From 44e06cea1e060948a1d09a5f8b36681a69327086 Mon Sep 17 00:00:00 2001 From: Lior Poterman <191881919+cx-lior-poterman@users.noreply.github.com> Date: Wed, 26 Aug 2026 11:43:32 +0300 Subject: [PATCH] fix(ci): correct release workflow secret aliasing and drop unused secrets The Secrets Manager step used the secret's ARN as both the secret-id and implicit alias, which produced env vars like CHECKMARX_PUBLIC_SECRETS_APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 instead of the un-prefixed names the rest of the workflow expects, breaking Apple code-signing cert import. Use a blank alias (leading comma) so env var names match the secret's JSON keys directly. Also removes the now-unused DOCKER_PASSWORD/DOCKER_USERNAME workflow_call secrets (Docker Hub now uses OIDC per #1546) and PERSONAL_ACCESS_TOKEN / GO_BOT_TOKEN, whose only consumer (the Homebrew tap publisher) is commented out in .goreleaser.yml. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 79e7f4c9..2d10540a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,12 +31,6 @@ on: required: true COSIGN_PUBLIC_KEY: required: true - DOCKER_PASSWORD: - required: true - DOCKER_USERNAME: - required: true - PERSONAL_ACCESS_TOKEN: - required: true S3_BUCKET_NAME: required: true S3_BUCKET_REGION: @@ -100,7 +94,7 @@ jobs: uses: step-security/aws-secretsmanager-get-secrets@102b6b2a2528747bcc321bb99ef326d8be7ef58f # v3.0.1 with: secret-ids: | - ${{ secrets.SECRET_MANAGER_SECRET_NAME }} + ,${{ secrets.SECRET_MANAGER_SECRET_NAME }} parse-json-secrets: true - name: Import Code-Signing Certificates uses: Apple-Actions/import-codesign-certs@253ddeeac23f2bdad1646faac5c8c2832e800071 #v1 @@ -183,7 +177,6 @@ jobs: args: ${{ env.GR_ARGS }} env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GO_BOT_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }} S3_BUCKET_NAME: ${{ secrets.S3_BUCKET_NAME }} S3_BUCKET_REGION: ${{ secrets.S3_BUCKET_REGION }} SIGNING_REMOTE_SSH_USER: ${{ secrets.SIGNING_REMOTE_SSH_USER }}