mirror of
https://github.com/hanzoai/extension.git
synced 2026-10-31 21:57:06 +00:00
zeekay
0d7c3c4e57
The publish lane reads VSCE_PAT and OVSX_PAT from KMS at hanzo:/extension-publish and sends the .vsix make check packaged to each store whose public API lacks the version. A store without its token is a notice, so the lane stays green until the owner seeds them; the steps are in packages/vscode/LLM.md.
75 lines
3.3 KiB
YAML
75 lines
3.3 KiB
YAML
# Store-publish credentials for the Hanzo browser extension β KMS is the ONLY home.
|
|
#
|
|
# The publish pipeline (.github/workflows/publish.yml, on the linux-amd64
|
|
# runners) reads these at publish time. No store credential lives in an Actions
|
|
# secret β the ONLY bootstrap credential is the KMS machine identity
|
|
# (KMS_CLIENT_ID / KMS_CLIENT_SECRET), already provisioned.
|
|
#
|
|
# ββ Operator steps (the VALUES are the store-account owner's; not in git) ββ
|
|
# 1. KMS (kms.hanzo.ai) β org `hanzo`, env `prod`, project path `/extension-publish`.
|
|
# Add the keys below. These are the Chrome Web Store, Firefox AMO, VS Code
|
|
# Marketplace and Open VSX credentials β the store-account owner drops the
|
|
# real values here:
|
|
# CHROME_EXTENSION_ID Chrome Web Store item id
|
|
# CHROME_CLIENT_ID Google OAuth client id (CWS API)
|
|
# CHROME_CLIENT_SECRET Google OAuth client secret
|
|
# CHROME_REFRESH_TOKEN Google OAuth refresh token
|
|
# AMO_API_KEY addons.mozilla.org JWT issuer
|
|
# AMO_API_SECRET addons.mozilla.org JWT secret
|
|
# VSCE_PAT Azure DevOps PAT, Marketplace (Manage), publisher hanzo-ai
|
|
# OVSX_PAT open-vsx.org access token, namespace hanzo-ai
|
|
# Optional (same path, if these stores are moved off GitHub too):
|
|
# JETBRAINS_TOKEN NPM_TOKEN
|
|
# hanzo --as hanzo kms secrets create --env prod --path /extension-publish \
|
|
# --name CHROME_EXTENSION_ID --value '<value>' # β¦repeat per key
|
|
# packages/vscode/LLM.md has the owner's steps for VSCE_PAT and OVSX_PAT.
|
|
# 2. Grant the extension repo's KMS machine identity (the KMS_CLIENT_ID it
|
|
# already uses) READ on project `hanzo`, path `/extension-publish`.
|
|
# 3. Re-provision KMS_CLIENT_ID / KMS_CLIENT_SECRET as git.hanzo.ai Actions
|
|
# secrets so the native runner can log in (they exist on GitHub today β
|
|
# runners-act-migration.md Phase 1.2).
|
|
#
|
|
# Canonical GitOps home is universe/infra/k8s/kms-canonical-crs/hanzo/ (generated
|
|
# by scripts/kms-canonical-v1alpha1-gen.py). This in-repo copy is the extension's
|
|
# declared secret contract β reflect it into universe, do not diverge.
|
|
---
|
|
apiVersion: secrets.lux.network/v1alpha1
|
|
kind: KMSSecret
|
|
metadata:
|
|
name: extension-publish-kms-sync
|
|
namespace: hanzo
|
|
labels:
|
|
app.kubernetes.io/name: extension
|
|
app.kubernetes.io/component: kms-secret
|
|
app.kubernetes.io/part-of: hanzo-universe
|
|
kms.hanzo.ai/org: hanzo
|
|
kms.hanzo.ai/env: prod
|
|
spec:
|
|
hostAPI: http://kms.hanzo.svc
|
|
resyncInterval: 60
|
|
authentication:
|
|
universalAuth:
|
|
# Shared platform machine identity (same as the other hanzo CRs). The
|
|
# operator scopes it to read /extension-publish.
|
|
credentialsRef:
|
|
secretName: hanzo-platform-iam-creds
|
|
secretNamespace: hanzo
|
|
secretsScope:
|
|
projectSlug: hanzo
|
|
envSlug: prod
|
|
secretsPath: /extension-publish
|
|
keys:
|
|
- CHROME_EXTENSION_ID
|
|
- CHROME_CLIENT_ID
|
|
- CHROME_CLIENT_SECRET
|
|
- CHROME_REFRESH_TOKEN
|
|
- AMO_API_KEY
|
|
- AMO_API_SECRET
|
|
- VSCE_PAT
|
|
- OVSX_PAT
|
|
managedSecretReference:
|
|
secretName: extension-publish-secrets
|
|
secretNamespace: hanzo
|
|
secretType: Opaque
|
|
creationPolicy: Orphan
|