diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index d0b7a64..951800f 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -51,6 +51,7 @@ jobs: - name: Deploy to Production env: PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }} + GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }} run: | echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt make up \ No newline at end of file diff --git a/.github/workflows/migrate-state.yml b/.github/workflows/migrate-state.yml deleted file mode 100644 index 90d7f34..0000000 --- a/.github/workflows/migrate-state.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: Migrate State (One-Time) - -on: - workflow_dispatch: - -permissions: - contents: write - -env: - PULUMI_VERSION: "3.197.0" - -jobs: - migrate: - name: Migrate Pulumi State - runs-on: ubuntu-latest - environment: production - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: '22' - cache: 'npm' - - - name: Setup Pulumi - uses: pulumi/actions@v6 - with: - pulumi-version: ${{ env.PULUMI_VERSION }} - - - name: Install Pulumi packages - run: pulumi install - - - name: Install dependencies - run: npm ci - - - name: Authenticate to Google Cloud - uses: google-github-actions/auth@v2 - with: - credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }} - - - name: Migrate State - env: - PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }} - PULUMI_GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }} - run: | - echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt - export PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt - - # Login to state backend - pulumi login gs://mcp-access-prod-pulumi-state - - # Set the GitHub token in Pulumi config (will be encrypted) - pulumi config set --secret --stack prod github:token "$PULUMI_GITHUB_TOKEN" - - # Clean up orphaned core team memberships from state - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::dsp-ant-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::maxisbey-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::bhosmer-ant-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::crondinini-ant-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::ochafik-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::ihrpr-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::jerome3o-anthropic-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::felixweinberger-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::maheshmurag-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::domdomegg-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/team:Team::core' --yes || true - - echo "State cleanup complete!" - - - name: Commit updated Pulumi config - run: | - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - git add Pulumi.prod.yaml - git commit -m "Update encrypted GitHub token in Pulumi config" || echo "No changes to commit" - git push