Commit 8233f8ef authored by Stephanos Ioannidis's avatar Stephanos Ioannidis
Browse files

ci: Use organisation-level AWS secrets 

This commit updates the CI workflows to use the `zephyrproject-rtos`
organisation-level AWS secrets instead of the repository-level secrets.

Using organisation-level secrets allows more centralised management of
the access keys used throughout the GitHub Actions CI infrastructure.

Note that the `AWS_*_ACCESS_KEY_ID` is now stored in plaintext as a
variable instead of a secret because it is equivalent to username and
needs to be identifiable for management and audit purposes.

Signed-off-by: default avatarStephanos Ioannidis <root@stephanos.io>
parent cc558a3c

.github/workflows/bug_snapshot.yaml

+1 −1
Changes for .github/workflows/bug_snapshot.yaml: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -44,7 +44,7 @@ jobs: 
    - name: Configure AWS Credentials

      uses: aws-actions/configure-aws-credentials@v2

      with:

        aws-access-key-id: ${{ secrets.AWS_BUILDS_ZEPHYR_BUG_SNAPSHOT_ACCESS_KEY_ID }}

        aws-access-key-id: ${{ vars.AWS_BUILDS_ZEPHYR_BUG_SNAPSHOT_ACCESS_KEY_ID }}

        aws-secret-access-key: ${{ secrets.AWS_BUILDS_ZEPHYR_BUG_SNAPSHOT_SECRET_ACCESS_KEY }}

        aws-region: us-east-1

.github/workflows/clang.yaml

+2 −2
Changes for .github/workflows/clang.yaml: 2 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -88,8 +88,8 @@ jobs: 
          key: ${{ steps.ccache_cache_timestamp.outputs.repo }}-${{ github.ref_name }}-clang-${{ matrix.platform }}-ccache

          path: /github/home/.ccache

          aws-s3-bucket: ccache.zephyrproject.org

          aws-access-key-id: ${{ secrets.CCACHE_S3_ACCESS_KEY_ID }}

          aws-secret-access-key: ${{ secrets.CCACHE_S3_SECRET_ACCESS_KEY }}

          aws-access-key-id: ${{ vars.AWS_CCACHE_ACCESS_KEY_ID }}

          aws-secret-access-key: ${{ secrets.AWS_CCACHE_SECRET_ACCESS_KEY }}

          aws-region: us-east-2



      - name: ccache stats initial

.github/workflows/codecov.yaml

+2 −2
Changes for .github/workflows/codecov.yaml: 2 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -72,8 +72,8 @@ jobs: 
          key: ${{ steps.ccache_cache_prop.outputs.repo }}-${{github.event_name}}-${{matrix.platform}}-codecov-ccache

          path: /github/home/.ccache

          aws-s3-bucket: ccache.zephyrproject.org

          aws-access-key-id: ${{ secrets.CCACHE_S3_ACCESS_KEY_ID }}

          aws-secret-access-key: ${{ secrets.CCACHE_S3_SECRET_ACCESS_KEY }}

          aws-access-key-id: ${{ vars.AWS_CCACHE_ACCESS_KEY_ID }}

          aws-secret-access-key: ${{ secrets.AWS_CCACHE_SECRET_ACCESS_KEY }}

          aws-region: us-east-2



      - name: ccache stats initial

.github/workflows/daily_test_version.yml

+2 −2
Changes for .github/workflows/daily_test_version.yml: 2 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -19,8 +19,8 @@ jobs: 
    - name: Configure AWS Credentials

      uses: aws-actions/configure-aws-credentials@v2

      with:

        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_TESTING }}

        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_TESTING }}

        aws-access-key-id: ${{ vars.AWS_TESTING_ACCESS_KEY_ID }}

        aws-secret-access-key: ${{ secrets.AWS_TESTING_SECRET_ACCESS_KEY }}

        aws-region: us-east-1



    - name: install-pip

.github/workflows/doc-publish-pr.yml

+1 −1
Changes for .github/workflows/doc-publish-pr.yml: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -50,7 +50,7 @@ jobs: 
    - name: Configure AWS Credentials

      uses: aws-actions/configure-aws-credentials@v2

      with:

        aws-access-key-id: ${{ secrets.AWS_BUILDS_ZEPHYR_PR_ACCESS_KEY_ID }}

        aws-access-key-id: ${{ vars.AWS_BUILDS_ZEPHYR_PR_ACCESS_KEY_ID }}

        aws-secret-access-key: ${{ secrets.AWS_BUILDS_ZEPHYR_PR_SECRET_ACCESS_KEY }}

        aws-region: us-east-1

CRA Git | Maintained and supported by SUSTech CRA and CCSE