RUM-10224: pr fixes

Author: aleksandr-gringauz

.gitlab-ci.yml

@@ -64,6 +64,10 @@ stages:
     - export OSSRH_USERNAME=$(aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.signing.ossrh_username --with-decryption --query "Parameter.Value" --out text)
     - export OSSRH_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.signing.ossrh_password --with-decryption --query "Parameter.Value" --out text)
     - export GPG_PUBLIC_FINGERPRINT=$(aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.signing.gpg_public_key --with-decryption --query "Parameter.Value" --out text | gpg --import --import-options show-only | grep -E -o -e "[A-F0-9]{40}")
+  set-github-installation-token:
+    - export GITHUB_APP_CLIENT_ID=$(aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.gh_app_client_id --with-decryption --query "Parameter.Value" --out text)
+    - export GITHUB_APP_INSTALLATION_ID=$(aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.gh_app_installation_id --with-decryption --query "Parameter.Value" --out text)
+    - export GITHUB_TOKEN=$(aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.gh_app_private_key --with-decryption --query "Parameter.Value" --out text | bash ./create_github_installation_token.sh "$GITHUB_APP_CLIENT_ID" "$GITHUB_APP_INSTALLATION_ID")
 
 # CI IMAGE
 
@@ -970,33 +974,15 @@ notify:publish-release-failure:
     - 'MESSAGE_TEXT=":status_alert: $CI_PROJECT_NAME $CI_COMMIT_TAG publish pipeline <$BUILD_URL|$COMMIT_MESSAGE> failed."'
     - postmessage "#mobile-sdk-ops" "$MESSAGE_TEXT"
 
-notify:prepare-github-token:
-  tags: [ "arch:amd64" ]
-  only:
-    - tags
-  image: $CI_IMAGE_DOCKER
-  stage: notify
-  when: on_success
-  script:
-    - aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.gh_app_private_key --with-decryption --query "Parameter.Value" --out text >> ./gh_private_key.pem
-    - export GITHUB_APP_CLIENT_ID=$(aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.gh_app_client_id --with-decryption --query "Parameter.Value" --out text)
-    - export GITHUB_APP_INSTALLATION_ID=$(aws ssm get-parameter --region us-east-1 --name ci.dd-sdk-android.gh_app_installation_id --with-decryption --query "Parameter.Value" --out text)
-    - echo "GITHUB_TOKEN=$(bash ./create_github_installation_token.sh)" >> github.env
-  artifacts:
-    reports:
-      dotenv: github.env
-    access: none
-
 notify:dogfood-app:
   tags: [ "arch:amd64" ]
   only:
     - tags
   image: $CI_IMAGE_DOCKER
   stage: notify
   when: on_success
-  needs:
-    - notify:prepare-github-token
   script:
+    - !reference [ .snippets, set-github-installation-token ]
     - pip3 install GitPython requests
     - python3 dogfood.py -v $CI_COMMIT_TAG -t app
 
@@ -1007,9 +993,8 @@ notify:dogfood-demo:
   image: $CI_IMAGE_DOCKER
   stage: notify
   when: on_success
-  needs:
-    - notify:prepare-github-token
   script:
+    - !reference [ .snippets, set-github-installation-token ]
     - pip3 install GitPython requests
     - python3 dogfood.py -v $CI_COMMIT_TAG -t demo
 
@@ -1021,6 +1006,7 @@ notify:dogfood-gradle-plugin:
   stage: notify
   when: on_success
   script:
+    - !reference [ .snippets, set-github-installation-token ]
     - pip3 install GitPython requests
     - python3 dogfood.py -v $CI_COMMIT_TAG -t gradle-plugin
 

create_github_installation_token.sh

@@ -8,7 +8,8 @@
 
 set -o pipefail
 
-pem='./gh_private_key.pem'
+client_id=$1
+installation_id=$2
 
 now=$(date +%s)
 iat=$((${now} - 60)) # Issues 60 seconds in the past
@@ -21,23 +22,20 @@ header_json='{
     "alg":"RS256"
 }'
 # Header encode
-header=$( echo -n "${header_json}" | b64enc )
+header=$(echo -n "${header_json}" | b64enc)
 
 payload_json="{
     \"iat\":${iat},
     \"exp\":${exp},
-    \"iss\":\"${GITHUB_APP_CLIENT_ID}\"
+    \"iss\":\"${client_id}\"
 }"
 
 # Payload encode
-payload=$( echo -n "${payload_json}" | b64enc )
+payload=$(echo -n "${payload_json}" | b64enc)
 
 # Signature
 header_payload="${header}"."${payload}"
-signature=$(
-    openssl dgst -sha256 -sign "${pem}" \
-    <(echo -n "${header_payload}") | b64enc
-)
+signature=$(openssl dgst -sha256 -sign /dev/stdin <(echo -n "${header_payload}") | b64enc)
 
 # Create JWT
 jwt_token="${header_payload}"."${signature}"
@@ -48,6 +46,6 @@ installation_token=$(curl \
   -X POST \
   -H "Authorization: Bearer $jwt_token" \
   -H "Accept: application/vnd.github+json" \
-  https://api.github.com/app/installations/$GITHUB_APP_INSTALLATION_ID/access_tokens)
+  https://api.github.com/app/installations/$installation_id/access_tokens)
 
 echo $installation_token | jq -r '.token'