use Dagger Secret for CODECOV_TOKEN

fluent-ci-templates · Nov 22, 2023 · e3e35db · e3e35db
1 parent daf7ccc
commit e3e35db
Show file tree

Hide file tree

Showing 4 changed files with 31 additions and 11 deletions.
diff --git a/deps.ts b/deps.ts
@@ -2,8 +2,8 @@ export { assertEquals } from "https://deno.land/std@0.191.0/testing/asserts.ts";
 import { Client } from "./sdk/client.gen.ts";
 export default Client;
 
-export type { DirectoryID } from "./sdk/client.gen.ts";
-export { Directory } from "./sdk/client.gen.ts";
+export type { DirectoryID, SecretID } from "./sdk/client.gen.ts";
+export { Directory, Secret } from "./sdk/client.gen.ts";
 export { connect, uploadContext } from "https://sdk.fluentci.io/v0.3.0/mod.ts";
 export { brightGreen } from "https://deno.land/std@0.191.0/fmt/colors.ts";
 export { withDevbox } from "https://nix.fluentci.io/v0.5.3/src/dagger/steps.ts";

diff --git a/src/dagger/jobs.ts b/src/dagger/jobs.ts
@@ -1,6 +1,6 @@
-import Client, { Directory } from "../../deps.ts";
+import Client, { Directory, Secret } from "../../deps.ts";
 import { connect } from "../../sdk/connect.ts";
-import { getDirectory } from "./lib.ts";
+import { getDirectory, getCodecovToken } from "./lib.ts";
 
 export enum Job {
   upload = "upload",
@@ -14,8 +14,9 @@ export const upload = async (
 ) => {
   await connect(async (client: Client) => {
     const context = getDirectory(client, src);
-    if (!Deno.env.get("CODECOV_TOKEN") && !token) {
-      console.log("CODECOV_TOKEN is not set. Skipping code coverage upload.");
+    const secret = getCodecovToken(client, token);
+    if (!secret) {
+      console.error("CODECOV_TOKEN is not set. Skipping code coverage upload.");
       Deno.exit(1);
     }
 
@@ -34,10 +35,7 @@ export const upload = async (
       .withExec(["mv", "codecov", "/usr/local/bin/codecov"])
       .withDirectory("/app", context, { exclude })
       .withWorkdir("/app")
-      .withEnvVariable(
-        "CODECOV_TOKEN",
-        Deno.env.get("CODECOV_TOKEN") ? Deno.env.get("CODECOV_TOKEN")! : token!
-      )
+      .withSecretVariable("CODECOV_TOKEN", secret)
       .withEnvVariable("CODECOV_URL", Deno.env.get("CODECOV_URL") || "")
       .withExec(["ls", "-la"])
       .withExec([

diff --git a/src/dagger/lib.ts b/src/dagger/lib.ts
@@ -1,4 +1,9 @@
-import Client, { Directory, DirectoryID } from "../../deps.ts";
+import Client, {
+  Directory,
+  DirectoryID,
+  Secret,
+  SecretID,
+} from "../../deps.ts";
 
 export const getDirectory = (
   client: Client,
@@ -11,3 +16,19 @@ export const getDirectory = (
   }
   return src instanceof Directory ? src : client.host().directory(src);
 };
+
+export const getCodecovToken = (client: Client, token?: string | Secret) => {
+  if (Deno.env.get("CODECOV_TOKEN")) {
+    return client.setSecret("CODECOV_TOKEN", Deno.env.get("CODECOV_TOKEN")!);
+  }
+  if (token && typeof token === "string") {
+    if (token.startsWith("core.Secret")) {
+      return client.loadSecretFromID(token as SecretID);
+    }
+    return client.setSecret("CODECOV_TOKEN", token);
+  }
+  if (token && token instanceof Secret) {
+    return token;
+  }
+  return undefined;
+};
diff --git a/src/dagger/schema.ts b/src/dagger/schema.ts
@@ -33,6 +33,7 @@ const schema = makeSchema({
 
 schema.description = JSON.stringify({
   "upload.src": "directory",
+  "upload.token": "secret",
 });
 
 export { schema };