From 3472cb1a6a3ac830c6b08c75fa5d57a6aaf54ceb Mon Sep 17 00:00:00 2001 From: Ruslan Kuprieiev Date: Mon, 19 Apr 2021 16:39:37 +0300 Subject: [PATCH] tests: don't set sensitive env secrets for all steps (#5823) Due to https://about.codecov.io/security-update/ , there is a potential that we've leaked these. This PR takes a more granular approach when setting secret env vars so that this doesn't happen in the future. We'll change these secrets after this PR is merged. --- .github/workflows/tests.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index 2ddbcf1ed..206029b32 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -12,10 +12,6 @@ env: DVC_TEST: "true" HOMEBREW_NO_AUTO_UPDATE: 1 SHELL: /bin/bash - GDRIVE_CREDENTIALS_DATA: ${{ secrets.GDRIVE_CREDENTIALS_DATA }} - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - GS_CREDS_JSON: ${{ secrets.GS_CREDS_JSON }} jobs: lint: @@ -85,11 +81,17 @@ jobs: git config --global user.name "DVC Tester" - name: setup gs creds shell: bash + env: + GS_CREDS_JSON: ${{ secrets.GS_CREDS_JSON }} if: env.GS_CREDS_JSON != '' run: | mkdir -p scripts/ci echo "$GS_CREDS_JSON" > scripts/ci/gcp-creds.json - name: run tests + env: + GDRIVE_CREDENTIALS_DATA: ${{ secrets.GDRIVE_CREDENTIALS_DATA }} + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} run: python -m tests --all --cov-report=xml --cov-report=term -n=4 - name: upload coverage report uses: codecov/codecov-action@v1.4.0