295889ed2e
Previously, the fallback key used for the CircleCI cache could match a cache indefinitely (as long as `.bazelversion` didn't change). This would allow the cache to grow quite large, which in turn would lead to slow-down in CI jobs. See, also, angular/angular-cli#17533 for more details of the impact of a growing CircleCI cache. Unfortunately, using something like the lockfile checksum in the fallback cache key would cause too many cache misses (esp. with automatic updates via Renovate), again slowing CI down. (The problem was originally discussed [here][2].) This commit uses the technique described in [this blogpost][1] to invalidate the cache monthly. This keeps the extra cache misses low (essentially once per month per fork), while also preventing the cache from growing indefinitely. [1]: https://support.circleci.com/hc/en-us/articles/360012618473-Creating-a-daily-cache [2]: https://github.com/angular/angular/pull/41467#discussion_r607818494 PR Close #41814 |
||
|---|---|---|
| .. | ||
| README.md | ||
| bazel.common.rc | ||
| bazel.linux.rc | ||
| bazel.windows.rc | ||
| config.yml | ||
| env-helpers.inc.sh | ||
| env.sh | ||
| gcp_token | ||
| github_token | ||
| rebase-pr.js | ||
| setup_cache.sh | ||
| trigger-webhook.js | ||
| windows-env.ps1 | ||
README.md
Encryption
Based on https://github.com/circleci/encrypted-files
In the CircleCI web UI, we have a secret variable called KEY
https://circleci.com/gh/angular/angular/edit#env-vars
which is only exposed to non-fork builds
(see "Pass secrets to builds from forked pull requests" under
https://circleci.com/gh/angular/angular/edit#advanced-settings)
We use this as a symmetric AES encryption key to encrypt tokens like a GitHub token that enables publishing snapshots.
To create the github_token file, we take this approach:
- Find the angular-builds:token in the internal pw database
- Go inside the CircleCI default docker image so you use the same version of openssl as we will at runtime:
docker run --rm -it circleci/node:10.12 - echo "https://[token]:@github.com" > credentials
- openssl aes-256-cbc -e -in credentials -out .circleci/github_token -k $KEY
- If needed, base64-encode the result so you can copy-paste it out of docker:
base64 github_token