Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/actions/prepare-accounts/action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -46,5 +46,5 @@ runs:
E2E_PERMISSIONS_USERS_PASSWORD: ${{ inputs.E2E_PERMISSIONS_USERS_PASSWORD }}
run: |
ACCOUNTS=$(node playwright/auth.js login)
echo "::add-mask::${ACCOUNTS}"
# echo "::add-mask::${ACCOUNTS}"
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commenting out ::add-mask::${ACCOUNTS} will allow the ACCOUNTS value to appear in logs if echoed by subsequent steps or if GitHub prints step outputs for debugging. Since this output is derived from credentials (even if encrypted), it should remain masked; restore the add-mask call or replace it with masking of the underlying secret inputs.

Suggested change
# echo "::add-mask::${ACCOUNTS}"
echo "::add-mask::${ACCOUNTS}"

Copilot uses AI. Check for mistakes.
echo "ACCOUNTS=${ACCOUNTS}" >> "$GITHUB_OUTPUT"
8 changes: 6 additions & 2 deletions .github/actions/prepare-api-variables/action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,11 @@ runs:
if [[ "$DESTINATION_BRANCH" =~ ^[0-9]+\.[0-9]+$ ]]; then
# handles pull requests to the other branches than main, e.g. release branches
VERSION_SLUG=$(echo "${DESTINATION_BRANCH}" | sed "s/\.//")
echo "BACKUP_NAMESPACE=snapshot-automation-tests-${DESTINATION_BRANCH}" >> $GITHUB_OUTPUT
if [[ "$DESTINATION_BRANCH" == "3.21" ]]; then
echo "BACKUP_NAMESPACE=snapshot-automation-tests-${DESTINATION_BRANCH}" >> $GITHUB_OUTPUT
else
echo "BACKUP_NAMESPACE=snapshot-e2e-tests-${DESTINATION_BRANCH}" >> $GITHUB_OUTPUT
fi
echo "SALEOR_CLOUD_SERVICE=saleor-staging-v${VERSION_SLUG}" >> $GITHUB_OUTPUT
echo "RUN_SLUG=${DESTINATION_BRANCH}" >> $GITHUB_OUTPUT
else
Expand All @@ -72,7 +76,7 @@ runs:
# the `main` branch as `main` is an unstable (dev) branch, whereas
# version number branches are stable branches thus we do not expect anyone
# to be using feature branches against these.
echo "BACKUP_NAMESPACE=snapshot-automation-tests" >> $GITHUB_OUTPUT
echo "BACKUP_NAMESPACE=snapshot-e2e-tests" >> $GITHUB_OUTPUT
echo "SALEOR_CLOUD_SERVICE=saleor-master-staging" >> $GITHUB_OUTPUT
echo "RUN_SLUG=${PREFIX}${PULL_REQUEST_NUMBER}" >> $GITHUB_OUTPUT
fi
Expand Down
19 changes: 15 additions & 4 deletions .github/workflows/pr-automation.yml
Original file line number Diff line number Diff line change
Expand Up @@ -164,17 +164,28 @@ jobs:
deployment_id: ${{ steps.deployment.outputs.deployment_id }}
env: ${{ needs.initialize-cloud.outputs.POOL_NAME }}

- name: Load secrets for prepare-accounts
if: ${{ contains(github.event.pull_request.labels.*.name, 'run pw-e2e') }}
uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2.0.0
with:
export-env: true
env:
OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
E2E_USER_NAME: "op://Continuous Integration/E2E_USER/username"
E2E_USER_PASSWORD: "op://Continuous Integration/E2E_USER/password"
E2E_PERMISSIONS_USERS_PASSWORD: "op://Continuous Integration/NEW_E2E_PERMISSIONS_USERS_PASSWORD/password"

- name: Prepare accounts
if: ${{ contains(github.event.pull_request.labels.*.name, 'run pw-e2e') }}
id: accounts
uses: ./.github/actions/prepare-accounts
with:
BASE_URL: ${{ needs.initialize-cloud.outputs.BASE_URL }}
API_URL: ${{ needs.initialize-cloud.outputs.API_URL }}
E2E_USER_NAME: ${{ secrets.E2E_USER_NAME }}
E2E_USER_PASSWORD: ${{ secrets.E2E_USER_PASSWORD }}
E2E_USER_NAME: ${{ env.E2E_USER_NAME }}
E2E_USER_PASSWORD: ${{ env.E2E_USER_PASSWORD }}
E2E_ENCODE_PASS: ${{ secrets.E2E_ENCODE_PASS }}
E2E_PERMISSIONS_USERS_PASSWORD: ${{ secrets.E2E_PERMISSIONS_USERS_PASSWORD }}
E2E_PERMISSIONS_USERS_PASSWORD: ${{ env.E2E_PERMISSIONS_USERS_PASSWORD }}

run-tests:
if: ${{ contains(github.event.pull_request.labels.*.name, 'run pw-e2e') }}
Expand All @@ -198,7 +209,7 @@ jobs:
OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
E2E_USER_NAME: "op://Continuous Integration/E2E_USER/username"
E2E_USER_PASSWORD: "op://Continuous Integration/E2E_USER/password"
E2E_PERMISSIONS_USERS_PASSWORD: "op://Continuous Integration/E2E_PERMISSIONS_USERS_PASSWORD/password"
E2E_PERMISSIONS_USERS_PASSWORD: "op://Continuous Integration/NEW_E2E_PERMISSIONS_USERS_PASSWORD/password"
MAILPITURL: "op://Continuous Integration/MAILPITURL_STAGING/password"

- name: Run playwright tests
Expand Down
Loading
Loading