mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
Paul Gschwendtner
aef5c92b0b
An additional issue with the current approach of how Yarn and Bazel interact, Yarn 1.x. does not prune unused nested `node_modules`. This can throw-off the Bazel NodeJS rules because they (correctly) would not expect such a nested folder. This seems to happen in some caches currently, so we invalidate the cache. Its worth seeing if we should rather cache the Yarn cache folder on Windows as well, but for now this will remain as is. Yarn 2.x+ will solve this for us, by addressing the root-cause. Dev-Infra already has Yarn 2.x+ running, so it's not far from happening. PR Close #45872
Encryption
Based on https://github.com/circleci/encrypted-files
In the CircleCI web UI, we have a secret variable called KEY
https://circleci.com/gh/angular/angular/edit#env-vars
which is only exposed to non-fork builds
(see "Pass secrets to builds from forked pull requests" under
https://circleci.com/gh/angular/angular/edit#advanced-settings)
We use this as a symmetric AES encryption key to encrypt tokens like a GitHub token that enables publishing snapshots.
To create the github_token file, we take this approach:
- Find the angular-builds:token in the internal pw database
- Go inside the CircleCI default docker image so you use the same version of openssl as we will at runtime:
docker run --rm -it circleci/node:10.12 - echo "https://[token]:@github.com" > credentials
- openssl aes-256-cbc -e -in credentials -out .circleci/github_token -k $KEY
- If needed, base64-encode the result so you can copy-paste it out of docker:
base64 github_token