Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit d873159

Browse files
Merge pull request #815 from arduino/iam-roles
github: Use IAM Roles to push files on AWS S3
2 parents d3d2d59 + 337a07e commit d873159

File tree

2 files changed

+24
-17
lines changed

2 files changed

+24
-17
lines changed

‎.github/workflows/publish-go-nightly-task.yml‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ env:
88
DIST_DIR: dist
99
# The project's folder on Arduino's download server for uploading builds
1010
AWS_PLUGIN_TARGET: /arduino-lint/
11+
AWS_REGION: "us-east-1"
1112
ARTIFACT_PREFIX: dist-
1213

1314
# See: https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows
@@ -183,8 +184,11 @@ jobs:
183184

184185
publish-nightly:
185186
runs-on: ubuntu-latest
187+
environment: production
186188
needs: notarize-macos
187-
permissions: {}
189+
permissions:
190+
contents: write
191+
id-token: write # This is required for requesting the JWT
188192

189193
steps:
190194
- name: Download artifact
@@ -200,15 +204,15 @@ jobs:
200204
TAG="nightly-$(date -u +"%Y%m%d")"
201205
sha256sum ${{ env.PROJECT_NAME }}_${TAG}* > ${TAG}-checksums.txt
202206
207+
- name: configure aws credentials
208+
uses: aws-actions/configure-aws-credentials@v4
209+
with:
210+
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
211+
role-session-name: "github_${{ env.PROJECT_NAME }}"
212+
aws-region: ${{ env.AWS_REGION }}
213+
203214
- name: Upload release files on Arduino downloads servers
204-
uses: docker://plugins/s3
205-
env:
206-
PLUGIN_SOURCE: "${{ env.DIST_DIR }}/*"
207-
PLUGIN_TARGET: "${{ env.AWS_PLUGIN_TARGET }}nightly"
208-
PLUGIN_STRIP_PREFIX: "${{ env.DIST_DIR }}/"
209-
PLUGIN_BUCKET: ${{ secrets.DOWNLOADS_BUCKET }}
210-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
211-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
215+
run: aws s3 sync ${{ env.DIST_DIR }} s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.AWS_PLUGIN_TARGET }}nightly
212216

213217
report:
214218
runs-on: ubuntu-latest

‎.github/workflows/release-go-task.yml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ env:
88
DIST_DIR: dist
99
# The project's folder on Arduino's download server for uploading builds
1010
AWS_PLUGIN_TARGET: /arduino-lint/
11+
AWS_REGION: "us-east-1"
1112
ARTIFACT_PREFIX: dist-
1213

1314
on:
@@ -189,9 +190,11 @@ jobs:
189190

190191
create-release:
191192
runs-on: ubuntu-latest
193+
environment: production
192194
needs: notarize-macos
193195
permissions:
194196
contents: write
197+
id-token: write # This is required for requesting the JWT
195198

196199
steps:
197200
- name: Download artifact
@@ -235,12 +238,12 @@ jobs:
235238
# (all the files we need are in the DIST_DIR root)
236239
artifacts: ${{ env.DIST_DIR }}/*
237240

241+
- name: configure aws credentials
242+
uses: aws-actions/configure-aws-credentials@v4
243+
with:
244+
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
245+
role-session-name: "github_${{ env.PROJECT_NAME }}"
246+
aws-region: ${{ env.AWS_REGION }}
247+
238248
- name: Upload release files on Arduino downloads servers
239-
uses: docker://plugins/s3
240-
env:
241-
PLUGIN_SOURCE: "${{ env.DIST_DIR }}/*"
242-
PLUGIN_TARGET: ${{ env.AWS_PLUGIN_TARGET }}
243-
PLUGIN_STRIP_PREFIX: "${{ env.DIST_DIR }}/"
244-
PLUGIN_BUCKET: ${{ secrets.DOWNLOADS_BUCKET }}
245-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
246-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
249+
run: aws s3 sync ${{ env.DIST_DIR }} s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.AWS_PLUGIN_TARGET }}

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /