From 4245b69744ac33fbbb860fb2140e129e1489e352 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nuno=20Sim=C3=B5es?= Date: Thu, 4 Jun 2026 19:42:32 +0200 Subject: [PATCH] Pass explicit secrets to reusable server CI workflows (#36896) --- .github/workflows/i18n-ci-pr.yml | 1 - .github/workflows/mmctl-test-template.yml | 9 +++++++++ .github/workflows/server-ci-nightly-race.yml | 1 - .github/workflows/server-ci-weekly.yml | 10 +++++++--- .github/workflows/server-ci.yml | 17 +++++++++++------ .github/workflows/server-test-template.yml | 9 +++++++++ 6 files changed, 36 insertions(+), 11 deletions(-) diff --git a/.github/workflows/i18n-ci-pr.yml b/.github/workflows/i18n-ci-pr.yml index f9a2f7a5708..c4b3671fa15 100644 --- a/.github/workflows/i18n-ci-pr.yml +++ b/.github/workflows/i18n-ci-pr.yml @@ -22,4 +22,3 @@ jobs: permissions: contents: read uses: ./.github/workflows/i18n-ci-template.yml - secrets: inherit diff --git a/.github/workflows/mmctl-test-template.yml b/.github/workflows/mmctl-test-template.yml index 72ef122d40a..e91a02eaf7b 100644 --- a/.github/workflows/mmctl-test-template.yml +++ b/.github/workflows/mmctl-test-template.yml @@ -21,6 +21,15 @@ on: required: false default: false type: boolean + secrets: + # Only if fips-enabled is true + DOCKERHUB_USERNAME: + required: false + DOCKERHUB_TOKEN: + required: false + # Only master / release and there is report + MM_E2E_ZEPHYR_API_KEY: + required: false permissions: contents: read diff --git a/.github/workflows/server-ci-nightly-race.yml b/.github/workflows/server-ci-nightly-race.yml index 10d127fcc5a..f9cb62afbab 100644 --- a/.github/workflows/server-ci-nightly-race.yml +++ b/.github/workflows/server-ci-nightly-race.yml @@ -43,7 +43,6 @@ jobs: contents: read actions: write uses: ./.github/workflows/server-test-template.yml - secrets: inherit with: name: Race Detector datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10 diff --git a/.github/workflows/server-ci-weekly.yml b/.github/workflows/server-ci-weekly.yml index 1c51c1a2b88..18aa48f1639 100644 --- a/.github/workflows/server-ci-weekly.yml +++ b/.github/workflows/server-ci-weekly.yml @@ -44,7 +44,6 @@ jobs: contents: read actions: write uses: ./.github/workflows/server-test-template.yml - secrets: inherit with: name: Postgres with binary parameters datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10&binary_parameters=yes @@ -64,7 +63,9 @@ jobs: contents: read actions: write uses: ./.github/workflows/server-test-template.yml - secrets: inherit + secrets: + DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} with: name: Postgres FIPS datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10 @@ -82,7 +83,10 @@ jobs: contents: read actions: write uses: ./.github/workflows/mmctl-test-template.yml - secrets: inherit + secrets: + DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} + MM_E2E_ZEPHYR_API_KEY: ${{ secrets.MM_E2E_ZEPHYR_API_KEY }} with: name: mmctl datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10 diff --git a/.github/workflows/server-ci.yml b/.github/workflows/server-ci.yml index 0b9669ee281..57b99ff4f56 100644 --- a/.github/workflows/server-ci.yml +++ b/.github/workflows/server-ci.yml @@ -291,7 +291,8 @@ jobs: contents: read actions: write uses: ./.github/workflows/server-test-template.yml - secrets: inherit + secrets: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: name: "Postgres (shard ${{ matrix.shard }})" datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10 @@ -325,7 +326,6 @@ jobs: contents: read actions: write uses: ./.github/workflows/server-test-template.yml - secrets: inherit with: name: Elasticsearch v8 Compatibility datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10 @@ -343,7 +343,6 @@ jobs: contents: read actions: write uses: ./.github/workflows/server-test-template.yml - secrets: inherit with: name: OpenSearch v2 Compatibility datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10 @@ -368,7 +367,9 @@ jobs: contents: read actions: write uses: ./.github/workflows/server-test-template.yml - secrets: inherit + secrets: + DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} with: name: "Postgres FIPS (shard ${{ matrix.shard }})" datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10 @@ -397,7 +398,8 @@ jobs: contents: read actions: write uses: ./.github/workflows/mmctl-test-template.yml - secrets: inherit + secrets: + MM_E2E_ZEPHYR_API_KEY: ${{ secrets.MM_E2E_ZEPHYR_API_KEY }} with: name: mmctl datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10 @@ -413,7 +415,10 @@ jobs: contents: read actions: write uses: ./.github/workflows/mmctl-test-template.yml - secrets: inherit + secrets: + DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} + MM_E2E_ZEPHYR_API_KEY: ${{ secrets.MM_E2E_ZEPHYR_API_KEY }} with: name: mmctl datasource: postgres://mmuser:mostest-fips-test@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10 diff --git a/.github/workflows/server-test-template.yml b/.github/workflows/server-test-template.yml index 288349c88d1..667b16e9e88 100644 --- a/.github/workflows/server-test-template.yml +++ b/.github/workflows/server-test-template.yml @@ -64,6 +64,15 @@ on: required: false type: boolean default: false + secrets: + # Only if enablecoverage is true + CODECOV_TOKEN: + required: false + # Only if fips-enabled is true + DOCKERHUB_USERNAME: + required: false + DOCKERHUB_TOKEN: + required: false permissions: contents: read