(CAT-2581) Propagate PUPPET_FORGE_TOKEN to gem acceptance workflow#177
Merged
Conversation
Mirror the puppetcore wiring from gem_ci.yml to gem_acceptance.yml so that gem-based projects' acceptance lanes can authenticate to the puppetcore private gem source (https://rubygems-puppetcore.puppet.com) the same way their spec lanes already do. Without this, the acceptance job sees no PUPPET_FORGE_TOKEN env var, so when it renders a fresh module via `pdk new module` (or any code that consumes the pdk-templates Gemfile.erb), the rendered Gemfile's `gemsource_puppetcore` switch stays on rubygems.org, and any bolt / puppet / facter gem published only to puppetcore (e.g. bolt 5.x) is unreachable. On Ruby 4 specifically this causes bundle resolution to fail because the only rubygems.org bolt version (4.0.0) pins `r10k < 5`, which cascades through puppet_forge < 6 to a faraday-follow_redirects 0.3.x gemspec constraint that excludes Ruby >= 4. Discovered while landing Ruby 4 support on pdk (CAT-2581 / pdk-private PR #48). Add two job-scoped env vars to gem_acceptance.yml (identical to the ones already present at workflow scope in gem_ci.yml): * `PUPPET_FORGE_TOKEN` from secrets.PUPPET_FORGE_TOKEN with a fallback to secrets.PUPPET_FORGE_TOKEN_PUBLIC. Setting this triggers the `gemsource_puppetcore` switch in pdk-templates' rendered Gemfile. * `BUNDLE_RUBYGEMS___PUPPETCORE__PUPPET__COM` set to "forge-key:<TOKEN>". This is Bundler's canonical env-var form of `bundle config rubygems-puppetcore.puppet.com forge-key:<TOKEN>` and authenticates the bundler download from puppetcore. Calling workflows must set PUPPET_FORGE_TOKEN as a repo / org secret (secrets.PUPPET_FORGE_TOKEN_PUBLIC is the fork-friendly fallback) and pass `secrets: inherit`, the same prerequisites as gem_ci.yml. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Mirror the puppetcore wiring from gem_ci.yml to gem_acceptance.yml so that gem-based projects' acceptance lanes can authenticate to the puppetcore private gem source (https://rubygems-puppetcore.puppet.com) the same way their spec lanes already do.
Without this, the acceptance job sees no PUPPET_FORGE_TOKEN env var, so when it renders a fresh module via
pdk new module(or any code that consumes the pdk-templates Gemfile.erb), the rendered Gemfile'sgemsource_puppetcoreswitch stays on rubygems.org, and any bolt / puppet / facter gem published only to puppetcore (e.g. bolt 5.x) is unreachable. On Ruby 4 specifically this causes bundle resolution to fail because the only rubygems.org bolt version (4.0.0) pinsr10k < 5, which cascades through puppet_forge < 6 to a faraday-follow_redirects 0.3.x gemspec constraint that excludes Ruby >= 4. Discovered while landing Ruby 4 support on pdk (CAT-2581 / pdk-private PR #48).Add two job-scoped env vars to gem_acceptance.yml (identical to the ones already present at workflow scope in gem_ci.yml):
PUPPET_FORGE_TOKENfrom secrets.PUPPET_FORGE_TOKEN with a fallback to secrets.PUPPET_FORGE_TOKEN_PUBLIC. Setting this triggers thegemsource_puppetcoreswitch in pdk-templates' rendered Gemfile.BUNDLE_RUBYGEMS___PUPPETCORE__PUPPET__COMset to "forge-key:". This is Bundler's canonical env-var form ofbundle config rubygems-puppetcore.puppet.com forge-key:<TOKEN>and authenticates the bundler download from puppetcore.Calling workflows must set PUPPET_FORGE_TOKEN as a repo / org secret (secrets.PUPPET_FORGE_TOKEN_PUBLIC is the fork-friendly fallback) and pass
secrets: inherit, the same prerequisites as gem_ci.yml.Checklist