From c47f7692c37005794ed16248a7e1ad9706bc828e Mon Sep 17 00:00:00 2001 From: David Soria Parra Date: Sat, 13 Dec 2025 17:48:40 +0000 Subject: [PATCH] Use GITHUB_TOKEN env var for Pulumi GitHub provider MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pass the token via GITHUB_TOKEN environment variable which the Pulumi GitHub provider reads automatically. Remove the one-time migration workflow since state cleanup already succeeded. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- .github/workflows/deploy.yml | 1 + .github/workflows/migrate-state.yml | 78 ----------------------------- 2 files changed, 1 insertion(+), 78 deletions(-) delete mode 100644 .github/workflows/migrate-state.yml diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index d0b7a64..951800f 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -51,6 +51,7 @@ jobs: - name: Deploy to Production env: PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }} + GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }} run: | echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt make up \ No newline at end of file diff --git a/.github/workflows/migrate-state.yml b/.github/workflows/migrate-state.yml deleted file mode 100644 index 90d7f34..0000000 --- a/.github/workflows/migrate-state.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: Migrate State (One-Time) - -on: - workflow_dispatch: - -permissions: - contents: write - -env: - PULUMI_VERSION: "3.197.0" - -jobs: - migrate: - name: Migrate Pulumi State - runs-on: ubuntu-latest - environment: production - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: '22' - cache: 'npm' - - - name: Setup Pulumi - uses: pulumi/actions@v6 - with: - pulumi-version: ${{ env.PULUMI_VERSION }} - - - name: Install Pulumi packages - run: pulumi install - - - name: Install dependencies - run: npm ci - - - name: Authenticate to Google Cloud - uses: google-github-actions/auth@v2 - with: - credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }} - - - name: Migrate State - env: - PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }} - PULUMI_GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }} - run: | - echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt - export PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt - - # Login to state backend - pulumi login gs://mcp-access-prod-pulumi-state - - # Set the GitHub token in Pulumi config (will be encrypted) - pulumi config set --secret --stack prod github:token "$PULUMI_GITHUB_TOKEN" - - # Clean up orphaned core team memberships from state - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::dsp-ant-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::maxisbey-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::bhosmer-ant-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::crondinini-ant-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::ochafik-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::ihrpr-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::jerome3o-anthropic-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::felixweinberger-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::maheshmurag-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::domdomegg-core' --yes || true - pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/team:Team::core' --yes || true - - echo "State cleanup complete!" - - - name: Commit updated Pulumi config - run: | - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - git add Pulumi.prod.yaml - git commit -m "Update encrypted GitHub token in Pulumi config" || echo "No changes to commit" - git push