fix(ci): modify shell.exec as per evergreen instructions to avoid lea…

…king any secrets MONGOSH-1704 (#1817) * fix: modify shell.exec as per evergreen instructions to avoid leaking any secrets * fix: fix for incorrect file permissions * Update .evergreen/run-evergreen-release.sh Co-authored-by: Anna Henningsen <[email protected]> --------- Co-authored-by: Anna Henningsen <[email protected]>
mongodb-js · Feb 9, 2024 · cbaeef2 · cbaeef2
1 parent 48fbb7f
commit cbaeef2
Show file tree

Hide file tree

Showing 5 changed files with 71 additions and 64 deletions.
diff --git a/.evergreen.yml b/.evergreen.yml
@@ -6561,24 +6561,18 @@ functions:
 
   write_preload_script:
     - command: shell.exec
+      silent: true
       type: setup
       params:
         working_dir: src
         shell: bash
+        env:
+          connectivity_test_atlas_username: ${connectivity_test_atlas_username}
+          connectivity_test_atlas_password: ${connectivity_test_atlas_password}
+          connectivity_test_atlas_hostname: ${connectivity_test_atlas_hostname}
         script: |
           set -e
-          set +x
-          cat <<PRELOAD_SCRIPT > preload.sh
-          echo "Preload script starting"
-          set -e
-          set -x
-          export ARTIFACT_URL=$(cat ../artifact-url.txt)
-          export IS_CI=1
-          set +x
-          export MONGOSH_SMOKE_TEST_SERVER="mongodb+srv://${connectivity_test_atlas_username}:${connectivity_test_atlas_password}@${connectivity_test_atlas_hostname}/"
-          echo "Preload script done"
-          set -x
-          PRELOAD_SCRIPT
+          .evergreen/create-preload-script.sh
   spawn_host:
     - command: host.create
       type: setup
@@ -6596,17 +6590,16 @@ functions:
         wait: true
   run_pkg_tests_through_ssh:
     - command: shell.exec
+      silent: true
       type: setup
       params:
+        working_dir: src
         shell: bash
+        env:
+          __project_aws_ssh_key_value: ${__project_aws_ssh_key_value}
         script: |
           set -e
-          {
-          set +x
-          echo '${__project_aws_ssh_key_value}' > ~/.ssh/mcipacker.pem
-          chmod 0600 ~/.ssh/mcipacker.pem
-          set -x
-          }
+          .evergreen/setup-ssh-key.sh
     - command: subprocess.exec
       params:
         working_dir: src
@@ -6851,18 +6844,16 @@ functions:
         file: tmp/expansions.yaml
         redacted: true
     - command: shell.exec
+      silent: true
+      env:
+        devtoolsbot_npm_token: ${devtoolsbot_npm_token}
+        node_js_version: ${node_js_version}
       params:
         working_dir: src
         shell: bash
         script: |
           set -e
-          {
-          echo "//registry.npmjs.org/:_authToken=${devtoolsbot_npm_token}" > .npmrc
-          export NODE_JS_VERSION=${node_js_version}
-          source .evergreen/setup-env.sh
-          export PUPPETEER_SKIP_CHROMIUM_DOWNLOAD="true"
-          npm run evergreen-release publish -- --dry-run
-          }
+          .evergreen/run-evergreen-release.sh -- --dry-run
 
   release_publish:
     - command: expansions.write
@@ -6871,18 +6862,16 @@ functions:
         file: tmp/expansions.yaml
         redacted: true
     - command: shell.exec
+      silent: true
+      env:
+        devtoolsbot_npm_token: ${devtoolsbot_npm_token}
+        node_js_version: ${node_js_version}
       params:
         working_dir: src
         shell: bash
         script: |
           set -e
-          {
-          echo "//registry.npmjs.org/:_authToken=${devtoolsbot_npm_token}" > .npmrc
-          export NODE_JS_VERSION=${node_js_version}
-          source .evergreen/setup-env.sh
-          export PUPPETEER_SKIP_CHROMIUM_DOWNLOAD="true"
-          npm run evergreen-release publish
-          }
+          .evergreen/run-evergreen-release.sh
 
 # Tasks will show up as the individual blocks in the Evergreen UI that can
 # pass or fail.

diff --git a/.evergreen/create-preload-script.sh b/.evergreen/create-preload-script.sh
@@ -0,0 +1,14 @@
+#! /usr/bin/env bash
+set -e
+set +x
+cat <<PRELOAD_SCRIPT > preload.sh
+echo "Preload script starting"
+set -e
+set -x
+export ARTIFACT_URL=$(cat ../artifact-url.txt)
+export IS_CI=1
+set +x
+export MONGOSH_SMOKE_TEST_SERVER="mongodb+srv://${connectivity_test_atlas_username}:${connectivity_test_atlas_password}@${connectivity_test_atlas_hostname}/"
+echo "Preload script done"
+set -x
+PRELOAD_SCRIPT
diff --git a/.evergreen/evergreen.yml.in b/.evergreen/evergreen.yml.in
@@ -513,24 +513,18 @@ functions:
 
   write_preload_script:
     - command: shell.exec
+      silent: true
       type: setup
       params:
         working_dir: src
         shell: bash
+        env:
+          connectivity_test_atlas_username: ${connectivity_test_atlas_username}
+          connectivity_test_atlas_password: ${connectivity_test_atlas_password}
+          connectivity_test_atlas_hostname: ${connectivity_test_atlas_hostname}
         script: |
           set -e
-          set +x
-          cat <<PRELOAD_SCRIPT > preload.sh
-          echo "Preload script starting"
-          set -e
-          set -x
-          export ARTIFACT_URL=$(cat ../artifact-url.txt)
-          export IS_CI=1
-          set +x
-          export MONGOSH_SMOKE_TEST_SERVER="mongodb+srv://${connectivity_test_atlas_username}:${connectivity_test_atlas_password}@${connectivity_test_atlas_hostname}/"
-          echo "Preload script done"
-          set -x
-          PRELOAD_SCRIPT
+          .evergreen/create-preload-script.sh
   spawn_host:
     - command: host.create
       type: setup
@@ -548,17 +542,16 @@ functions:
         wait: true
   run_pkg_tests_through_ssh:
     - command: shell.exec
+      silent: true
       type: setup
       params:
+        working_dir: src
         shell: bash
+        env:
+          __project_aws_ssh_key_value: ${__project_aws_ssh_key_value}
         script: |
           set -e
-          {
-          set +x
-          echo '${__project_aws_ssh_key_value}' > ~/.ssh/mcipacker.pem
-          chmod 0600 ~/.ssh/mcipacker.pem
-          set -x
-          }
+          .evergreen/setup-ssh-key.sh
     - command: subprocess.exec
       params:
         working_dir: src
@@ -803,18 +796,16 @@ functions:
         file: tmp/expansions.yaml
         redacted: true
     - command: shell.exec
+      silent: true
+      env:
+        devtoolsbot_npm_token: ${devtoolsbot_npm_token}
+        node_js_version: ${node_js_version}
       params:
         working_dir: src
         shell: bash
         script: |
           set -e
-          {
-          echo "//registry.npmjs.org/:_authToken=${devtoolsbot_npm_token}" > .npmrc
-          export NODE_JS_VERSION=${node_js_version}
-          source .evergreen/setup-env.sh
-          export PUPPETEER_SKIP_CHROMIUM_DOWNLOAD="true"
-          npm run evergreen-release publish -- --dry-run
-          }
+          .evergreen/run-evergreen-release.sh -- --dry-run
 
   release_publish:
     - command: expansions.write
@@ -823,18 +814,16 @@ functions:
         file: tmp/expansions.yaml
         redacted: true
     - command: shell.exec
+      silent: true
+      env:
+        devtoolsbot_npm_token: ${devtoolsbot_npm_token}
+        node_js_version: ${node_js_version}
       params:
         working_dir: src
         shell: bash
         script: |
           set -e
-          {
-          echo "//registry.npmjs.org/:_authToken=${devtoolsbot_npm_token}" > .npmrc
-          export NODE_JS_VERSION=${node_js_version}
-          source .evergreen/setup-env.sh
-          export PUPPETEER_SKIP_CHROMIUM_DOWNLOAD="true"
-          npm run evergreen-release publish
-          }
+          .evergreen/run-evergreen-release.sh
 
 # Tasks will show up as the individual blocks in the Evergreen UI that can
 # pass or fail.

diff --git a/.evergreen/run-evergreen-release.sh b/.evergreen/run-evergreen-release.sh
@@ -0,0 +1,9 @@
+#! /usr/bin/env bash
+set -e
+
+echo "//registry.npmjs.org/:_authToken=${devtoolsbot_npm_token}" > .npmrc
+set -x
+export NODE_JS_VERSION=${node_js_version}
+source .evergreen/setup-env.sh
+export PUPPETEER_SKIP_CHROMIUM_DOWNLOAD="true"
+npm run evergreen-release publish $@
diff --git a/.evergreen/setup-ssh-key.sh b/.evergreen/setup-ssh-key.sh
@@ -0,0 +1,6 @@
+#! /usr/bin/env bash
+
+set -e
+set +x
+echo "${__project_aws_ssh_key_value}" > ~/.ssh/mcipacker.pem
+chmod 0600 ~/.ssh/mcipacker.pem