From 90fc91220087247b91a326d64f1a83e1044b2a44 Mon Sep 17 00:00:00 2001 From: Jesper Terkelsen Date: Thu, 1 Oct 2026 09:41:15 +0200 Subject: [PATCH] feat(workflows): forward the S3 cache secrets through the generic and Python deploys deploy-generic, deploy-generic-v2 and deploy-python accept the optional GH_ACTION_* secrets and pass them to component-build, so their image builds on ARC can keep Dockerfile cache mounts in S3 like deploy-kotlin. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/deploy-generic-v2.yml | 8 ++++++++ .github/workflows/deploy-generic.yml | 8 ++++++++ .github/workflows/deploy-python.yml | 8 ++++++++ 3 files changed, 24 insertions(+) diff --git a/.github/workflows/deploy-generic-v2.yml b/.github/workflows/deploy-generic-v2.yml index da1c198..e6ee3cc 100644 --- a/.github/workflows/deploy-generic-v2.yml +++ b/.github/workflows/deploy-generic-v2.yml @@ -89,6 +89,12 @@ on: AWS_ACCOUNT_ID: required: true description: 'AWS Account ID for ECR and deployment access' + GH_ACTION_ACCESS_KEY_ID: + required: false + description: "AWS access key for the S3 cache bucket, used on ARC. Without it ARC builds use the GitHub cache." + GH_ACTION_SECRET_ACCESS_KEY: + required: false + description: "AWS secret key for the S3 cache bucket, used on ARC. Without it ARC builds use the GitHub cache." MANIFEST_REPO_PAT: required: true description: 'GitHub PAT to commit/push to kube-manifests repo' @@ -181,6 +187,8 @@ jobs: AWS_CDN_ACCESS_KEY_ID: ${{ secrets.AWS_CDN_ACCESS_KEY_ID }} AWS_CDN_SECRET_ACCESS_KEY: ${{ secrets.AWS_CDN_SECRET_ACCESS_KEY }} NEXT_SERVER_ACTIONS_ENCRYPTION_KEY: ${{ secrets.NEXT_SERVER_ACTIONS_ENCRYPTION_KEY }} + GH_ACTION_ACCESS_KEY_ID: ${{ secrets.GH_ACTION_ACCESS_KEY_ID }} + GH_ACTION_SECRET_ACCESS_KEY: ${{ secrets.GH_ACTION_SECRET_ACCESS_KEY }} deploy: name: Deploy diff --git a/.github/workflows/deploy-generic.yml b/.github/workflows/deploy-generic.yml index a1f9ce3..26e8878 100644 --- a/.github/workflows/deploy-generic.yml +++ b/.github/workflows/deploy-generic.yml @@ -86,6 +86,12 @@ on: AWS_ACCOUNT_ID: required: true description: 'AWS Account ID for ECR and deployment access' + GH_ACTION_ACCESS_KEY_ID: + required: false + description: "AWS access key for the S3 cache bucket, used on ARC. Without it ARC builds use the GitHub cache." + GH_ACTION_SECRET_ACCESS_KEY: + required: false + description: "AWS secret key for the S3 cache bucket, used on ARC. Without it ARC builds use the GitHub cache." MANIFEST_REPO_PAT: required: true description: 'GitHub PAT to commit/push to kube-manifests repo' @@ -170,6 +176,8 @@ jobs: SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} AWS_CDN_ACCESS_KEY_ID: ${{ secrets.AWS_CDN_ACCESS_KEY_ID }} AWS_CDN_SECRET_ACCESS_KEY: ${{ secrets.AWS_CDN_SECRET_ACCESS_KEY }} + GH_ACTION_ACCESS_KEY_ID: ${{ secrets.GH_ACTION_ACCESS_KEY_ID }} + GH_ACTION_SECRET_ACCESS_KEY: ${{ secrets.GH_ACTION_SECRET_ACCESS_KEY }} deploy: name: Deploy diff --git a/.github/workflows/deploy-python.yml b/.github/workflows/deploy-python.yml index a2c8b84..f8d64bf 100644 --- a/.github/workflows/deploy-python.yml +++ b/.github/workflows/deploy-python.yml @@ -72,6 +72,12 @@ on: AWS_ACCOUNT_ID: required: true description: 'AWS Account ID for ECR and deployment access' + GH_ACTION_ACCESS_KEY_ID: + required: false + description: "AWS access key for the S3 cache bucket, used on ARC. Without it ARC builds use the GitHub cache." + GH_ACTION_SECRET_ACCESS_KEY: + required: false + description: "AWS secret key for the S3 cache bucket, used on ARC. Without it ARC builds use the GitHub cache." MANIFEST_REPO_PAT: required: true description: 'GitHub PAT to commit/push to kube-manifests repo' @@ -142,6 +148,8 @@ jobs: SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} AWS_CDN_ACCESS_KEY_ID: ${{ secrets.AWS_CDN_ACCESS_KEY_ID }} AWS_CDN_SECRET_ACCESS_KEY: ${{ secrets.AWS_CDN_SECRET_ACCESS_KEY }} + GH_ACTION_ACCESS_KEY_ID: ${{ secrets.GH_ACTION_ACCESS_KEY_ID }} + GH_ACTION_SECRET_ACCESS_KEY: ${{ secrets.GH_ACTION_SECRET_ACCESS_KEY }} deploy: name: Deploy