c53bae839d
As part of the `setup` CI job (which is a prerequisite for all other CI jobs), we rebase the current code on master to make sure the PR changes are compatible with the latest code from master, even if the PR has not been rebased recently. When it is not possible to automatically rebase (i.e. when there are conflicts that need to be resolved manually), the job and subsequently the entire workflow should fail. This behavior has been accidentally broken in #39592, so that the job would succeed even if the rebase operation failed. This commit fixes it by ensuring the `exec()` helper used in `rebase-pr.js` will throw an error if the underlying command execution fails. Previously, the function would always return stdout output as a string and attach a `code` property indicating the exit code of the command. Since the exit code isn't necessary in the `rebase-pr.js` script, this commit simplifies the `exec()` helper by making it return the stdout output as a plain string (without extra properties) and re-throw any errors (unless the `ignoreError` argument is set to `true`). (Initially reported [here][1] by @JoostK.) [1]: https://angular-team.slack.com/archives/C042EU9T5/p1608070403128900 PR Close #40161 |
||
|---|---|---|
| .. | ||
| README.md | ||
| bazel.common.rc | ||
| bazel.linux.rc | ||
| bazel.windows.rc | ||
| config.yml | ||
| env-helpers.inc.sh | ||
| env.sh | ||
| gcp_token | ||
| github_token | ||
| rebase-pr.js | ||
| setup_cache.sh | ||
| trigger-webhook.js | ||
| windows-env.ps1 | ||
README.md
Encryption
Based on https://github.com/circleci/encrypted-files
In the CircleCI web UI, we have a secret variable called KEY
https://circleci.com/gh/angular/angular/edit#env-vars
which is only exposed to non-fork builds
(see "Pass secrets to builds from forked pull requests" under
https://circleci.com/gh/angular/angular/edit#advanced-settings)
We use this as a symmetric AES encryption key to encrypt tokens like a GitHub token that enables publishing snapshots.
To create the github_token file, we take this approach:
- Find the angular-builds:token in the internal pw database
- Go inside the CircleCI default docker image so you use the same version of openssl as we will at runtime:
docker run --rm -it circleci/node:10.12 - echo "https://[token]:@github.com" > credentials
- openssl aes-256-cbc -e -in credentials -out .circleci/github_token -k $KEY
- If needed, base64-encode the result so you can copy-paste it out of docker:
base64 github_token