refactor: remove secrets file in place of using new gh secrets

.github/composite/setup/action.yaml

@@ -18,18 +18,22 @@ inputs:
   AZURE_SUBSCRIPTION_ID:
     description: "Azure subscription ID if azure authentication is required."
     required: false
+  SECRETS:
+    description: "secrets passed in as JSON."
+    required: false
 
 runs:
   using: "composite"
   steps:
     - name: Setup
-      uses: tahminator/pipeline/actions/setup@1.0.46
+      uses: tahminator/pipeline/actions/setup@1.0.65
       with:
         AZURE_CLIENT_ID: ${{ inputs.AZURE_CLIENT_ID }}
         AZURE_CLIENT_SECRET: ${{ inputs.AZURE_CLIENT_SECRET }}
         AZURE_TENANT_ID: ${{ inputs.AZURE_TENANT_ID }}
         AZURE_SUBSCRIPTION_ID: ${{ inputs.AZURE_SUBSCRIPTION_ID }}
         INSTALL_SOPS: true
+        SECRETS: ${{ inputs.SECRETS }}
 
     - name: Test CI scripts
       shell: bash

.github/scripts/package.json

@@ -17,7 +17,7 @@
   "license": "MIT",
   "dependencies": {
     "@octokit/rest": "^22.0.1",
-    "@tahminator/pipeline": "^1.0.23",
+    "@tahminator/pipeline": "^1.0.65",
     "@types/yargs": "^17.0.35",
     "bun": "^1.3.6",
     "octokit": "^5.0.5",

.github/scripts/src/build-images/index.ts

@@ -1,12 +1,9 @@
-import {
-  DockerClient,
-  EnvClient,
-  EnvClientStrategy,
-  Utils,
-} from "@tahminator/pipeline";
+import { DockerClient, Utils } from "@tahminator/pipeline";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
+const { required } = Utils;
+
 const { ver, shouldUpload } = await yargs(hideBin(process.argv))
   .option("ver", {
     type: "string",
@@ -23,10 +20,7 @@ const { ver, shouldUpload } = await yargs(hideBin(process.argv))
 const targets = ["pg-az"] as const;
 
 export async function main() {
-  const envClient = EnvClient.create(EnvClientStrategy.SOPS);
-  const { dockerHubPat, dockerHubUsername } = parseCiEnv(
-    await envClient.readFromEnv("secrets.yaml"),
-  );
+  const { dockerHubPat, dockerHubUsername } = parseCiEnv();
   await using dockerClient = await DockerClient.create(
     dockerHubUsername,
     dockerHubPat,
@@ -45,22 +39,10 @@ export async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
-  const dockerHubPat = (() => {
-    const v = ciEnv["DOCKER_HUB_PAT"];
-    if (!v) {
-      throw new Error("Missing DOCKER_HUB_PAT from .env.ci");
-    }
-    return v;
-  })();
+function parseCiEnv() {
+  const dockerHubPat = required(process.env["DOCKER_HUB_PAT"]);
 
-  const dockerHubUsername = (() => {
-    const v = ciEnv["DOCKER_HUB_USERNAME"];
-    if (!v) {
-      throw new Error("Missing DOCKER_HUB_USERNAME from .env.ci");
-    }
-    return v;
-  })();
+  const dockerHubUsername = required(process.env["DOCKER_HUB_USERNAME"]);
 
   return { dockerHubPat, dockerHubUsername };
 }

.github/scripts/src/create-tag/index.ts

@@ -1,52 +1,40 @@
 import {
-  EnvClient,
-  EnvClientStrategy,
   GitHubClient,
   Utils,
+  VersioningClient,
+  VersionUpdatingStrategy,
 } from "@tahminator/pipeline";
 
+const { required } = Utils;
+
 export async function main() {
-  const envClient = EnvClient.create(EnvClientStrategy.SOPS);
   const { githubAppAppId, githubAppInstallationId, githubAppPrivateKey } =
-    parseCiEnv(await envClient.readFromEnv("secrets.yaml"));
+    parseCiEnv();
 
   const ghClient = await GitHubClient.createWithGithubAppToken({
     appId: githubAppAppId,
     installationId: githubAppInstallationId,
     privateKey: githubAppPrivateKey,
   });
 
+  const versioningClient = new VersioningClient(
+    ghClient,
+    VersionUpdatingStrategy.NONE,
+  );
+
   await ghClient.createTag({
-    onPreTagCreate: async (tag) => {
-      await Utils.updateAllPackageJsonsWithVersion(tag);
-    },
+    nextTag: await versioningClient.next(),
   });
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
-  const githubAppAppId = (() => {
-    const v = ciEnv["GITHUB_APP_APP_ID"];
-    if (!v) {
-      throw new Error("Missing GITHUB_APP_APP_ID from .env.ci");
-    }
-    return v;
-  })();
-
-  const githubAppInstallationId = (() => {
-    const v = ciEnv["GITHUB_APP_INSTALLATION_ID"];
-    if (!v) {
-      throw new Error("Missing GITHUB_APP_INSTALLATION_ID from .env.ci");
-    }
-    return v;
-  })();
-
-  const githubAppPrivateKey = (() => {
-    const v = ciEnv["GITHUB_APP_PEM_CONTENT"];
-    if (!v) {
-      throw new Error("Missing GITHUB_APP_PRIVATE_KEY from .env.ci");
-    }
-    return v;
-  })();
+function parseCiEnv() {
+  const githubAppAppId = required(process.env["_GITHUB_APP_APP_ID"]);
+
+  const githubAppInstallationId = required(
+    process.env["_GITHUB_APP_INSTALLATION_ID"],
+  );
+
+  const githubAppPrivateKey = required(process.env["_GITHUB_APP_PEM_CONTENT"]);
 
   return { githubAppAppId, githubAppInstallationId, githubAppPrivateKey };
 }

.github/workflows/ci.yaml

@@ -27,10 +27,7 @@ jobs:
       - name: Setup pipeline
         uses: ./.github/composite/setup
         with:
-          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
-          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-          AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          SECRETS: ${{ toJSON(secrets) }}
 
       - name: Build images
         uses: ./.github/composite/build-images
@@ -55,10 +52,7 @@ jobs:
       - name: Setup pipeline
         uses: ./.github/composite/setup
         with:
-          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
-          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-          AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          SECRETS: ${{ toJSON(secrets) }}
 
       - name: Create new tag
         uses: ./.github/composite/create-tag

Justfile

@@ -1,17 +1,11 @@
-e file *args:
-  just install-pre-scripts && sops --encrypt --in-place {{ file }} {{ args }}
-
-d file *args:
-  just install-pre-scripts && sops --decrypt --in-place {{ file }} {{ args }}
-
 build-pg-az:
-  just install-pre-scripts && docker build --platform linux/amd64 -t Patina-Network/pg-az -f src/pg-az/Dockerfile .
+    docker build --platform linux/amd64 -t Patina-Network/pg-az -f src/pg-az/Dockerfile .
 
 install-pre-scripts:
-  just install-pre-commit && just install-pre-push
+    just install-pre-commit && just install-pre-push
 
 install-pre-commit:
-  cp pre-commit .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
+    cp pre-commit .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
 
 install-pre-push:
-  cp pre-commit .git/hooks/pre-push && chmod +x .git/hooks/pre-push
+    cp pre-commit .git/hooks/pre-push && chmod +x .git/hooks/pre-push