mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
Paul Gschwendtner
01d2f03d3d
Windows disallows removal of files which are currently being used. i.e. have active handles. This currently can result in permission denied failures on the Windows CI jobs where `yarn bazel` resolves to the local bazelisk installation that can be unlinked by `yarn_install` repository fetching as part of the Bazel invocation, resulting in errors like: ``` ERROR: An error occurred during the fetch of repository 'npm': yarn_install failed: $ node tools/yarn/check-yarn.js ... [4/5] Linking dependencies... info If you think this is a bug, please open a bug report with the information provided in "C:\\users\\circleci\\ng\\yarn-error.log". info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command. (warning " > tsickle@0.34.3" has incorrect peer dependency "typescript@~3.3.1". error An unexpected error occurred: "EPERM: operation not permitted, unlink 'C:\\users\\circleci\\ng\\node_modules\\@bazel\\bazel-win32_x64\\bazel-0.27.0-windows-x86_64.exe'". Process stalled Active handles: - Socket - Socket - Socket ) ``` We workarund this in order to improve CI stability in case the node modules are being invalidated by Bazel, or through Yarns integrity checking. PR Close #43365
Encryption
Based on https://github.com/circleci/encrypted-files
In the CircleCI web UI, we have a secret variable called KEY
https://circleci.com/gh/angular/angular/edit#env-vars
which is only exposed to non-fork builds
(see "Pass secrets to builds from forked pull requests" under
https://circleci.com/gh/angular/angular/edit#advanced-settings)
We use this as a symmetric AES encryption key to encrypt tokens like a GitHub token that enables publishing snapshots.
To create the github_token file, we take this approach:
- Find the angular-builds:token in the internal pw database
- Go inside the CircleCI default docker image so you use the same version of openssl as we will at runtime:
docker run --rm -it circleci/node:10.12 - echo "https://[token]:@github.com" > credentials
- openssl aes-256-cbc -e -in credentials -out .circleci/github_token -k $KEY
- If needed, base64-encode the result so you can copy-paste it out of docker:
base64 github_token