From 14a82efc3f0a9ade079c2dfcd843e6f6f4b8ac31 Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Fri, 9 Oct 2026 12:38:58 -0700 Subject: [PATCH 1/2] chore(gocd): expose App credentials to image deploy jobs --- gocd/templates/pipelines/launchpad.libsonnet | 3 +++ 1 file changed, 3 insertions(+) diff --git a/gocd/templates/pipelines/launchpad.libsonnet b/gocd/templates/pipelines/launchpad.libsonnet index bf2e3769..532cfa08 100644 --- a/gocd/templates/pipelines/launchpad.libsonnet +++ b/gocd/templates/pipelines/launchpad.libsonnet @@ -2,6 +2,9 @@ local gocdtasks = import 'github.com/getsentry/gocd-jsonnet/libs/gocd-tasks.libs function(region) { environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', // SENTRY_REGION is used by the dev-infra scripts to connect to GKE SENTRY_REGION: region, }, From b3be72a9ea21273f23a9a80c82411eb285fb6744 Mon Sep 17 00:00:00 2001 From: joshuarli Date: Fri, 9 Oct 2026 13:54:08 -0700 Subject: [PATCH 2/2] fix(gocd): scope workflow credentials to deployment jobs --- gocd/templates/pipelines/launchpad.libsonnet | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/gocd/templates/pipelines/launchpad.libsonnet b/gocd/templates/pipelines/launchpad.libsonnet index 532cfa08..e345d87f 100644 --- a/gocd/templates/pipelines/launchpad.libsonnet +++ b/gocd/templates/pipelines/launchpad.libsonnet @@ -2,9 +2,6 @@ local gocdtasks = import 'github.com/getsentry/gocd-jsonnet/libs/gocd-tasks.libs function(region) { environment_variables: { - // k8s-deploy dispatches deployment workflows using GitHub App credentials. - GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', - GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', // SENTRY_REGION is used by the dev-infra scripts to connect to GKE SENTRY_REGION: region, }, @@ -44,6 +41,9 @@ function(region) { timeout: 1200, elastic_profile_id: 'launchpad', environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', LABEL_SELECTOR: 'service=launchpad,env=canary', }, tasks: [ @@ -64,6 +64,9 @@ function(region) { timeout: 1200, elastic_profile_id: 'launchpad', environment_variables: { + // k8s-deploy dispatches deployment workflows using GitHub App credentials. + GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', + GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', LABEL_SELECTOR: 'service=launchpad', }, tasks: [