feat: get github token from bjerk-bot stack reference (#81)

* feat: get github token from bjerk-bot stack

* fix: add githubProvider to other github actions secrets

* feat: use githubProvider everywhere

* fix: get token from stackref, not through provider

* fix: remove unused import

* fix: update import

* fix: update imports and stack refs

* fix: remove unnecessary provider

* refactor: use gitHub instead of github

* feat: add stack refs to bjerk-conf

* fix: remove extraneous provider reference

* fix: remove unused export

* fix: revert irrelevant change

* revert format change

* refactor: move stack-refs into resources folder

* refactor: rename token in import

* fix: use correct quotes

* fix: use singlequotes

* fix: use all lowercase stack refs

* fix: set temporary local github token

* fix: add config

* move away from stackref folder

* move out of stack ref

* fix: revert temp token testing

* fix: remove unnecessary import

* disable default providers

* change github token name

* remove default provider

* do not refresh for a second

* fix token name

* fix token name

---------

Co-authored-by: Simen A. W. Olsen <so@bjerk.io>

.github/workflows/pull-request.yml

@@ -49,7 +49,7 @@ jobs:
           PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
         with:
           command: preview
-          refresh: true
+          refresh: false
           stack-name: ${{ matrix.stack-name }}
           work-dir: projects/${{ matrix.project }}
           comment-on-pr: true

projects/bjerk-conf/Pulumi.prod.yaml

@@ -1,6 +1 @@
 config:
-  bjerk-conf:github-token:
-    secure: AAABAPHVya0OAwni/3n8vb9t92GR3dwAWHbXAPMppk+ZGMq3osCn2bWpX0eEyAhMi0ZTvpp6F9ucDj48EzIJw8MfsI5V35ya
-  bjerk-conf:github-token-expires-at: "2023-07-30T09:21:37.869Z"
-  bjerk-conf:github-token-id:
-    secure: AAABAKVO5zlOw54bufDPNBpYJl14X+EeC3z8ArADGs6qkPRF1rqQFzrr

projects/bjerk-conf/resources/github/providers.ts

@@ -1,10 +1,8 @@
 import * as github from '@pulumi/github';
-import { getToken } from 'get-pulumi-secret';
+import { bjerkBotGitHubToken as token } from '../stack-refs';
 
 const githubProviders = new Map<string, github.Provider>();
 
-const token = getToken('github-token');
-
 export function getGithubProvider(owner: string): github.Provider {
   if (!githubProviders.has(owner)) {
     githubProviders.set(

projects/bjerk-conf/resources/stack-refs.ts

@@ -0,0 +1,7 @@
+import * as pulumi from '@pulumi/pulumi';
+
+const bjerkBot = new pulumi.StackReference('bjerk/bjerk-bot/prod');
+
+export const bjerkBotGitHubToken = pulumi.secret(
+  bjerkBot.requireOutput('githubToken'),
+);

projects/bjerk-io/src/github.ts

@@ -1,7 +1,7 @@
 import * as github from '@pulumi/github';
-import { gitHubToken } from './stack-refs';
+import { bjerkBotGitHubToken } from './stack-refs';
 
 export const githubProvider = new github.Provider('gh-provider', {
   owner: 'bjerkio',
-  token: gitHubToken,
+  token: bjerkBotGitHubToken,
 });

projects/bjerk-io/src/index.ts

@@ -1,4 +1,3 @@
 import './zones/bjerk-dev';
 import './zones/bjerk-io';
 import './deploy-service-account';
-import './github';

projects/bjerk-io/src/stack-refs.ts

@@ -1,7 +1,7 @@
 import * as pulumi from '@pulumi/pulumi';
 
-const bjerkConf = new pulumi.StackReference('Bjerk/bjerk-conf/prod');
+const bjerkBotStack = new pulumi.StackReference('Bjerk/bjerk-bot/prod');
 
-export const gitHubToken = pulumi.secret(
-  bjerkConf.requireOutput('gitHubToken'),
+export const bjerkBotGitHubToken = pulumi.secret(
+  bjerkBotStack.requireOutput('githubToken'),
 );

projects/core-infra/src/github-orgs.ts

@@ -1,5 +1,5 @@
 import * as github from '@pulumi/github';
-import { gitHubToken as token } from './stack-refs';
+import { bjerkBotGitHubToken as token } from './stack-refs';
 
 export const bjerkio = new github.Provider('bjerkio-provider', {
   owner: 'bjerkio',

projects/core-infra/src/index.ts

@@ -5,6 +5,3 @@ import './customers';
 import './bot';
 import './branches';
 import './identity-pool';
-import { gitHubToken } from './stack-refs';
-
-export const token = gitHubToken;

projects/core-infra/src/providers/github.ts

@@ -1,6 +1,6 @@
 import * as github from '@pulumi/github';
-import { gitHubToken } from '../stack-refs';
+import { bjerkBotGitHubToken } from '../stack-refs';
 
 export const provider = new github.Provider('github-provider', {
-  token: gitHubToken,
+  token: bjerkBotGitHubToken,
 });

projects/core-infra/src/stack-refs.ts

@@ -1,7 +1,7 @@
 import * as pulumi from '@pulumi/pulumi';
 
-const bjerkConf = new pulumi.StackReference('Bjerk/bjerk-conf/prod');
+const bjerkBot = new pulumi.StackReference('bjerk/bjerk-bot/prod');
 
-export const gitHubToken = pulumi.secret(
-  bjerkConf.requireOutput('gitHubToken'),
+export const bjerkBotGitHubToken = pulumi.secret(
+  bjerkBot.requireOutput('githubToken'),
 );