Use GitHub deploy keys rather than personal access tokens about continuous_analysis HOT 7 CLOSED

As @gwaygenomics and I just saw, it also seems to be easy for $git_publish_key to leak into the CI log.

This means you would have to redact logs before sharing.

from continuous_analysis.

Agree. It should be noted that github does deactivate any keys accidentally pushed to a repository but any other way of distributing could result in the key leaking into the log.

I think Drone 0.5 offers the best solution, pushing back to github is a supported workflow. You can also mount local drives. I am working on updating the docs for this but a nice example can be seen at - https://github.com/COMBINE-lab/continuous_analysis_rnaseq

from continuous_analysis.

Cool, so COMBINE-lab/continuous_analysis_rnaseq looks like it uses the Drone git-push plugin that uses SSH keys.

How does the GIT_PUSH_SSH_KEY get set? That wasn't entirely clear to me from the COMBINE-lab/continuous_analysis_rnaseq repo.

from continuous_analysis.

Are you going to update .travis.yml to use deploy keys? I'd be happy to submit a PR.

from continuous_analysis.

@dhimmel if you want to submit a PR that'd be great

@rob-p would be best to answer the COMBINE-lab example

from continuous_analysis.

@dhimmel --- The variant of the pipeline I built uses Drone's git_push plugin to push the results. Drone has a notion of "secrets". There is a secret "store" that is managed by the drone command line interface. You simply add the GIT_PUSH_SSH_KEY to the store and then sign your .drone.yml file to propagate the key. You can see an example here.

from continuous_analysis.

Closed because I think Rob answered the question, and it’s now almost 5 months old so just cleaning. If you want to make a pull request to demonstrate that’d be great but I was afraid it’d be too complicated for the average user (and github does a good job of reducing risk by inactivating any leaky keys)

from continuous_analysis.