken to use with Magic Github Proxy
47-
before_action {
48-
fetch_keystore {
49-
keystore_resource {
50-
keystore_config_id: 73713
51-
keyname: "releasetool-magictoken"
52-
}
53-
}
26+
# Fetch PyPI password
27+
before_action {
28+
fetch_keystore {
29+
keystore_resource {
30+
keystore_config_id: 73713
31+
keyname: "google_cloud_pypi_password"
32+
}
33+
}
5434
}
5535

56-
# Fetch api key to use with Magic Github Proxy
57-
before_action {
58-
fetch_keystore {
59-
keystore_resource {
60-
keystore_config_id: 73713
61-
keyname: "magic-github-proxy-api-key"
62-
}
63-
}
64-
}
36+
# Tokens needed to report release status back to GitHub
37+
env_vars: {
38+
key: "SECRET_MANAGER_KEYS"
39+
value: "releasetool-publish-reporter-app,releasetool-publish-reporter-googleapis-installation,releasetool-publish-reporter-pem"
40+
}

‎.kokoro/trampoline.sh‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,14 @@
1515

1616
set -eo pipefail
1717

18-
python3 "${KOKORO_GFILE_DIR}/trampoline_v1.py" || ret_code=$?
18+
# Always run the cleanup script, regardless of the success of bouncing into
19+
# the container.
20+
function cleanup() {
21+
chmod +x ${KOKORO_GFILE_DIR}/trampoline_cleanup.sh
22+
${KOKORO_GFILE_DIR}/trampoline_cleanup.sh
23+
echo "cleanup";
24+
}
25+
trap cleanup EXIT
1926

20-
chmod +x ${KOKORO_GFILE_DIR}/trampoline_cleanup.sh
21-
${KOKORO_GFILE_DIR}/trampoline_cleanup.sh || true
22-
23-
exit ${ret_code}
27+
$(dirname $0)/populate-secrets.sh # Secret Manager secrets.
28+
python3 "${KOKORO_GFILE_DIR}/trampoline_v1.py"

‎docs/conf.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
# -- General configuration ------------------------------------------------
3030

3131
# If your documentation needs a minimal Sphinx version, state it here.
32-
needs_sphinx = "1.6.3"
32+
needs_sphinx = "1.5.5"
3333

3434
# Add any Sphinx extension module names here, as strings. They can be
3535
# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
@@ -39,6 +39,7 @@
3939
"sphinx.ext.autosummary",
4040
"sphinx.ext.intersphinx",
4141
"sphinx.ext.coverage",
42+
"sphinx.ext.doctest",
4243
"sphinx.ext.napoleon",
4344
"sphinx.ext.todo",
4445
"sphinx.ext.viewcode",

‎scripts/decrypt-secrets.sh‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,27 @@ ROOT=$( dirname "$DIR" )
2020
# Work from the project root.
2121
cd $ROOT
2222

23+
# Prevent it from overriding files.
24+
# We recommend that sample authors use their own service account files and cloud project.
25+
# In that case, they are supposed to prepare these files by themselves.
26+
if [[ -f "testing/test-env.sh" ]] || \
27+
[[ -f "testing/service-account.json" ]] || \
28+
[[ -f "testing/client-secrets.json" ]]; then
29+
echo "One or more target files exist, aborting."
30+
exit 1
31+
fi
32+
2333
# Use SECRET_MANAGER_PROJECT if set, fallback to cloud-devrel-kokoro-resources.
2434
PROJECT_ID="${SECRET_MANAGER_PROJECT:-cloud-devrel-kokoro-resources}"
2535

2636
gcloud secrets versions access latest --secret="python-docs-samples-test-env" \
37+
--project="${PROJECT_ID}" \
2738
> testing/test-env.sh
2839
gcloud secrets versions access latest \
2940
--secret="python-docs-samples-service-account" \
41+
--project="${PROJECT_ID}" \
3042
> testing/service-account.json
3143
gcloud secrets versions access latest \
3244
--secret="python-docs-samples-client-secrets" \
33-
> testing/client-secrets.json
45+
--project="${PROJECT_ID}" \
46+
> testing/client-secrets.json

‎synth.metadata‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
"git": {
55
"name": ".",
66
"remote": "https://github.com/googleapis/python-bigquery.git",
7-
"sha": "a125160696d1453b04a66c967819f90e70e03a52"
7+
"sha": "b716e1c8ecd90142b498b95e7f8830835529cf4a"
88
}
99
},
1010
{
@@ -19,14 +19,14 @@
1919
"git": {
2020
"name": "synthtool",
2121
"remote": "https://github.com/googleapis/synthtool.git",
22-
"sha": "32c758f11b8c578f515a746c9d263b82a615a77c"
22+
"sha": "27f4406999b1eee29e04b09b2423a8e4646c7e24"
2323
}
2424
},
2525
{
2626
"git": {
2727
"name": "synthtool",
2828
"remote": "https://github.com/googleapis/synthtool.git",
29-
"sha": "32c758f11b8c578f515a746c9d263b82a615a77c"
29+
"sha": "27f4406999b1eee29e04b09b2423a8e4646c7e24"
3030
}
3131
}
3232
],
@@ -60,6 +60,7 @@
6060
".kokoro/docs/common.cfg",
6161
".kokoro/docs/docs-presubmit.cfg",
6262
".kokoro/docs/docs.cfg",
63+
".kokoro/populate-secrets.sh",
6364
".kokoro/presubmit/common.cfg",
6465
".kokoro/presubmit/presubmit.cfg",
6566
".kokoro/presubmit/system-2.7.cfg",

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL