Remove SSH setup action (#1300)

This removes our custom SSH setup action in favor of some logic within the test that needs it.
pulumi · Dec 9, 2024 · d983eca · d983eca
1 parent 3d6cde8
commit d983eca
Show file tree

Hide file tree

Showing 7 changed files with 54 additions and 24 deletions.
diff --git a/.ci-mgmt.yaml b/.ci-mgmt.yaml
@@ -20,6 +20,7 @@ env:
   GOOGLE_REGION: us-central1
   GOOGLE_ZONE: us-central1-a
   DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+  PRIVATE_SSH_KEY_FOR_DIGITALOCEAN: ${{ secrets.PRIVATE_SSH_KEY_FOR_DIGITALOCEAN }}
 makeTemplate: bridged
 docsCmd: "cd provider/pkg/docs-gen/examples/ && go run generate.go ./yaml ./"
 hybrid: true
@@ -31,11 +32,5 @@ plugins:
   - name: aws
     version: "6.8.0"
 team: ecosystem
-actions:
-  preTest:
-    - name: Setup SSH key
-      uses: webfactory/[email protected]
-      with:
-        ssh-private-key: ${{ secrets.PRIVATE_SSH_KEY_FOR_DIGITALOCEAN }}
 pulumiConvert: 1
 registryDocs: true
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
@@ -20,6 +20,7 @@ env:
   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PRIVATE_SSH_KEY_FOR_DIGITALOCEAN: ${{ secrets.PRIVATE_SSH_KEY_FOR_DIGITALOCEAN }}
   PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
   PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
   PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
@@ -208,10 +209,6 @@ jobs:
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         version: v2.5.0
-    - name: Setup SSH key
-      uses: webfactory/[email protected]
-      with:
-        ssh-private-key: ${{ secrets.PRIVATE_SSH_KEY_FOR_DIGITALOCEAN }}
     - name: Run tests
       run: cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4
     strategy:

diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
@@ -21,6 +21,7 @@ env:
   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PRIVATE_SSH_KEY_FOR_DIGITALOCEAN: ${{ secrets.PRIVATE_SSH_KEY_FOR_DIGITALOCEAN }}
   PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
   PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
   PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
@@ -149,10 +150,6 @@ jobs:
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         version: v2.5.0
-    - name: Setup SSH key
-      uses: webfactory/[email protected]
-      with:
-        ssh-private-key: ${{ secrets.PRIVATE_SSH_KEY_FOR_DIGITALOCEAN }}
     - name: Run tests
       run: cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
     strategy:

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -26,6 +26,7 @@ env:
   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PRIVATE_SSH_KEY_FOR_DIGITALOCEAN: ${{ secrets.PRIVATE_SSH_KEY_FOR_DIGITALOCEAN }}
   PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
   PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
   PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
@@ -155,10 +156,6 @@ jobs:
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         version: v2.5.0
-    - name: Setup SSH key
-      uses: webfactory/[email protected]
-      with:
-        ssh-private-key: ${{ secrets.PRIVATE_SSH_KEY_FOR_DIGITALOCEAN }}
     - name: Run tests
       run: cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
     strategy:

diff --git a/.github/workflows/run-acceptance-tests.yml b/.github/workflows/run-acceptance-tests.yml
@@ -31,6 +31,7 @@ env:
   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PRIVATE_SSH_KEY_FOR_DIGITALOCEAN: ${{ secrets.PRIVATE_SSH_KEY_FOR_DIGITALOCEAN }}
   PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
   PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
   PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
@@ -204,13 +205,9 @@ jobs:
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         version: v2.5.0
-    - name: Setup SSH key
-      uses: webfactory/[email protected]
-      with:
-        ssh-private-key: ${{ secrets.PRIVATE_SSH_KEY_FOR_DIGITALOCEAN }}
     - name: Run tests
       if: matrix.testTarget == 'local'
-      run: cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -skip TestPulumiExamples -parallel 4 .
+      run: cd examples && go test -count=1 -v -cover -timeout 2h -tags=${{ matrix.language }} -skip TestPulumiExamples -parallel 4 .
     - name: Run pulumi/examples tests
       if: matrix.testTarget == 'pulumiExamples'
       run: cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -run TestPulumiExamples -parallel 4 .

diff --git a/examples/examples_nodejs_test.go b/examples/examples_nodejs_test.go
@@ -19,12 +19,20 @@ package examples
 import (
 	"encoding/base64"
 	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
 	"os"
 	"path"
+	"path/filepath"
 	"testing"
 
 	"github.com/pulumi/pulumi/pkg/v3/testing/integration"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/agent"
 )
 
 func TestNginxTs(t *testing.T) {
@@ -207,6 +215,44 @@ func TestSSHConnNode(t *testing.T) {
 	if token == "" {
 		t.Skipf("Skipping test due to missing DIGITALOCEAN_TOKEN environment variable")
 	}
+	key := os.Getenv("PRIVATE_SSH_KEY_FOR_DIGITALOCEAN")
+	if key == "" {
+		t.Skip("PRIVATE_SSH_KEY_FOR_DIGITALOCEAN is unset")
+	}
+
+	// sshagent crates an in-memory SSH agent with our DO private key loaded, and it returns the listening socket.
+	sshagent := func() string {
+		dir, err := os.MkdirTemp(os.TempDir(), "docker-test-*")
+		require.NoError(t, err)
+
+		sock := filepath.Join(dir, "test.sock")
+
+		l, err := net.Listen("unix", sock)
+		require.NoError(t, err)
+
+		a := agent.NewKeyring()
+
+		privateKey, err := ssh.ParseRawPrivateKey([]byte(key))
+		require.NoError(t, err)
+
+		err = a.Add(agent.AddedKey{PrivateKey: privateKey})
+		require.NoError(t, err)
+
+		go func() {
+			for {
+				conn, err := l.Accept()
+				if err != nil {
+					panic(err)
+				}
+				if err := agent.ServeAgent(a, conn); err != nil && !errors.Is(err, io.EOF) {
+					panic(err)
+				}
+			}
+		}()
+
+		return sock
+	}
+
 	test := getJsOptions(t).
 		With(integration.ProgramTestOptions{
 			Dir: path.Join(getCwd(t), "test-ssh-conn", "ts"),
@@ -221,6 +267,7 @@ func TestSSHConnNode(t *testing.T) {
 			Config: map[string]string{
 				"digitalocean:token": token,
 			},
+			Env:     []string{fmt.Sprintf("SSH_AUTH_SOCK=%s", sshagent())},
 			Verbose: true,
 		})
 	integration.ProgramTest(t, &test)

diff --git a/examples/go.mod b/examples/go.mod
@@ -6,6 +6,7 @@ require (
 	github.com/docker/docker v27.0.3+incompatible
 	github.com/pulumi/pulumi/pkg/v3 v3.140.0
 	github.com/stretchr/testify v1.9.0
+	golang.org/x/crypto v0.26.0
 )
 
 replace github.com/pulumi/pulumi-docker/sdk/v4 => ../sdk
@@ -162,7 +163,6 @@ require (
 	go.uber.org/atomic v1.10.0 // indirect
 	gocloud.dev v0.37.0 // indirect
 	gocloud.dev/secrets/hashivault v0.37.0 // indirect
-	golang.org/x/crypto v0.26.0 // indirect
 	golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 // indirect
 	golang.org/x/mod v0.18.0 // indirect
 	golang.org/x/net v0.28.0 // indirect