[skip jenkins] Add gpg key and adjust workflow label#700
Merged
Conversation
Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Zeitsperre
requested review from
fmigneault,
mishaschwartz and
tlvu
as code owners
Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/4275/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : add-gpg-key DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-118.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/820/NOTEBOOK TEST RESULTS |
fmigneault
reviewed
May 15, 2026
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/4276/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : add-gpg-key DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-154.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/821/NOTEBOOK TEST RESULTS |
Collaborator
|
Just curious, last time the create-tag workflow failed (https://github.com/bird-house/birdhouse-deploy/actions/runs/25896036654/job/76109218802) was because the git username was not set. So adding the GPG key will solve that? Is it possible to reference in that |
fmigneault
approved these changes
May 15, 2026
Member
Author
Precisely. The GPG key has a username and email associated with it.
I suppose I can add this somewhere, sure. |
Collaborator
Ah, thanks for the explanation. I was trying to connect the dots! This GPG key is the bot's one, not your personal GPG right? |
Member
Author
|
Indeed, the GPG key is the bot one, but it's tied to my account as we don't have a bot account that we could use. |
Collaborator
So the commit author is still you? We currently have this bot user https://github.com/ouranos-deploy, would that work? The credential to this bot user already shared via our credential sharing mechanism if you need it. |
Member
Author
|
I could definitely migrate the key, or I could create a new one with that user. We're using this key in a few places already, so it would make sense to do this at the org level. Would it be cleaner to make a |
Collaborator
Ah oops forgot this is bird-house org. Yes that would be cleaner. So we need one bot user per org? If we have a generic user like I wouldn't consider this blocking. We can merge this PR now and switch the user in a different one. I am guessing a name debate for the new bot user would take some time. |
tlvu
approved these changes
May 19, 2026
Collaborator
tlvu
left a comment
tlvu
left a comment
There was a problem hiding this comment.
Please just add some docs for future maintainer.
Member
Author
|
I'm hesitant to have a shared user bot across multiple orgs, simply for security reasons. Sharing access/responsibility according to our respective orgs seems safer/easier.
|
Collaborator
Name debate possible for shared bot only. If we're going the separate bot per org then yes it's simpler for the naming. Up to you guys. |
Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
github-actions
Bot
added
the
documentation
Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Member
Author
|
This is good to go, AFAIC! |
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/4281/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : add-gpg-key DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-118.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/823/NOTEBOOK TEST RESULTS |
Collaborator
|
Good for me, thanks. |
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/4282/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : add-gpg-key DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-154.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/824/NOTEBOOK TEST RESULTS |
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/4283/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : add-gpg-key DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-133.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/825/NOTEBOOK TEST RESULTS |
Member
Author
|
@mishaschwartz This PR will fix the tagging workflow! |
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/4321/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : add-gpg-key DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-118.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/842/NOTEBOOK TEST RESULTS |
Collaborator
@Zeitsperre FYI we have all 3 approved this PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
This PR includes two very small adjustments required for normal GitHub Workflow operations.
A GPG Key specific for Bird-house projects has now been added (with access to this repo enabled). This should have been in my original PR, but I forgot to add it.
The other change is a label adjustment to address a small race condition.
This also adds a section to the README explaining the privileges and keys required in order to run the various GitHub Workflows.
Changes
Non-breaking changes
create-tag.ymlworkflow.auto-accept-ci-changes.ymlto thegithub_actionslabel.birdhouse/README.rstthat explains the settings required for GitHub Workflows.Additional Information
The
label.ymlworkflow that categorized PRs as "ci/operations" would only be completed after theauto-accept-ci-changes.ymlalready has started. This meant that the only time that this workflow would properly work would be after a change was pushed to the branch after being opened.