Skip to content

ci: keep AZURE_OPENAI_API_KEY out of pull request runs #323

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Krishnadheeraj (DheerajPannala) merged 3 commits into from
Oct 27, 2026
Merged

ci: keep AZURE_OPENAI_API_KEY out of pull request runs #323

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3086018
ci: don't expose AZURE_OPENAI_API_KEY to pull request runs
DheerajPannala Oct 15, 2026
0ac1e55
Merge main into users/DheerajPannala/glasswing-ci-secret
DheerajPannala Oct 27, 2026
ab250a6
ci: run integration tests in a push-only job bound to a protected env…
DheerajPannala Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 57 additions & 10 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,16 +94,6 @@ jobs:
- name: Run tests
run: npm test

- name: Run integration tests
env:
AZURE_OPENAI_API_KEY: ${{ secrets.AZURE_OPENAI_API_KEY }}
AZURE_OPENAI_ENDPOINT: ${{ vars.AZURE_OPENAI_ENDPOINT }}
AZURE_OPENAI_DEPLOYMENT: ${{ vars.AZURE_OPENAI_DEPLOYMENT }}
AZURE_OPENAI_API_VERSION: ${{ vars.AZURE_OPENAI_API_VERSION }}
ENABLE_OBSERVABILITY: ${{ vars.ENABLE_OBSERVABILITY }}
run: |
npm run test:integration

- name: Pack packages
run: npm run pack

Expand All @@ -123,3 +113,60 @@ jobs:
# run: npm publish
# env:
# NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

integration-tests:
name: Integration tests
needs: [nodejs-sdk]
# Pull request workflows can be edited by the PR author, so the Azure OpenAI key lives in the
# integration-tests environment, which only allows deployments from main.
if: github.event_name == 'push'
runs-on: ubuntu-latest
environment: integration-tests
permissions:
contents: read

strategy:
matrix:
node-version: ['18', '20']

steps:
- name: Checkout repository
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
fetch-depth: 0

- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
name: Install pnpm
with:
run_install: false

- name: Set up Node.js ${{ matrix.node-version }}
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version: ${{ matrix.node-version }}
cache: 'pnpm'
cache-dependency-path: '**/pnpm-lock.yaml'

- name: Setup pnpm
uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
with:
version: 10.20.0

- name: Install dependencies
run: pnpm i

- name: Set version with Nerdbank.GitVersioning
run: node setVersion.js

- name: Build package
run: npm run build

- name: Run integration tests
env:
AZURE_OPENAI_API_KEY: ${{ secrets.AZURE_OPENAI_API_KEY }}
AZURE_OPENAI_ENDPOINT: ${{ vars.AZURE_OPENAI_ENDPOINT }}
AZURE_OPENAI_DEPLOYMENT: ${{ vars.AZURE_OPENAI_DEPLOYMENT }}
AZURE_OPENAI_API_VERSION: ${{ vars.AZURE_OPENAI_API_VERSION }}
ENABLE_OBSERVABILITY: ${{ vars.ENABLE_OBSERVABILITY }}
run: |
npm run test:integration
Loading