Skip to content

Commit 7e006c6

Browse files
CorruptedAestheticCorruptedAesthetic
committed
Fix GitHub Actions workflow to use GitHub Secrets for production keys
- Replace Vault integration with GitHub Secrets for production public keys - Fix linter error with overwrite_files parameter - Add PRODUCTION_SECRETS_SETUP.md with configuration instructions - Update workflow to properly detect production builds and generate chainspecs
1 parent 460380c commit 7e006c6

2 files changed

Lines changed: 123 additions & 43 deletions

File tree

‎.github/workflows/publish.yml‎

Lines changed: 22 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -256,68 +256,47 @@ jobs:
256256
type=sha,format=long
257257
258258
# ------------------------------------------------------------
259-
# PRODUCTION KEY EXPORT (following Vault/CI/CD methodology)
259+
# PRODUCTION KEY EXPORT (using GitHub Secrets)
260260
# Export public keys for production builds - MANDATORY for releases
261-
# Following the field-tested methodology from MOSTUPTODATEMETHODOLOGYEURKEA.md
261+
# Public keys are safe to store in GitHub Secrets, private keys remain in Vault
262262
# ------------------------------------------------------------
263-
- name: Export production public keys from Vault/Secrets
263+
- name: Export production public keys from GitHub Secrets
264264
run: |
265265
set -euo pipefail
266-
echo "🔐 Setting up production environment variables following Vault/CI/CD methodology..."
266+
echo "🔐 Setting up production environment variables from GitHub Secrets..."
267267
268-
# For production releases, use real keys from GitHub Secrets (Vault integration)
268+
# For production releases, use real keys from GitHub Secrets
269269
if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
270-
echo "🏭 Production release detected - exporting production keys from Vault"
271-
272-
# Install Vault CLI and jq for public key access and OIDC token parsing
273-
echo "📦 Installing Vault CLI and jq..."
274-
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
275-
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
276-
sudo apt update && sudo apt install vault jq
277-
278-
# Configure Vault connection for public key access
279-
export VAULT_ADDR="${{ secrets.VAULT_ADDR }}"
280-
export VAULT_TOKEN="${{ secrets.VAULT_CI_TOKEN }}"
281-
282-
echo "🔐 Authenticating to Vault for public key access..."
283-
284-
# Verify Vault connection
285-
if ! vault status; then
286-
echo "❌ ERROR: Cannot connect to Vault at $VAULT_ADDR"
287-
echo "🔧 Check VAULT_ADDR and VAULT_CI_TOKEN secrets"
288-
echo "💡 If you see 'non-printable characters' error, run scripts/fix-vault-ci-token.sh"
289-
exit 1
290-
fi
291-
292-
echo "✅ Successfully authenticated to Vault for public key access"
270+
echo "🏭 Production release detected - exporting production keys from GitHub Secrets"
293271
294272
# MANDATORY production keys - build will fail if any are missing
295-
# Following the methodology: GitHub Actions pulls public values from Vault,
273+
# GitHub Actions pulls public values from GitHub Secrets,
296274
# exports them as environment variables, and Rust compiler substitutes them
297275
# into the preset at build time via env!() macros
298276
299-
echo "🔑 Fetching production public keys from Vault..."
277+
echo "🔑 Exporting production public keys from GitHub Secrets..."
300278
301-
# Fetch keys from Vault KV store
302-
export SUDO_SS58=$(vault kv get -field=sudo_ss58 kv/fennel-production/ci-cd/sudo 2>/dev/null || echo "")
303-
export VAL1_AURA_PUB=$(vault kv get -field=aura_public kv/fennel-production/ci-cd/validator-1 2>/dev/null || echo "")
304-
export VAL1_GRANDPA_PUB=$(vault kv get -field=grandpa_public kv/fennel-production/ci-cd/validator-1 2>/dev/null || echo "")
305-
export VAL1_STASH_SS58=$(vault kv get -field=stash_ss58 kv/fennel-production/ci-cd/validator-1 2>/dev/null || echo "")
306-
export VAL2_AURA_PUB=$(vault kv get -field=aura_public kv/fennel-production/ci-cd/validator-2 2>/dev/null || echo "")
307-
export VAL2_GRANDPA_PUB=$(vault kv get -field=grandpa_public kv/fennel-production/ci-cd/validator-2 2>/dev/null || echo "")
308-
export VAL2_STASH_SS58=$(vault kv get -field=stash_ss58 kv/fennel-production/ci-cd/validator-2 2>/dev/null || echo "")
279+
# Export production keys from GitHub Secrets
280+
export SUDO_SS58="${{ secrets.PROD_SUDO_SS58 }}"
281+
export VAL1_AURA_PUB="${{ secrets.PROD_VAL1_AURA_PUB }}"
282+
export VAL1_GRANDPA_PUB="${{ secrets.PROD_VAL1_GRANDPA_PUB }}"
283+
export VAL1_STASH_SS58="${{ secrets.PROD_VAL1_STASH_SS58 }}"
284+
export VAL2_AURA_PUB="${{ secrets.PROD_VAL2_AURA_PUB }}"
285+
export VAL2_GRANDPA_PUB="${{ secrets.PROD_VAL2_GRANDPA_PUB }}"
286+
export VAL2_STASH_SS58="${{ secrets.PROD_VAL2_STASH_SS58 }}"
309287
310288
# Verify all production variables are set (prevent empty values)
311289
for var in SUDO_SS58 VAL1_AURA_PUB VAL1_GRANDPA_PUB VAL1_STASH_SS58 VAL2_AURA_PUB VAL2_GRANDPA_PUB VAL2_STASH_SS58; do
312290
if [ -z "${!var:-}" ]; then
313-
echo "❌ ERROR: Production variable $var is empty or missing from Vault!"
314-
echo "🔧 Check Vault KV store at kv/fennel-production/ci-cd/"
291+
echo "❌ ERROR: Production variable $var is empty or missing from GitHub Secrets!"
292+
echo "🔧 Add PROD_* secrets to GitHub repository settings"
293+
echo "💡 Use extract-github-secrets.sh script to get the required values"
315294
exit 1
316295
fi
317296
done
318297
319-
echo "✅ All 7 production environment variables fetched from Vault and validated"
320-
echo "🔒 Using production public keys from Vault (private keys remain secure in Vault)"
298+
echo "✅ All 7 production environment variables exported from GitHub Secrets and validated"
299+
echo "🔒 Using production public keys from GitHub Secrets (private keys remain secure in Vault)"
321300
else
322301
echo "🧪 Development/staging build - production variables not required"
323302
echo "📋 Development/staging presets use Alice/Bob hardcoded keys from sp_keyring"
@@ -339,7 +318,7 @@ jobs:
339318
# For production releases: pass mandatory environment variables
340319
# For development/staging: build without production env vars (uses Alice/Bob presets)
341320
if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
342-
echo "🏭 Building production runtime with Vault-sourced public keys"
321+
echo "🏭 Building production runtime with GitHub Secrets-sourced public keys"
343322
344323
# Production build with mandatory environment variables
345324
# These MUST be set or build.rs will fail with clear error message

‎PRODUCTION_SECRETS_SETUP.md‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
# Production Secrets Setup Guide
2+
3+
This guide explains how to configure GitHub Secrets for production chainspec generation.
4+
5+
## 🔐 Required GitHub Secrets
6+
7+
The following secrets must be configured in your GitHub repository settings for production builds to work:
8+
9+
### Go to Repository Settings
10+
1. Navigate to: `https://github.com/CorruptedAesthetic/fennel-solonet/settings/secrets/actions`
11+
2. Click "New repository secret" for each of the following:
12+
13+
### Required Secrets
14+
15+
| Secret Name | Description | Example Format |
16+
|-------------|-------------|----------------|
17+
| `PROD_SUDO_SS58` | Production sudo account SS58 address | `5DfhGyQdFobKM8NsWvEeAKk5EQQgYe9AydgJ7rMB6E1EqRzV` |
18+
| `PROD_VAL1_AURA_PUB` | Validator 1 AURA public key (hex) | `0x46ebddef8cd9bb167dc30878d7113b7e168e6f0646beffd77d69d39bad76b47a` |
19+
| `PROD_VAL1_GRANDPA_PUB` | Validator 1 GRANDPA public key (hex) | `0x345071da55e5dccefaaa440339415ef9f2663338a38f7da0df21be5ab4e055ef` |
20+
| `PROD_VAL1_STASH_SS58` | Validator 1 stash account SS58 address | `5DfhGyQdFobKM8NsWvEeAKk5EQQgYe9AydgJ7rMB6E1EqRzV` |
21+
| `PROD_VAL2_AURA_PUB` | Validator 2 AURA public key (hex) | `0x46ebddef8cd9bb167dc30878d7113b7e168e6f0646beffd77d69d39bad76b47a` |
22+
| `PROD_VAL2_GRANDPA_PUB` | Validator 2 GRANDPA public key (hex) | `0x345071da55e5dccefaaa440339415ef9f2663338a38f7da0df21be5ab4e055ef` |
23+
| `PROD_VAL2_STASH_SS58` | Validator 2 stash account SS58 address | `5DfhGyQdFobKM8NsWvEeAKk5EQQgYe9AydgJ7rMB6E1EqRzV` |
24+
25+
## 🔑 Getting the Secret Values
26+
27+
### Option 1: From fennel-prod Repository
28+
If you have the `fennel-prod` repository set up with Vault:
29+
30+
```bash
31+
cd /path/to/fennel-prod
32+
./environments/production/extract-github-secrets.sh
33+
```
34+
35+
This script will output the exact values you need to copy into GitHub Secrets.
36+
37+
### Option 2: Manual Generation
38+
If you need to generate new production keys:
39+
40+
```bash
41+
# Generate validator 1 keys
42+
fennel-node key generate --scheme sr25519 --output-type json > val1_aura.json
43+
fennel-node key generate --scheme ed25519 --output-type json > val1_grandpa.json
44+
45+
# Generate validator 2 keys
46+
fennel-node key generate --scheme sr25519 --output-type json > val2_aura.json
47+
fennel-node key generate --scheme ed25519 --output-type json > val2_grandpa.json
48+
49+
# Extract public keys and SS58 addresses from the JSON files
50+
```
51+
52+
## 🚀 Testing the Setup
53+
54+
Once you've configured all the secrets:
55+
56+
1. **Create a release tag**:
57+
```bash
58+
git tag -a fennel-node-0.5.0 -m "Production release v0.5.0"
59+
git push origin fennel-node-0.5.0
60+
```
61+
62+
2. **Monitor the GitHub Actions workflow**:
63+
- Go to the Actions tab in your repository
64+
- Watch for the "Create and publish a Docker image" workflow
65+
- Verify it detects the production release and exports the secrets
66+
67+
3. **Check the artifacts**:
68+
- The workflow should generate production chainspecs
69+
- They should be included in the GitHub release
70+
- Verify the production chainspec contains your validator keys
71+
72+
## 🔒 Security Notes
73+
74+
- **Public Keys Only**: These secrets contain only public keys and SS58 addresses
75+
- **Safe to Store**: Public keys are safe to store in GitHub Secrets
76+
- **Private Keys**: Private validator keys remain secure in HashiCorp Vault
77+
- **Runtime Injection**: Private keys are injected at runtime via Vault Agent
78+
79+
## 🔄 Migration Path
80+
81+
This GitHub Secrets approach provides:
82+
1. **Immediate Solution**: Production chainspecs generated right away
83+
2. **Security**: Public keys are safe in GitHub Secrets
84+
3. **Simplicity**: No complex Vault OIDC authentication in CI/CD
85+
4. **Vault Integration**: Private keys still managed via Vault for runtime
86+
87+
The compilation methodology remains the same - only the source of public keys changes from Vault to GitHub Secrets.
88+
89+
## ✅ Verification
90+
91+
After setup, your production builds should:
92+
- ✅ Detect release tags correctly
93+
- ✅ Export production environment variables from GitHub Secrets
94+
- ✅ Build runtime with production keys embedded
95+
- ✅ Generate production chainspecs
96+
- ✅ Include chainspecs in GitHub releases
97+
- ✅ Show "Production release detected" in workflow logs
98+
99+
---
100+
101+
**Next Steps**: Once this is working, you can optionally migrate back to Vault integration if needed, but GitHub Secrets provides a simpler and equally secure approach for public key material.

0 commit comments

Comments
 (0)