conda-forge
Feedstock tokens per CI
Currently the feedstock token is the same for each CI and is only stored on existing CI. This is problematic when adding a new CI as we have to reset all the tokens for all CI as we don't have the token in plain text to add to the new CI.
This requires a change to conda-smithy. To make this easier we can keep using the global token if there's no CI specific token.
cc @beckermr, @jaimergp
Thanks for making this one!
One comment here that I did not store any tokens in plain text on the conda-forge side on purpose to increase security. The tokens are salted+hashed and then stored in a private place.
We'll also need corresponding changes in the ci-setup scripts repo and possibly the webserver.
We'll also need corresponding changes in the ci-setup scripts repo and possibly the webserver.
They are all handled by conda-smithy right?
Validation depends on how the tokens are stored: https://github.com/conda-forge/conda-forge-webservices/blob/main/conda_forge_webservices/feedstock_outputs.py#L35
We could/should clean this up so we don't have these coordination issues.
I wrote that since verifying via an https request is faster. We should upstream it back to smithy.