Switch to SSH auth

angr · May 29, 2024 · ac3b3a7 · ac3b3a7
1 parent 70eb7fc
commit ac3b3a7
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 8 deletions.
diff --git a/.github/workflows/angr-release.yml b/.github/workflows/angr-release.yml
@@ -155,6 +155,15 @@ jobs:
           git config --global user.name "github-actions[bot]"
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
+      - name: Add release key
+        run: |
+          mkdir -p ~/.ssh
+          echo "${RELEASE_KEY}" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          ssh-keyscan github.com >> ~/.ssh/known_hosts
+        env:
+          RELEASE_SSH_KEY: ${{ secrets.RELEASE_KEY }}
+
       # Git release commits
       - name: Download repos artifact
         uses: actions/download-artifact@v4
@@ -166,15 +175,11 @@ jobs:
         run: release-scripts/publish_release_commits.sh
         env:
           DRY_RUN: ${{ github.event_name != 'schedule' && github.event.inputs.dry_run == false }}
-          GIT_USERNAME: ${{ secrets.RELEASE_USER }}
-          GIT_PASSWORD: ${{ secrets.RELEASE_TOKEN }}
 
       - name: Bump versions on master
         run: release-scripts/bump_versions.sh
         env:
           DRY_RUN: ${{ github.event_name != 'schedule' && github.event.inputs.dry_run == false }}
-          GIT_USERNAME: ${{ secrets.RELEASE_USER }}
-          GIT_PASSWORD: ${{ secrets.RELEASE_TOKEN }}
 
       # PyPI artifacts
       - name: Create artifacts and dist directories

diff --git a/release-scripts/bump_versions.sh b/release-scripts/bump_versions.sh
@@ -8,7 +8,7 @@ pip install packaging
 
 export CHECKOUT_DIR=$(mktemp -d)
 for r in $REPOS $REPOS_LINUX_ONLY; do
-    git clone https://github.com/angr/$r.git $CHECKOUT_DIR/$r --depth=1 --recursive
+    git clone git@github.com:angr/$r.git $CHECKOUT_DIR/$r --depth=1 --recursive
 done
 
 for i in $(ls $CHECKOUT_DIR); do
@@ -43,7 +43,6 @@ for i in $(ls $CHECKOUT_DIR); do
 
     # Push
     if [ "$DRY_RUN" == "false" ]; then
-        git remote set-url origin $(git remote get-url origin | sed "s#https://#https://$GIT_USERNAME:$GIT_PASSWORD@#")
         git push
         push_successful=$?
         if [ $push_successful -ne 0 ]; then

diff --git a/release-scripts/checkout_repos.sh b/release-scripts/checkout_repos.sh
@@ -6,5 +6,5 @@ mkdir -p "repos"
 echo "!.git" > repos/.artifactignore
 
 for r in $REPOS $REPOS_LINUX_ONLY; do
-    git clone https://github.com/angr/$r.git $CHECKOUT_DIR/$r --depth=1 --recursive
+    git clone git@github.com:angr/$r.git $CHECKOUT_DIR/$r --depth=1 --recursive
 done
diff --git a/release-scripts/publish_release_commits.sh b/release-scripts/publish_release_commits.sh
@@ -5,7 +5,6 @@ source "$(dirname "$0")/vars.sh"
 
 for i in $(ls $CHECKOUT_DIR); do
     ref_to_push=$(git -C $CHECKOUT_DIR/$i describe --tags | head -n 1)
-    git -C $CHECKOUT_DIR/$i remote set-url origin $(git -C $CHECKOUT_DIR/$i remote get-url origin | sed "s#https://#https://$GIT_USERNAME:$GIT_PASSWORD@#")
     if [ "$DRY_RUN" == "false" ]; then
         git -C $CHECKOUT_DIR/$i push origin "$ref_to_push"
     fi