ci: passing secrets to workflows. (#4096)

* ci: fix text not replaced

Signed-off-by: Thomas Poignant <[email protected]>

* passing secrets for kotlin

Signed-off-by: Thomas Poignant <[email protected]>

* passing secrets for python

Signed-off-by: Thomas Poignant <[email protected]>

* passing secrets for root release

Signed-off-by: Thomas Poignant <[email protected]>

---------

Signed-off-by: Thomas Poignant <[email protected]>

Author: thomaspoignant

.github/workflows/release-bump-modules.yml

@@ -49,10 +49,10 @@ jobs:
           VERSION: ${{ inputs.version }}
           MODULE_PATH: ${{ inputs.modulePath }}
         with:
-          branch: bump-module-${MODULE_PATH}-${VERSION}
-          title: "chore(dependency): Bump module ${MODULE_PATH} ${VERSION}"
+          branch: bump-module-${{ env.MODULE_PATH}}-${{ env.VERSION }}
+          title: "chore(dependency): Bump module ${{ env.MODULE_PATH }} ${{ env.VERSION }}"
           body: |
-            Automated pull request to bump module  ${MODULE_PATH} ${VERSION}
+            Automated pull request to bump module ${{ env.MODULE_PATH}} ${{ env.VERSION }}
           commit-message: "chore(dependency): Bump module  ${MODULE_PATH} ${VERSION}"
           assignees: thomaspoignant
           draft: false

.github/workflows/release-kotlin-provider.yml

@@ -3,6 +3,12 @@ on:
   workflow_call:
     inputs:
       version: { type: string, required: false }
+    secrets:
+      OSSRH_USERNAME: { required: true }
+      OSSRH_PASSWORD: { required: true }
+      GPG_SIGNING_KEY: { required: true }
+      GPG_SIGNING_KEY_PASSWORD: { required: true }
+      GPG_SIGNING_KEY_ID: { required: true }
 
 permissions:
   actions: read

.github/workflows/release-please.yml

@@ -69,17 +69,29 @@ jobs:
     needs: release-please
     with:
       version: ${{ needs.release-please.outputs.provider_python_version }}
+    secrets:
+      pypi_token: ${{ secrets.PYPI_TOKEN }}
 
   kotlin-provider-release:
     if: ${{ needs.release-please.outputs.provider_kotlin_released == 'true' }}
     uses: ./.github/workflows/release-kotlin-provider.yml
     needs: release-please
     with:
       version: ${{ needs.release-please.outputs.provider_kotlin_version }}
+    secrets:
+      OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+      OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+      GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
+      GPG_SIGNING_KEY_PASSWORD: ${{ secrets.GPG_SIGNING_KEY_PASSWORD }}
+      GPG_SIGNING_KEY_ID: ${{ secrets.GPG_SIGNING_KEY_ID }}
 
   root-release:
     if: ${{ needs.release-please.outputs.root_released == 'true' }}
     uses: ./.github/workflows/release.yml
     needs: release-please
     with:
       version: ${{ needs.release-please.outputs.root_version }}
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      PERSONAL_GITHUB_TOKEN: ${{ secrets.PERSONAL_GITHUB_TOKEN }}

.github/workflows/release-python-provider.yml

@@ -4,7 +4,8 @@ on:
   workflow_call:
     inputs:
       version: { type: string, required: true }
-
+    secrets:
+      pypi_token: { required: true }
 permissions:
   actions: read
   contents: read
@@ -27,4 +28,4 @@ jobs:
         uses: JRubics/poetry-publish@4b3306307f536bbfcb559603629b3b4f6aef5ab8 # v2.1
         with:
           package_directory: ./openfeature/providers/python-provider
-          pypi_token: ${{ secrets.PYPI_TOKEN }}
+          pypi_token: ${{ secrets.pypi_token }}

.github/workflows/release.yml

@@ -3,6 +3,10 @@ on:
   workflow_call:
     inputs:
       version: { type: string, required: true }
+    secrets:  
+      DOCKER_USERNAME: { required: true }
+      DOCKER_PASSWORD: { required: true }
+      PERSONAL_GITHUB_TOKEN: { required: true }
 
 permissions:
   contents: read