search

nrwl / ci

47 stars 51 forks source link

nx-cloud-main: forward secrets/env for commands running parallel #71

Closed muametgrooby closed 1 year ago

muametgrooby commented 1 year ago

Hello, I am using nx-cloud-main and I have a use case where I need to pass a secret into a command running in parallel. It is currently impossible, can we get a way to set internal environment variables from outside or allow nx-cloud-main to use secrets?

I am using @nx-tools/nx-container and they require secrets.GITHUB_TOKEN

kapik commented 1 year ago

Hey 👋 I have the same need but for others env var (like deployment secrets).

Wouldn't it be possible to use the workflow envs like that?

env:
  FOO: ${{ secrets.BAR }}

jobs:
  main:
    name: Nx Cloud - Main Job
    uses: nrwl/ci/.github/workflows/nx-cloud-main.yml@v0.11.3
    ...

What would be the best alternative if this is not possible?

latanoel commented 1 year ago

Hey 👋 I have the same need but for others env var (like deployment secrets).

Wouldn't it be possible to use the workflow envs like that?

env:
  FOO: ${{ secrets.BAR }}

jobs:
  main:
    name: Nx Cloud - Main Job
    uses: nrwl/ci/.github/workflows/nx-cloud-main.yml@v0.11.3
    ...

What would be the best alternative if this is not possible?

I'm having similar issue where I need to set sentry auth token. Tried this configuration but didn't work.

meeroslav commented 1 year ago

Unfortunately, the workflows are limited to known variables only.

Additionally, passing in GITHUB_TOKEN is not allowed as it clashes with GitHub's variable:

Secret name `GITHUB_TOKEN` within `workflow_call` can not be used since it would collide with system reserved name

You can find some reasoning for this here: https://github.com/orgs/community/discussions/21068

This workflow is not meant for all the use cases, and unfortunately, you will have to create your own workflow to accommodate the custom requirements.