mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
Paul Gschwendtner
8d7fd91a67
For quite some time now, since we started to use Bazel for integration tests, we relied on some size tracking logic that did not actually fully work under Bazel. It was thought that all the necessary CI push/PR information is available to the Bazel test, but that was not the case. This was now fixed with the recent Rules NodeJS v5 update where I made sure the `env.sh` variables are actually available before we write them to the temporary file for the Bazel-access. This now will unveil an issue because payload size goldens would start being based on their branch name. e.g. the golden key in `13.3.x` should not be `master` but `13.3.x`. This makes more sense than `master` as key, but makes things more cumbersome and ideally we would not store the branch name at all (this is a larger change though -- not worth now since we might refactor this anyway). For now we will update the size tracking logic to always use `master` as golden key (like it worked in the past year(s)) With the environment fix we now (again) start uploading payload size results to Firebase. This did not work by accident either. The uploading logic is reliant on the CircleCI commit range which is not working/reliable in upstream branches. This commit removes this reliance on `COMMIT_RANGE` since it's not strictly necessary and currently breaking renovate PRs. We can re-enable this when we have a solution with CircleCI, or a workaround/resolution logic provided in e.g. `ng-dev ci determine-commit-range`. PR Close #45444
Encryption
Based on https://github.com/circleci/encrypted-files
In the CircleCI web UI, we have a secret variable called KEY
https://circleci.com/gh/angular/angular/edit#env-vars
which is only exposed to non-fork builds
(see "Pass secrets to builds from forked pull requests" under
https://circleci.com/gh/angular/angular/edit#advanced-settings)
We use this as a symmetric AES encryption key to encrypt tokens like a GitHub token that enables publishing snapshots.
To create the github_token file, we take this approach:
- Find the angular-builds:token in the internal pw database
- Go inside the CircleCI default docker image so you use the same version of openssl as we will at runtime:
docker run --rm -it circleci/node:10.12 - echo "https://[token]:@github.com" > credentials
- openssl aes-256-cbc -e -in credentials -out .circleci/github_token -k $KEY
- If needed, base64-encode the result so you can copy-paste it out of docker:
base64 github_token