mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
Paul Gschwendtner
efcc723846
Invalidate the cache for node modules so that the CLI builds from the snapshot repositories are used. Due to a bug in Yarn, and the need of using the `github:<..>` syntax, the old artifacts from previous runs are incorrectly cached. This could have been prevented by using an actual full Git ref URL, but unfortunately that does not work because the CLI devkit snapshot dependencies set snapshot builds as deps as well. The URLs here need to match as otherwise Yarn will conflict. e.g. ``` Pattern ["@angular-devkit/core@github:angular/angular-devkit-core-builds#64b7e2b1d"] is trying to unpack in the same destination "/Users/paul/Library/Caches/Yarn/v6/npm-@angular-devkit-core-13.0.0-next.6/node_modules/@angular-devkit/core" as pattern ["@angular-devkit/core@github:angular/angular-devkit-core-builds#0e7277c63"]. This could result in non-deterministic behavior, skipping. ``` PR Close #43431
Encryption
Based on https://github.com/circleci/encrypted-files
In the CircleCI web UI, we have a secret variable called KEY
https://circleci.com/gh/angular/angular/edit#env-vars
which is only exposed to non-fork builds
(see "Pass secrets to builds from forked pull requests" under
https://circleci.com/gh/angular/angular/edit#advanced-settings)
We use this as a symmetric AES encryption key to encrypt tokens like a GitHub token that enables publishing snapshots.
To create the github_token file, we take this approach:
- Find the angular-builds:token in the internal pw database
- Go inside the CircleCI default docker image so you use the same version of openssl as we will at runtime:
docker run --rm -it circleci/node:10.12 - echo "https://[token]:@github.com" > credentials
- openssl aes-256-cbc -e -in credentials -out .circleci/github_token -k $KEY
- If needed, base64-encode the result so you can copy-paste it out of docker:
base64 github_token