diff --git a/.github/workflows/credentials-verification.yml b/.github/workflows/credentials-verification.yml index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..3b70e74fbddf736c28ec4a74aef3eb85f4820160 100644 --- a/.github/workflows/credentials-verification.yml +++ b/.github/workflows/credentials-verification.yml @@ -0,0 +1,51 @@ +name: Daily credentials verification +on: + schedule: + # Runs 00:00 UTC every day + - cron: "0 0 * * *" + workflow_dispatch: + +jobs: + # Verifies the token used by the bot to publish crates to crates.io + verify-crates-io-token: + name: Verify Crates.io Token + runs-on: ubuntu-latest + steps: + - name: Checkout smithy-rs + uses: actions/checkout@v3 + - name: Verify Crates.io Token + shell: bash + env: + RELEASE_AUTOMATION_BOT_CRATESIO_TOKEN: ${{ secrets.RELEASE_AUTOMATION_BOT_CRATESIO_TOKEN }} + run: | + cargo login -- "${RELEASE_AUTOMATION_BOT_CRATESIO_TOKEN}" + echo "Checking cargo auth token..." + # "cargo login" only saves a token and does not actually use it, so we use "cargo yank" to verify the token. + # This version has already been yanked, so it is safe to execute the command below repeatedly. + # This command succeeds if we have a token with permission to yank the crate. + cargo yank aws-sigv4 --version 0.55.0 + - name: Notify Slack on Failure + if: failure() + env: + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} + run: | + curl -X POST "${SLACK_WEBHOOK_URL}" -H 'Content-type: application/json' \ + --data '{"workflow_msg":"⚠️ Invalid crates.io token. Create a new token as soon as possible!"}' + + # Verifies the token used to perform actions on the repository on behalf of the bot user + verify-personal-access-token: + name: Verify Personal Access Token + runs-on: ubuntu-latest + steps: + - name: Checkout smithy-rs + # To test the validity of the personal access token, we only need to perform checkout with the specified token. + uses: actions/checkout@v3 + with: + token: ${{ secrets.RELEASE_AUTOMATION_BOT_PAT }} + - name: Notify Slack on Failure + if: failure() + env: + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} + run: | + curl -X POST "${SLACK_WEBHOOK_URL}" -H 'Content-type: application/json' \ + --data '{"workflow_msg":"⚠️ Invalid GitHub personal access token. Create a new token as soon as possible!"}'