search

ProjectPythia / cookbook-actions

Reusable workflows used by Project Pythia Cookbooks
Apache License 2.0
2 stars 7 forks source link

ADD: Add new fields for AQ cookbook data portals #116

Closed mgrover1 closed 5 months ago

mgrover1 commented 5 months ago

Add in new fields required for AQS and NASA Earthdata environment variables

mgrover1 commented 5 months ago

@brian-rose - this adds new environment variables required for the air quality cookbook. Can you please review + merge here? So we can test downstream to ensure the secrets are passed properly in the build?

mgrover1 commented 5 months ago

@ktyle feel free to take a look as well!

ktyle commented 5 months ago

@mgrover1 this looks good but I'm a bit ignorant of how secrets should work in our workflows and actions. To test things, I created a fork of cookbook-actions based on your branch, and then added the AQS_USERNAME and AQS_KEY as secrets (using the email address and key that I received from the AQS site), based on https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions. I then forked the api-cookbook and created a PR (ktyle/api-cookbook#1) whose trigger-book-build action points to my fork of cookbook-actions. However, the build failed and it didn't seem like these two secrets were applied.

Additionally, in our ProjectPythia/cookbook-actions repo, I don't see any secrets set.

What might I be missing?

brian-rose commented 5 months ago

As far as I understand things, @ktyle's build failure should be expected because builds triggered by a PR from a different org (in this case, an individual user) won't have access to secrets set in the upstream repository.

brian-rose commented 5 months ago

I will merge so @mgrover1 can test functionality! We can go back and fix things as necessary.

There's a clear need for a more modular system for declaring secrets so we don't have to specify every possibility in these reusable workflow. But we're not there yet.

AMDeitsch commented 5 months ago

As far as I understand things, @ktyle's build failure should be expected because builds triggered by a PR from a different org (in this case, an individual user) won't have access to secrets set in the upstream repository.

Would this be the same issue with PR builds failing when sent from my fork to the Project Pythia cookbook? As far as I can tell, my builds are still failing when I push commits to my fork (and when PRs are initiated to the main repository).

brian-rose commented 5 months ago

@AMDeitsch Probably not, unless you are working with a cookbook that uses secrets for data access. Which cookbook repository are you opening PRs to?

AMDeitsch commented 5 months ago

Thanks, @brian-rose . It looks like @mgrover1 got the issue resolved in subsequent PRs.