From 7facac8c467be911e0fd17c4d2d1bc9de7aefd45 Mon Sep 17 00:00:00 2001 From: Teodor Calin Date: Thu, 3 Sep 2026 13:32:44 +0300 Subject: [PATCH] scope metadata deploy credentials --- .github/workflows/deploy-appstore-meta.yml | 6 +++--- deploy/appstore-meta/README.md | 5 +++++ 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deploy-appstore-meta.yml b/.github/workflows/deploy-appstore-meta.yml index 176aeae..3a87522 100644 --- a/.github/workflows/deploy-appstore-meta.yml +++ b/.github/workflows/deploy-appstore-meta.yml @@ -26,19 +26,19 @@ jobs: - name: Gate on credentials id: gate env: - SA_KEY: ${{ secrets.GCP_SA_KEY }} + SA_KEY: ${{ secrets.APPSTORE_META_GCP_SA_KEY }} run: | if [ -n "$SA_KEY" ]; then echo "enabled=true" >> "$GITHUB_OUTPUT" else - echo "GCP_SA_KEY is not configured; metadata deploy skipped." + echo "APPSTORE_META_GCP_SA_KEY is not configured; metadata deploy skipped." echo "enabled=false" >> "$GITHUB_OUTPUT" fi - uses: google-github-actions/auth@v2 if: steps.gate.outputs.enabled == 'true' with: - credentials_json: ${{ secrets.GCP_SA_KEY }} + credentials_json: ${{ secrets.APPSTORE_META_GCP_SA_KEY }} - uses: google-github-actions/setup-gcloud@v2 if: steps.gate.outputs.enabled == 'true' diff --git a/deploy/appstore-meta/README.md b/deploy/appstore-meta/README.md index 514a268..dedd7cd 100644 --- a/deploy/appstore-meta/README.md +++ b/deploy/appstore-meta/README.md @@ -48,6 +48,11 @@ curl -sI https://$HOST/v1/appstore/metadata | grep -i etag ## Update +Repository deployments use a dedicated `APPSTORE_META_GCP_SA_KEY` secret. +The service account must be able to read and SSH to the `appstore-meta` +instance in this project, including IAP tunnel access. The general publishing +VM credential is intentionally not reused across this project boundary. + `startup.sh` re-clones and rebuilds on every boot: ```bash