From 609880c57ffc217dbd5b6e2eed86765fd2a4b547 Mon Sep 17 00:00:00 2001 From: David Soria Parra Date: Sat, 13 Dec 2025 17:46:16 +0000 Subject: [PATCH] Add one-time migration workflow to set GitHub token and clean up state MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add migrate-state.yml workflow (manual trigger) that: - Sets github:token in Pulumi config from PULUMI_GITHUB_TOKEN secret - Cleans up orphaned 'core' team memberships from state - Commits the updated Pulumi.prod.yaml back to repo - Revert deploy.yml to use encrypted token from Pulumi config 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- .github/workflows/deploy.yml | 1 - .github/workflows/migrate-state.yml | 78 +++++++++++++++++++++++++++++ 2 files changed, 78 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/migrate-state.yml diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 951800f..d0b7a64 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -51,7 +51,6 @@ jobs: - name: Deploy to Production env: PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }} - GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }} run: | echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt make up \ No newline at end of file diff --git a/.github/workflows/migrate-state.yml b/.github/workflows/migrate-state.yml new file mode 100644 index 0000000..90d7f34 --- /dev/null +++ b/.github/workflows/migrate-state.yml @@ -0,0 +1,78 @@ +name: Migrate State (One-Time) + +on: + workflow_dispatch: + +permissions: + contents: write + +env: + PULUMI_VERSION: "3.197.0" + +jobs: + migrate: + name: Migrate Pulumi State + runs-on: ubuntu-latest + environment: production + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '22' + cache: 'npm' + + - name: Setup Pulumi + uses: pulumi/actions@v6 + with: + pulumi-version: ${{ env.PULUMI_VERSION }} + + - name: Install Pulumi packages + run: pulumi install + + - name: Install dependencies + run: npm ci + + - name: Authenticate to Google Cloud + uses: google-github-actions/auth@v2 + with: + credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }} + + - name: Migrate State + env: + PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }} + PULUMI_GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }} + run: | + echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt + export PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt + + # Login to state backend + pulumi login gs://mcp-access-prod-pulumi-state + + # Set the GitHub token in Pulumi config (will be encrypted) + pulumi config set --secret --stack prod github:token "$PULUMI_GITHUB_TOKEN" + + # Clean up orphaned core team memberships from state + pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::dsp-ant-core' --yes || true + pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::maxisbey-core' --yes || true + pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::bhosmer-ant-core' --yes || true + pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::crondinini-ant-core' --yes || true + pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::ochafik-core' --yes || true + pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::ihrpr-core' --yes || true + pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::jerome3o-anthropic-core' --yes || true + pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::felixweinberger-core' --yes || true + pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::maheshmurag-core' --yes || true + pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::domdomegg-core' --yes || true + pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/team:Team::core' --yes || true + + echo "State cleanup complete!" + + - name: Commit updated Pulumi config + run: | + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" + git add Pulumi.prod.yaml + git commit -m "Update encrypted GitHub token in Pulumi config" || echo "No changes to commit" + git push