lux/explore
2
0
Fork 0
mirror of https://github.com/luxfi/explore.git synced 2026-09-24 00:28:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci(explore): KMS credential step must not abort under set -e

Browse Source 
The KMS login (curl -sf | jq) had no failure guard, so under Actions' default
bash -eo pipefail a failed KMS login aborted the step before the
DIGITALOCEAN_ACCESS_TOKEN fallback ran (deploy failed instead of falling back).
Swallow curl/jq errors so the fallback path executes.

Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
zeekay
2026-07-14 08:02:47 -07:00
co-authored by Hanzo Dev
parent dcf0d9a048
commit df378dd0d2
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-lux.yml
+3 -1
View File
@@ -107,9 +107,11 @@ jobs:
DO_FALLBACK_TOKEN: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
run: |
if [ -n "${KMS_CLIENT_ID}" ] && [ -n "${KMS_CLIENT_SECRET}" ]; then
# Must not abort the step under `bash -eo pipefail` when KMS login
# fails — swallow curl/jq errors so the DO_FALLBACK_TOKEN path runs.
HANZO_API_KEY=$(curl -sf "${KMS_ENDPOINT}/api/v1/auth/universal-auth/login" \
-H "Content-Type: application/json" \
-d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}" | jq -r '.accessToken')
-d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}" 2>/dev/null | jq -r '.accessToken' 2>/dev/null || echo "")
fi
response=$(curl -sf "${KMS_ENDPOINT}/api/v3/secrets/raw?workspaceId=e1359bf4-31b4-4dfa-bb90-323e2c298ad8&secretPath=/deploy&environment=prod" \
-H "Authorization: Bearer ${HANZO_API_KEY}" 2>/dev/null || echo "")