Skip to content

fix: Sync Workflow Lives in Chronon #743

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 19 commits into from
May 7, 2025
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions .github/workflows/push_to_platform.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
name: Push to Platform

on:
push:
branches:
- main

jobs:
subtree-pull:
runs-on: ubuntu-latest

steps:
- name: Checkout platform repo
uses: actions/checkout@v4
with:
repository: "zipline-ai/platform"
ssh-key: ${{ secrets.PLATFORM_REPO_DEPLOY_KEY }}
fetch-depth: 0 # Required for subtree operations
ref: main # Ensure we're on the main branch

- name: Set up Git config
run: |
git config user.name "GitHub Actions"
git config user.email "[email protected]"

- name: Set up SSH key for Chronon access and pull subtree
env:
SSH_PRIVATE_KEY: ${{ secrets.CHRONON_REPO_DEPLOY_KEY }}
run: |
mkdir -p ~/.ssh
echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this going to show the private key in the CI logs? Or is it possible a simple followup change could expose that?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here is it running: https://github.com/zipline-ai/platform/actions/runs/14843383331/job/41671413678 It doesn't expose the secret data.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I confirmed here that a simple change won't expose the secret SSH key: https://github.com/zipline-ai/chronon/actions/runs/14872732013/job/41764246277?pr=743. Github is good about keeping secrets from getting exposed.

chmod 600 ~/.ssh/id_rsa

# Add GitHub's SSH key to known_hosts
ssh-keyscan github.com >> ~/.ssh/known_hosts

# Set up SSH agent
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_rsa

# Create basic SSH config
cat > ~/.ssh/config << EOF
Host github.com
User git
IdentityFile ~/.ssh/id_rsa
StrictHostKeyChecking no
EOF

# Add the SSH remote
git remote add chronon [email protected]:zipline-ai/chronon.git || true

git fetch chronon main
git subtree pull --prefix=chronon chronon main --message="chore: update chronon subtree"

- name: Push changes to platform
run: git push origin main