Fix tag_version job: switch from HTTPS to SSH authentication - #844
Conversation
The codacy/tag_version orb job was failing with: "Invalid username or token. Password authentication is not supported for Git operations." GitHub no longer accepts token-based HTTPS push for git operations. Replace both codacy/tag_version orb calls in the release_pipeline workflow with a custom tag_version_ssh job that uses SSH key authentication, bypassing the HTTPS credential issue entirely. AI-Generated: true
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The pull request effectively replaces the deprecated HTTPS authentication method with a custom SSH-based tagging job. Codacy analysis indicates the changes are up to standards with no new quality issues. However, the configuration relies on a hardcoded repository URL, which limits portability and should be replaced with dynamic environment variables. Additionally, while the implementation aligns with acceptance criteria, there are no test cases confirming the logic for version fallback or the force-push parameter.
Test suggestions
- Verify tagging using version read from .version file when no parameter is provided\n- [ ] Verify tagging using explicit version parameter (e.g., 'latest')\n- [ ] Verify force push behavior when the force parameter is set to true
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify tagging using version read from .version file when no parameter is provided\n- [ ] Verify tagging using explicit version parameter (e.g., 'latest')\n- [ ] Verify force push behavior when the force parameter is set to true
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| command: | | ||
| git config --global user.email "circleci@codacy.com" | ||
| git config --global user.name "CircleCI" | ||
| git remote set-url origin git@github.com:codacy/chart.git |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Suggestion: Avoid hardcoding the repository URL. Use CircleCI environment variables to construct the SSH URL dynamically.\n\nsuggestion\n git remote set-url origin "git@github.com:${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}.git"\n
| - "df:83:d7:c7:d5:79:06:c2:3b:d1:fd:e2:a3:d1:12:c5" | ||
| - run: | ||
| name: Setup SSH | ||
| command: ssh-keyscan github.com >> ~/.ssh/known_hosts |
There was a problem hiding this comment.
⚪ LOW RISK
Nitpick: Ensure the '~/.ssh' directory exists and use the '-H' flag for 'ssh-keyscan' to improve security and robustness.\n\nsuggestion\n command: mkdir -p ~/.ssh && ssh-keyscan -H github.com >> ~/.ssh/known_hosts\n
1 participant
Summary
tag_version) failed with:remote: Invalid username or token. Password authentication is not supported for Git operations.codacy/tag_versionorb job pushes git tags over HTTPS usingPROVIDER_TOKENas a credential, which GitHub now rejects for git push operations.codacy/tag_versionorb calls in therelease_pipelineworkflow with a new customtag_version_sshjob that uses the SSH deploy key (fingerprintdf:83:d7:c7:d5:79:06:c2:3b:d1:fd:e2:a3:d1:12:c5) already configured in the project.https://app.circleci.com/agents/gh/codacy/chat/46410d71-f290-44c1-bbfe-7883ad739c3e