Pass Control Plane token to cpflow steps

Author: justin808

.github/workflows/cpflow-cleanup-stale-review-apps.yml

@@ -48,6 +48,7 @@ jobs:
 
       - name: Remove stale review apps
         env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
           REVIEW_APP_PREFIX: ${{ vars.REVIEW_APP_PREFIX }}
           CPLN_ORG_STAGING: ${{ vars.CPLN_ORG_STAGING }}
         shell: bash

.github/workflows/cpflow-delete-review-app.yml

@@ -109,6 +109,8 @@ jobs:
       - name: Delete review app
         if: steps.config.outputs.ready == 'true'
         uses: ./.github/actions/cpflow-delete-control-plane-app
+        env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
         with:
           app_name: ${{ env.APP_NAME }}
           cpln_org: ${{ vars.CPLN_ORG_STAGING }}

.github/workflows/cpflow-deploy-review-app.yml

@@ -216,6 +216,8 @@ jobs:
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true'
         id: check-app
         working-directory: app
+        env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
         shell: bash
         run: |
           set -euo pipefail
@@ -261,6 +263,8 @@ jobs:
         id: setup-review-app
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true' && steps.check-app.outputs.exists != 'true' && github.event_name != 'pull_request'
         working-directory: app
+        env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
         shell: bash
         run: |
           set -euo pipefail
@@ -347,6 +351,8 @@ jobs:
       - name: Build Docker image
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true' && (steps.check-app.outputs.exists == 'true' || steps.setup-review-app.outcome == 'success')
         uses: ./.github/actions/cpflow-build-docker-image
+        env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
         with:
           app_name: ${{ env.APP_NAME }}
           org: ${{ vars.CPLN_ORG_STAGING }}
@@ -387,6 +393,7 @@ jobs:
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true' && (steps.check-app.outputs.exists == 'true' || steps.setup-review-app.outcome == 'success')
         working-directory: app
         env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
           RELEASE_PHASE_FLAG: ${{ steps.release-phase.outputs.flag }}
         shell: bash
         run: |
@@ -404,6 +411,8 @@ jobs:
         if: steps.config.outputs.ready == 'true' && steps.source.outputs.allowed == 'true' && (steps.check-app.outputs.exists == 'true' || steps.setup-review-app.outcome == 'success')
         id: workload
         working-directory: app
+        env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
         shell: bash
         run: |
           set -euo pipefail

.github/workflows/cpflow-deploy-staging.yml

@@ -91,6 +91,8 @@ jobs:
 
       - name: Build Docker image
         uses: ./.github/actions/cpflow-build-docker-image
+        env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
         with:
           app_name: ${{ env.APP_NAME }}
           org: ${{ vars.CPLN_ORG_STAGING }}
@@ -126,6 +128,7 @@ jobs:
 
       - name: Deploy staging image
         env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
           RELEASE_PHASE_FLAG: ${{ steps.release-phase.outputs.flag }}
         shell: bash
         run: |

.github/workflows/cpflow-promote-staging-to-production.yml

@@ -162,6 +162,7 @@ jobs:
       - name: Capture current production image
         id: capture-current
         env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_PRODUCTION }}
           PRODUCTION_APP_NAME: ${{ vars.PRODUCTION_APP_NAME }}
           CPLN_ORG_PRODUCTION: ${{ vars.CPLN_ORG_PRODUCTION }}
           WORKLOAD_NAMES: ${{ steps.workloads.outputs.names }}
@@ -271,6 +272,7 @@ jobs:
 
       - name: Copy image from staging
         env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_PRODUCTION }}
           # Pass the upstream token via env rather than `-t` so it doesn't appear in /proc/<pid>/cmdline.
           CPLN_UPSTREAM_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
           PRODUCTION_APP_NAME: ${{ vars.PRODUCTION_APP_NAME }}
@@ -283,6 +285,7 @@ jobs:
 
       - name: Deploy image to production
         env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_PRODUCTION }}
           PRODUCTION_APP_NAME: ${{ vars.PRODUCTION_APP_NAME }}
           CPLN_ORG_PRODUCTION: ${{ vars.CPLN_ORG_PRODUCTION }}
           RELEASE_PHASE_FLAG: ${{ steps.release-phase.outputs.flag }}
@@ -301,6 +304,8 @@ jobs:
       - name: Wait for deployment health
         id: health-check
         uses: ./.github/actions/cpflow-wait-for-health
+        env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_PRODUCTION }}
         with:
           workload_name: ${{ env.PRIMARY_WORKLOAD || 'rails' }}
           app_name: ${{ vars.PRODUCTION_APP_NAME }}
@@ -312,6 +317,7 @@ jobs:
       - name: Roll back on failure
         if: failure() && steps.capture-current.outputs.rollback_state != '' && steps.capture-current.outputs.rollback_state != '{}'
         env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_PRODUCTION }}
           ROLLBACK_STATE: ${{ steps.capture-current.outputs.rollback_state }}
           PRODUCTION_APP_NAME: ${{ vars.PRODUCTION_APP_NAME }}
           CPLN_ORG_PRODUCTION: ${{ vars.CPLN_ORG_PRODUCTION }}
@@ -378,6 +384,7 @@ jobs:
       - name: Wait for rollback readiness
         if: failure() && steps.capture-current.outputs.rollback_state != '' && steps.capture-current.outputs.rollback_state != '{}'
         env:
+          CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_PRODUCTION }}
           ROLLBACK_STATE: ${{ steps.capture-current.outputs.rollback_state }}
           PRODUCTION_APP_NAME: ${{ vars.PRODUCTION_APP_NAME }}
           CPLN_ORG_PRODUCTION: ${{ vars.CPLN_ORG_PRODUCTION }}