363e1ab775
In the past we had connecitivity issues on Saucelabs. Browsers on mobile devices were not able to properly resolve the `localhost` hostname through the tunnel. This is because the device resolves `localhost` or `127.0.0.1` to the actual Saucelabs device, while it should resolve to the tunnel host machine (in our case the CircleCI VM). In the past, we simply disabled the failing devices and re-enabled the devices later. At this point, the Saucelabs team claimed that the connecitivy/proxy issues were fixed. Saucelabs seems to have a process for VMs which ensures that requests to `localhost` / `127.0.0.1` are properly resolved through the tunnel. This process is not very reliable and can cause tests to fail. Related issues have been observed/mentioned in the Saucelabs support docs. e.g. https://support.saucelabs.com/hc/en-us/articles/115002212447-Unable-to-Reach-Application-on-localhost-for-Tests-Run-on-Safari-8-and-9-and-Edge https://support.saucelabs.com/hc/en-us/articles/225106887-Safari-and-Internet-Explorer-Won-t-Load-Website-When-Using-Sauce-Connect-on-Localhost In order to ensure that requests are always resolved through the tunnel, we add our own domain alias in the CircleCI's hosts file, and enforce that it is always resolved through the tunnel (using the `--tunnel-domains` SC flag). Saucelabs devices by default will never resolve this domain/hostname to the actual local Saucelabs device. PR Close #35171
Encryption
Based on https://github.com/circleci/encrypted-files
In the CircleCI web UI, we have a secret variable called KEY
https://circleci.com/gh/angular/angular/edit#env-vars
which is only exposed to non-fork builds
(see "Pass secrets to builds from forked pull requests" under
https://circleci.com/gh/angular/angular/edit#advanced-settings)
We use this as a symmetric AES encryption key to encrypt tokens like a GitHub token that enables publishing snapshots.
To create the github_token file, we take this approach:
- Find the angular-builds:token in http://valentine
- Go inside the CircleCI default docker image so you use the same version of openssl as we will at runtime:
docker run --rm -it circleci/node:10.12 - echo "https://[token]:@github.com" > credentials
- openssl aes-256-cbc -e -in credentials -out .circleci/github_token -k $KEY
- If needed, base64-encode the result so you can copy-paste it out of docker:
base64 github_token