fix(release): apply 64dc681c970ae57f2d1fc5d357eff5ccc57381e6 to release by jakobmoellerdev · Pull Request #5749 · external-secrets/external-secrets

jakobmoellerdev · 2025-12-19T12:35:52Z

Problem Statement

ports the same weird crazy remote fixup into the release so we dont have failing docs releases as part of our normal release workflow.

Related Issue

#5664

Proposed Changes

How do you like to solve the issue and why?

Format

Please ensure that your PR follows the following format for the title:

feat(scope): add new feature
fix(scope): fix bug
docs(scope): update documentation
chore(scope): update build tool or dependencies
ref(scope): refactor code
clean(scope): provider cleanup
test(scope): add tests
perf(scope): improve performance
desig(scope): improve design

Where scope is optionally one of:

charts
release
testing
security
templating

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

Summary by CodeRabbit

Chores
- Enhanced the automated release workflow with improved authentication mechanisms to ensure secure and reliable deployment processes.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

coderabbitai · 2025-12-19T12:36:05Z

Caution

Review failed

The pull request is closed.

Walkthrough

The release workflow adds token-based authentication for Git pushes by exposing a TOKEN env var from secrets.GITHUB_TOKEN and running git remote set-url to set the origin URL using x-access-token before push operations.

Changes

Cohort / File(s)	Change Summary
Release workflow `\.github/workflows/release.yml`	Adds `TOKEN` environment variable sourced from `secrets.GITHUB_TOKEN`; inserts `git remote set-url origin https://x-access-token:${TOKEN}@github.com/...` to authenticate Git pushes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5–10 minutes

Verify secrets.GITHUB_TOKEN is available in the workflow context.
Confirm git remote set-url uses correct repository URL and token interpolation.
Ensure the workflow does not log the token or expose it in step outputs.

Poem

🐰 A tiny token snug and bright,
It hops into the remote's night,
Authenticated push — take flight! ✨
Release trails moonbeams in its sight.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between b71ff34 and 315903f.

📒 Files selected for processing (1)

.github/workflows/release.yml (1 hunks)

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

ports the same weird crazy remote fixup into the release so we dont have failing docs releases as part of our normal release workflow. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

sonarqubecloud · 2025-12-19T12:41:53Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `1.1.1` -> `1.2.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v1.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0) [Compare Source](external-secrets/external-secrets@v1.1.1...v1.2.0) Image: `ghcr.io/external-secrets/external-secrets:v1.2.0` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi-boringssl`  #### What's Changed ##### General - chore: bump 1.1.1 by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5687](external-secrets/external-secrets#5687) - chore: fix the argocd e2e test case by [@Skarlso](https://github.com/Skarlso) in [#5688](external-secrets/external-secrets#5688) - feat(provider): add Barbican provider support by [@rkferreira](https://github.com/rkferreira) in [#5398](external-secrets/external-secrets#5398) - docs(secretserver): promote secretserver provider to beta by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5668](external-secrets/external-secrets#5668) - feat(controller): add flag to enable/disable secretstore reconcile by [@Ilhan-Personal](https://github.com/Ilhan-Personal) in [#5653](external-secrets/external-secrets#5653) - fix(aws-secrets-manager): Apply filtering based on both name and tags if provided by [@iypetrov](https://github.com/iypetrov) in [#5685](external-secrets/external-secrets#5685) - fix(gcpsm): SecretExists should check for regional secrets when store location is specified by [@tokiwong](https://github.com/tokiwong) in [#5708](external-secrets/external-secrets#5708) - feat: introduce store deprecation by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5711](external-secrets/external-secrets#5711) - feat(charts): add global values for common deployment configurations by [@Gabryel8818](https://github.com/Gabryel8818) in [#5652](external-secrets/external-secrets#5652) - feat: add Doppler OIDC-based authentication by [@mikesellitto](https://github.com/mikesellitto) in [#5475](external-secrets/external-secrets#5475) - fix: make custom configuration available regardless of environment by [@Skarlso](https://github.com/Skarlso) in [#5713](external-secrets/external-secrets#5713) - chore(chart): update bitwarden dependency to v0.5.2 by [@Skarlso](https://github.com/Skarlso) in [#5719](external-secrets/external-secrets#5719) - docs(templating): update rbac for generic targets by [@lostick](https://github.com/lostick) in [#5736](external-secrets/external-secrets#5736) - fix(testing): Breaking changes should not break ci by [@evrardjp](https://github.com/evrardjp) in [#5739](external-secrets/external-secrets#5739) - fix(security): Get rid of getSecretKey by [@evrardjp](https://github.com/evrardjp) in [#5738](external-secrets/external-secrets#5738) - fix(aws): parse resource policies into canonical JSON (sorted) before comparing by [@cmoscofian](https://github.com/cmoscofian) in [#5622](external-secrets/external-secrets#5622) - docs: Fix example in GCP documentation by [@headcr4sh](https://github.com/headcr4sh) in [#5745](external-secrets/external-secrets#5745) - chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5742](external-secrets/external-secrets#5742) - fix(gcpsm): Improve SecretExists method in GCP secret manager provider by [@tosih](https://github.com/tosih) in [#5610](external-secrets/external-secrets#5610) - chore(docs): add clarification to helm values being disabled by [@Skarlso](https://github.com/Skarlso) in [#5746](external-secrets/external-secrets#5746) - fix(release): apply [`64dc681`](external-secrets/external-secrets@64dc681) to release by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5749](external-secrets/external-secrets#5749) - docs(release): 1.2 stability-support.md by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5750](external-secrets/external-secrets#5750) ##### Dependencies - chore(deps): bump golang from 1.25.4 to 1.25.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#5693](external-secrets/external-secrets#5693) - chore(deps): bump golang from 1.25.4-bookworm to 1.25.5-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5702](external-secrets/external-secrets#5702) - chore(deps): bump ubi9/ubi from `dcd8128` to `75937d9` by [@dependabot](https://github.com/dependabot)\[bot] in [#5655](external-secrets/external-secrets#5655) - chore(deps): bump peter-evans/slash-command-dispatch from 5.0.0 to 5.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5695](external-secrets/external-secrets#5695) - chore(deps): bump github/codeql-action from 4.31.5 to 4.31.7 by [@dependabot](https://github.com/dependabot)\[bot] in [#5696](external-secrets/external-secrets#5696) - chore(deps): bump actions/stale from 10.1.0 to 10.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5697](external-secrets/external-secrets#5697) - chore(deps): bump actions/create-github-app-token from 2.2.0 to 2.2.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5700](external-secrets/external-secrets#5700) - chore(deps): bump step-security/harden-runner from 2.13.2 to 2.13.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5698](external-secrets/external-secrets#5698) - chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5699](external-secrets/external-secrets#5699) - chore(deps): bump platformdirs from 4.5.0 to 4.5.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5705](external-secrets/external-secrets#5705) - chore(deps): bump distroless/static from `87bce11` to `4b2a093` by [@dependabot](https://github.com/dependabot)\[bot] in [#5692](external-secrets/external-secrets#5692) - chore(deps): bump alpine from 3.22 to 3.23 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5703](external-secrets/external-secrets#5703) - chore(deps): bump urllib3 from 2.5.0 to 2.6.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5704](external-secrets/external-secrets#5704) - chore(deps): bump pymdown-extensions from 10.17.2 to 10.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5706](external-secrets/external-secrets#5706) - chore(deps): bump alpine from 3.22.2 to 3.23.0 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5701](external-secrets/external-secrets#5701) - chore(deps): bump golang from `2611181` to `2611181` by [@dependabot](https://github.com/dependabot)\[bot] in [#5721](external-secrets/external-secrets#5721) - chore(deps): bump codecov/codecov-action from 5.5.1 to 5.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5725](external-secrets/external-secrets#5725) - chore(deps): bump urllib3 from 2.6.0 to 2.6.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5730](external-secrets/external-secrets#5730) - chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 by [@dependabot](https://github.com/dependabot)\[bot] in [#5726](external-secrets/external-secrets#5726) - chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5724](external-secrets/external-secrets#5724) - chore(deps): bump tornado from 6.5.2 to 6.5.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5732](external-secrets/external-secrets#5732) - chore(deps): bump ubi9/ubi from `75937d9` to `d4feb57` by [@dependabot](https://github.com/dependabot)\[bot] in [#5722](external-secrets/external-secrets#5722) - chore(deps): bump golang from `5117d68` to `09f53de` in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5729](external-secrets/external-secrets#5729) - chore(deps): bump alpine from `4b7ce07` to `51183f2` by [@dependabot](https://github.com/dependabot)\[bot] in [#5694](external-secrets/external-secrets#5694) - chore(deps): bump hashicorp/setup-terraform from [`712b439`](external-secrets/external-secrets@712b439) to [`071811a`](external-secrets/external-secrets@071811a) by [@dependabot](https://github.com/dependabot)\[bot] in [#5727](external-secrets/external-secrets#5727) - chore(deps): bump pymdown-extensions from 10.18 to 10.19.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5731](external-secrets/external-secrets#5731) - chore(deps): bump step-security/harden-runner from 2.13.3 to 2.14.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5728](external-secrets/external-secrets#5728) - chore(deps): bump actions/cache from 4.3.0 to 5.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5723](external-secrets/external-secrets#5723) #### New Contributors - [@iypetrov](https://github.com/iypetrov) made their first contribution in [#5685](external-secrets/external-secrets#5685) - [@tokiwong](https://github.com/tokiwong) made their first contribution in [#5708](external-secrets/external-secrets#5708) - [@Gabryel8818](https://github.com/Gabryel8818) made their first contribution in [#5652](external-secrets/external-secrets#5652) - [@mikesellitto](https://github.com/mikesellitto) made their first contribution in [#5475](external-secrets/external-secrets#5475) - [@lostick](https://github.com/lostick) made their first contribution in [#5736](external-secrets/external-secrets#5736) - [@cmoscofian](https://github.com/cmoscofian) made their first contribution in [#5622](external-secrets/external-secrets#5622) - [@headcr4sh](https://github.com/headcr4sh) made their first contribution in [#5745](external-secrets/external-secrets#5745) - [@tosih](https://github.com/tosih) made their first contribution in [#5610](external-secrets/external-secrets#5610) **Full Changelog**: <external-secrets/external-secrets@v1.1.1...v1.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/2737 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

ports the same weird crazy remote fixup into the release so we dont have failing docs releases as part of our normal release workflow. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

github-project-automation bot added this to External Secrets Dec 19, 2025

github-actions bot added component/github-actions area/release Issues / Pull Requests related to releases kind/bug Categorizes issue or PR as related to a bug. size/s labels Dec 19, 2025

jakobmoellerdev force-pushed the fixup-release-docs branch from 9f3e6e9 to d652e8b Compare December 19, 2025 12:37

github-actions bot added the size/xs label Dec 19, 2025

Skarlso previously approved these changes Dec 19, 2025

View reviewed changes

fix: apply 64dc681 to release

315903f

ports the same weird crazy remote fixup into the release so we dont have failing docs releases as part of our normal release workflow. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

jakobmoellerdev dismissed Skarlso’s stale review via 315903f December 19, 2025 12:41

jakobmoellerdev force-pushed the fixup-release-docs branch from d652e8b to 315903f Compare December 19, 2025 12:41

Skarlso approved these changes Dec 19, 2025

View reviewed changes

jakobmoellerdev merged commit 2e599d4 into external-secrets:main Dec 19, 2025
27 checks passed

github-project-automation bot moved this to Done in External Secrets Dec 19, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(release): apply 64dc681c970ae57f2d1fc5d357eff5ccc57381e6 to release#5749

fix(release): apply 64dc681c970ae57f2d1fc5d357eff5ccc57381e6 to release#5749
jakobmoellerdev merged 1 commit intoexternal-secrets:mainfrom
jakobmoellerdev:fixup-release-docs

jakobmoellerdev commented Dec 19, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Dec 19, 2025 •

edited

Loading

Review failed

Uh oh!

sonarqubecloud bot commented Dec 19, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

jakobmoellerdev commented Dec 19, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement

Related Issue

Proposed Changes

Format

Checklist

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

sonarqubecloud bot commented Dec 19, 2025

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jakobmoellerdev commented Dec 19, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Dec 19, 2025 •

edited

Loading