Skip to content

Commit 3f289f8

Browse files
caposselecapossele
authored
BM-3117: Pin shutdown images and refresh pipeline GitHub credential (#2081)
Pin all order-generator and indexer deployment stacks to `nightly-93e971a`, the last successful image build. The shutdown changes only modify IaC, and the pinned images use the same Rust/Docker source as current main. Replace the encrypted `pipelines:GITHUB_TOKEN` value with Signal's validated existing PAT, which belongs to `willpote` and expires January 3, 2027. The targeted Ops update has succeeded. All seven GitHub SecretVersion resources have new `AWSCURRENT` versions matching both Pulumi state and Signal's token, with prior versions retained as `AWSPREVIOUS`. The update replaced only those seven versions; 168 resources were unchanged. This PR preserves the credential in IaC and deploys the image pins through the normal service pipelines. Validation: both pinned image manifests are available; Signal's token passes the exact GHCR Docker login; all 14 YAML pins preserve other stack settings; encrypted token round-trip matches the source credential. PR checks pass, including infra and formatting. Deployment pipeline reruns have not yet been verified.
1 parent ee98a01 commit 3f289f8

15 files changed

Lines changed: 15 additions & 1 deletion

‎infra/indexer/Pulumi.l-prod-1.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
secretsprovider: awskms:///arn:aws:kms:us-west-2:968153779208:alias/pulumi-secrets-key
22
encryptedkey: AQICAHhnm/1/W7/xeF2uxmXOGjFzOf6jjMX+KgbMb0K+LSCbsAFENpC4nM4ety57wps7qAsIAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM9+SeDYAwx0VExWWBAgEQgDuU2+MSQPunHYAiZZt6xStyKOo4SdYofelR7IcC1n2UpUBGjt2QzV0wEnLj92nWuz6twcO/B3k6g6cEcg==
33
config:
4+
indexer:GHCR_IMAGE_TAG: nightly-93e971a
45
aws:region: us-west-2
56
indexer:DOCKER_DIR: ../../
67
indexer:DOCKER_TAG: latest

‎infra/indexer/Pulumi.l-prod-11155111.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
secretsprovider: awskms:///arn:aws:kms:us-west-2:968153779208:alias/pulumi-secrets-key
22
encryptedkey: AQICAHhnm/1/W7/xeF2uxmXOGjFzOf6jjMX+KgbMb0K+LSCbsAFRhipnyFym/q/4SF1hsJO0AAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMgS683knwd0fUeITEAgEQgDsWq54Zlx7VSEuu1bkIv2B5+HVEgFut12UhqtpQdkZwxM5ii4vzcI2zW86cs47yTmt+iR6cKazJ3ht04g==
33
config:
4+
indexer:GHCR_IMAGE_TAG: nightly-93e971a
45
aws:region: us-west-2
56
indexer:BASE_STACK: organization/bootstrap/services-prod
67
indexer:BOUNDLESS_ADDRESS: 0xc211b581cb62e3a6d396a592bab34979e1bbba7d

‎infra/indexer/Pulumi.l-prod-167000.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
secretsprovider: awskms:///arn:aws:kms:us-west-2:968153779208:alias/pulumi-secrets-key
22
encryptedkey: AQICAHjo9dP83MIkRU7zP48vJb5veObMz9xpFGm6gYEXRHbpqwGJLP78fsbuW4wZV+pqul3iAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMVHb1B0Zut2WvVZA9AgEQgDuV24t/cLeoCMm2dcmk3vu0KNVcqS9gC7OpjDnkc5gUnyOAXbTfdkoa3pViCbOm/CvfK82ITaM6kRJDxg==
33
config:
4+
indexer:GHCR_IMAGE_TAG: nightly-93e971a
45
aws:region: us-west-2
56
indexer:ALLOWED_IP_ADDRESSES:
67
secure: v1:/OwfvlV5c/WpyGOB:39kj/yXgE7TSVsDnn0ChDW4cXeKb13OOdsuZ0EbLXMI=

‎infra/indexer/Pulumi.l-prod-8453.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
secretsprovider: awskms:///arn:aws:kms:us-west-2:968153779208:alias/pulumi-secrets-key
22
encryptedkey: AQICAHhnm/1/W7/xeF2uxmXOGjFzOf6jjMX+KgbMb0K+LSCbsAHrK+9eIhmBLBN6ZFD95Zt5AAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMJiII6Tq9vuswLTfCAgEQgDvyHa6T6MOS6fS5LOeXmlndVkK81At8L0sVFHS8pwDm2DS2RNagK/ZtEAsITGbkpmvh3d9xN5bDrmS9Uw==
33
config:
4+
indexer:GHCR_IMAGE_TAG: nightly-93e971a
45
aws:region: us-west-2
56
indexer:BASE_STACK: organization/bootstrap/services-prod
67
indexer:BOUNDLESS_ADDRESS: 0xfd152dadc5183870710fe54f939eae3ab9f0fe82

‎infra/indexer/Pulumi.l-prod-84532.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
secretsprovider: awskms:///arn:aws:kms:us-west-2:968153779208:alias/pulumi-secrets-key
22
encryptedkey: AQICAHhnm/1/W7/xeF2uxmXOGjFzOf6jjMX+KgbMb0K+LSCbsAHJQ9l6dgl4dPIl3oJ9wYCXAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMAR8PlGB8KGuDc/unAgEQgDulg3dKiGDuyLoRoFWXIJgraQFOCFBJQiy9zGpWww+t6cTBo0zy1WF/K8cwuTefXQOlmB3RJe8rEA0fIg==
33
config:
4+
indexer:GHCR_IMAGE_TAG: nightly-93e971a
45
aws:region: us-west-2
56
indexer:BASE_STACK: organization/bootstrap/services-prod
67
indexer:BOUNDLESS_ADDRESS: 0x56da3786061c82214d18e634d2817e86ad42d7ce

‎infra/indexer/Pulumi.l-staging-11155111.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
config:
2+
indexer:GHCR_IMAGE_TAG: nightly-93e971a
23
aws:region: us-west-2
34
indexer:DOCKER_DIR: ../../
45
indexer:DOCKER_TAG: latest

‎infra/indexer/Pulumi.l-staging-167000.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
secretsprovider: awskms:///arn:aws:kms:us-west-2:968153779208:alias/pulumi-secrets-key
22
encryptedkey: AQICAHjo9dP83MIkRU7zP48vJb5veObMz9xpFGm6gYEXRHbpqwHzlkKXvUwuFhA5vPqdftyJAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMD40eUXGtDmXeA9J4AgEQgDtYffI3rigMfgQTI7PXpGtmu8BZ7zDOSSbgQaZX+OEAYMmHvNCPc9xmCy3l8pULapdDk3s2Uo2B7M6rww==
33
config:
4+
indexer:GHCR_IMAGE_TAG: nightly-93e971a
45
aws:region: us-west-2
56
indexer:BACKFILL_CHAIN_DATA_BLOCKS: "100"
67
indexer:BASE_STACK: organization/bootstrap/services-staging

‎infra/indexer/Pulumi.l-staging-84532.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
secretsprovider: awskms:///arn:aws:kms:us-west-2:968153779208:alias/pulumi-secrets-key
22
encryptedkey: AQICAHhnm/1/W7/xeF2uxmXOGjFzOf6jjMX+KgbMb0K+LSCbsAFhGPorkVKVmIzT59myXLDeAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMHk+N0QGY87UhlT0bAgEQgDsPtOR+OJ8FN756p+HT9KkCrmMots/HfD2CPJeipMXlAWXT8hnJ6mHZkWZYuBN25IV0LPaEnY/APC+pXA==
33
config:
4+
indexer:GHCR_IMAGE_TAG: nightly-93e971a
45
aws:region: us-west-2
56
indexer:BASE_STACK: organization/bootstrap/services-staging
67
indexer:BOUNDLESS_ADDRESS: 0x7abb16522f4599481361d318b765af988bfcca8e

‎infra/order-generator/Pulumi.l-prod-11155111.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
secretsprovider: awskms:///arn:aws:kms:us-west-2:968153779208:alias/pulumi-secrets-key
22
encryptedkey: AQICAHhnm/1/W7/xeF2uxmXOGjFzOf6jjMX+KgbMb0K+LSCbsAG8+En5WRcnegfmXdKPmxM2AAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMBhB0twYe9uOb6WQgAgEQgDuYPvLqO7SGhJXFhNltdNmk6blOB7tU2Uht3YQp0LASG73HV3CWrInUVl9D23sm0nxtM92r+cF0Man0Ag==
33
config:
4+
order-generator-base:GHCR_IMAGE_TAG: nightly-93e971a
45
order-generator-base:STOPPED: true
56
order-generator-base:ETH_RPC_URL:
67
secure: v1:JV6BU8LnLaZSXmOO:P7LOOA5XoPzhznzjpRUQLza+wA36VAebDwi8qwAp08LK+w3fCI3CHJexzfJgRlM4UGR92GfXW7LBNhSRLjy5eyCl/G5skmQRoMns4QkZi5u9FzF7fy52nhXWLXCFIRsCCyxC7vtXCrVrUL48ZlqdP/U/3g==

‎infra/order-generator/Pulumi.l-prod-167000.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
secretsprovider: awskms:///arn:aws:kms:us-west-2:968153779208:alias/pulumi-secrets-key
22
encryptedkey: AQICAHjo9dP83MIkRU7zP48vJb5veObMz9xpFGm6gYEXRHbpqwEZO7JTkZlIKRs+bMDVZwfkAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMMjjsI00zrwgjE2HDAgEQgDsPwOEqqeuj+E2axnfWJ0VzxYQF4EoezYwNRod3IhRI60yM9Qk3azSZSKgerouvKYtZVKMqS5cM+IIKfQ==
33
config:
4+
order-generator-base:GHCR_IMAGE_TAG: nightly-93e971a
45
order-generator-base:STOPPED: true
56
aws:region: us-west-2
67
order-generator-base:BASE_STACK: organization/bootstrap/services-prod

0 commit comments

Comments
 (0)