From 37d4f058fa6641366bfee248c419cd24b2b1a7a9 Mon Sep 17 00:00:00 2001
From: aboyko <aboyko@vmware.com>
Date: Wed, 8 Nov 2023 16:17:29 -0500
Subject: [PATCH] GHA: Tests passing env vars to another job

---
 .github/scripts/akamai-aws-cli-env.sh         | 12 ++++++++
 .github/workflows/akamai-test.yml             | 28 +++++++++++++++++++
 .../workflows/eclipse-ls-extensions-build.yml |  4 +--
 eclipse-language-servers/pom.xml              |  6 ++--
 4 files changed, 44 insertions(+), 6 deletions(-)
 create mode 100755 .github/scripts/akamai-aws-cli-env.sh

diff --git a/.github/scripts/akamai-aws-cli-env.sh b/.github/scripts/akamai-aws-cli-env.sh
new file mode 100755
index 000000000..4a461a3b6
--- /dev/null
+++ b/.github/scripts/akamai-aws-cli-env.sh
@@ -0,0 +1,12 @@
+# Akamai supports assumeRole for Cloudgate S3 access
+# The script asks for temp credentials to be able to upload to Akamai S3 origin bucket
+# The AWS CLI environment variables are then updated with temp credentials values
+session_name=$1
+duration_seconds=$2
+export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s" \
+$(aws sts assume-role \
+--role-arn arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }} \
+--role-session-name $session_name \
+--duration-seconds $duration_seconds \
+--query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
+--output text))
diff --git a/.github/workflows/akamai-test.yml b/.github/workflows/akamai-test.yml
index 81e8cca35..880ad78b2 100644
--- a/.github/workflows/akamai-test.yml
+++ b/.github/workflows/akamai-test.yml
@@ -4,9 +4,14 @@ on:
   workflow_dispatch:
 
 jobs:
+
   akamai-upload:
     name: Upload to Akamai
     runs-on: ubuntu-latest
+    outputs:
+      key_id: ${{ steps.gen-upload.outputs.key_id }}
+      key_secret: ${{ steps.gen-upload.outputs.key_secret }}
+      session_token: ${{ steps.gen-upload.outputs.session_token }}
     steps:
       - name: Gen file and upload
         id: gen-upload
@@ -22,6 +27,29 @@ jobs:
           $(aws sts assume-role \
           --role-arn arn:aws:iam::${{ secrets.TOOLS_CLOUDGATE_ACCOUNT_ID }}:role/${{ secrets.TOOLS_CLOUDGATE_USER }} \
           --role-session-name gha-upload \
+          --duration-seconds=10 \
           --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
           --output text))
           aws s3 mv ./$file s3://tools-spring-io/test-akamai/$file
+          aws s3 rm s3://tools-spring-io/test-akamai/$file
+          echo "key_id=${AWS_ACCESS_KEY_ID}" >> $GITHUB_OUTPUT
+          echo "key_secret=${AWS_SECRET_ACCESS_KEY}" >> $GITHUB_OUTPUT
+          echo "session_token=${AWS_SESSION_TOKEN}" >> $GITHUB_OUTPUT
+
+  akamai-test:
+    name: Test Akamai
+    runs-on: ubuntu-latest
+    needs: [ akamai-upload ]
+    steps:
+      - name: Test Environment
+        env:
+          AWS_ACCESS_KEY_ID: ${{ needs.akamai-upload.outputs.key_id }}
+          AWS_SECRET_ACCESS_KEY: ${{ needs.akamai-upload.outputs.key_secret }}
+          AWS_SESSION_TOKEN: ${{ needs.akamai-upload.outputs.session_token }}
+        run: |
+          echo $AWS_ACCESS_KEY_ID
+          echo $AWS_SECRET_ACCESS_KEY
+          echo $AWS_SESSION_TOKEN
+
+
+
diff --git a/.github/workflows/eclipse-ls-extensions-build.yml b/.github/workflows/eclipse-ls-extensions-build.yml
index 145639736..f794bce39 100644
--- a/.github/workflows/eclipse-ls-extensions-build.yml
+++ b/.github/workflows/eclipse-ls-extensions-build.yml
@@ -63,8 +63,8 @@ jobs:
           echo "${{ secrets.GPG_PASSPHRASE }}" | gpg --batch --yes --passphrase-fd 0 --import gpg.asc
       - name: Build Eclipse LS extensions
         env:
-          tools_s3_access_key: ${{ secrets.TOOLS_S3_ACCESS_KEY }}
-          tools_s3_secret_key: ${{ secrets.TOOLS_S3_SECRET_KEY  }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.TOOLS_S3_ACCESS_KEY }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.TOOLS_S3_SECRET_KEY  }}
           gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }}
           gpg_keyname: ${{ secrets.GPG_KEYID }}
         run: |
diff --git a/eclipse-language-servers/pom.xml b/eclipse-language-servers/pom.xml
index 6664e1b40..873fb964f 100644
--- a/eclipse-language-servers/pom.xml
+++ b/eclipse-language-servers/pom.xml
@@ -90,8 +90,8 @@
 		<tycho-version>4.0.0</tycho-version>
 		<encoding>UTF-8</encoding>
 
-		<dist.accessKey>${env.bamboo_vault_tools_s3_accesskey_password}</dist.accessKey>
-		<dist.secretKey>${env.bamboo_vault_tools_s3_secretkey_password}</dist.secretKey>
+		<dist.accessKey>${env.AWS_ACCESS_KEY_ID}</dist.accessKey>
+		<dist.secretKey>${env.AWS_SECRET_ACCESS_KEY}</dist.secretKey>
 
 		<dist.bucket>dist.springsource.com</dist.bucket>
 		<dist.key>TOOLS</dist.key>
@@ -134,8 +134,6 @@
 		<profile>
 			<id>gitactions</id>
 			<properties>
-				<dist.accessKey>${env.tools_s3_access_key}</dist.accessKey>
-				<dist.secretKey>${env.tools_s3_secret_key}</dist.secretKey>
 				<gpg.passphrase>${env.gpg_passphrase}</gpg.passphrase>
 				<gpg.keyname>${env.gpg_keyname}</gpg.keyname>
 				<gpg.homedir>${env.gpg_homedir}</gpg.homedir>