Skip to content

Implemented version switcher for docs the Operators way #392

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nastena1606 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Implemented version switcher for docs the Operators way #392

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6168786
Implemented version switcher for docs the Operators way
nastena1606 Jul 22, 2026
1b610db
Updated steps to add more security
nastena1606 Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 63 additions & 0 deletions .github/workflows/main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
name: Build Percona Backup for MongoDB docs
on:
push:
branches:
- main

jobs:
build:
name: Deploy docs
runs-on: ubuntu-latest
permissions:
contents: write

steps:
#Pull the latest changes
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0 # fetch all commits/branches
#Prepare the env
- name: Set up Python
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
with:
python-version: '3.x'

#Configure git
- name: Configure git
env:
ROBOT_TOKEN: ${{ secrets.ROBOT_TOKEN }}
run: |
git config --global url."https://percona-platform-robot:${ROBOT_TOKEN}@github.com".insteadOf "https://github.com"
git config user.name "GitHub Action"
git config user.email "github-action@users.noreply.github.com"
git config user.password "${ROBOT_TOKEN}"
echo "GIT_USER=percona-platform-robot:${ROBOT_TOKEN}" >> $GITHUB_ENV

@radoslawszulgo radoslawszulgo Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GIT_USER is set but never read anywhere in this repo (checked both main.yaml and vale.yml — no consumer). So lines 34–35 aren't just risky, they're dead code that adds risk for no benefit.

Line 34 — git config user.password "${ROBOT_TOKEN}"
user.password isn't a real git config key (git doesn't read credentials from user.*). It does nothing functionally, but it does write the raw token in plaintext into ~/.gitconfig for the rest of the job. Pure downside, no upside — delete it.

Line 35 — echo "GIT_USER=percona-platform-robot:${ROBOT_TOKEN}" >> $GITHUB_ENV
This writes the token into $GITHUB_ENV, which means every subsequent step in the job gets GIT_USER (containing the raw secret) injected into its environment automatically — a much bigger blast radius than the one step that needs it. GitHub does mask the literal token value in logs, but that doesn't protect against a compromised/malicious dependency in a later step (e.g. something pulled in by pip install -r requirements.txt) reading $GIT_USER from its own env and exfiltrating it. Since nothing downstream even uses GIT_USER, this line should just go.

@radoslawszulgo radoslawszulgo Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That action can be removed - I suggested a rewritten step later



#Extract release from YAML
- name: Extract release from variables
run: |
RELEASE=$(grep '^release:' variables.yml | awk '{print $2}' | tr -d "'")
echo "RELEASE=$RELEASE" >> $GITHUB_ENV
# PRUNED_VERSION=$(grep '^pruned_version:' variables.yml | awk '{print $2}' | tr -d "'")
# echo "PRUNED_VERSION"=$"PRUNED_VERSION" >> $GITHUB_ENV


#Set up MkDocs
- name: Install MkDocs
run: |
python -m pip install --upgrade pip
pip install wheel
if [ -f requirements.txt ]; then pip install -r requirements.txt; fi


@radoslawszulgo radoslawszulgo Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# Configure git auth right before it's needed, scoped to this checkout only,
# so the credential isn't live on disk for the earlier setup steps.
- name: Configure git
env:
ROBOT_TOKEN: ${{ secrets.ROBOT_TOKEN }}
run: |
git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic $(printf '%s' "x-access-token:${ROBOT_TOKEN}" | base64 -w0)"
git config user.name "GitHub Action"
git config user.email "github-action@users.noreply.github.com"

@radoslawszulgo radoslawszulgo Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • insteadOf → http.extraheader: instead of embedding percona-platform-robot:${ROBOT_TOKEN} directly in a rewritten URL (visible in git remote -v, cache dirs, etc.), the token is now sent as a base64-encoded HTTP Authorization: basic header via http.https://github.com/.extraheader.
  • local instead of --global: scopes the credential to this one repo checkout (.git/config) instead of the whole runner's ~/.gitconfig, so it can't leak into unrelated git operations elsewhere in the job (e.g. anything pip install might do).
  • Reduced lifetime: the "Configure git" step moved from the very start of the job to right before "Deploy docs" — the only step that actually needs write access. It's no longer configured during Python setup / release extraction / MkDocs install.

# Deploy docs
- name: Deploy docs
env:
MKDOCS_GIT_COMMITTERS_APIKEY: ${{ secrets.ROBOT_TOKEN }}
run: |
mike deploy $RELEASE -u latest -b publish -p
mike set-default latest -b publish -p
# mike delete $PRUNED_VERSION -b publish -p

@radoslawszulgo radoslawszulgo Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# Drop the credential as soon as it's no longer needed
- name: Clear git credentials
if: always()
run: git config --local --unset-all http.https://github.com/.extraheader || true

@radoslawszulgo radoslawszulgo Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Explicit cleanup: added a final "Clear git credentials" step (if: always()) that unsets the extraheader as soon as the push is done.

0 .github/workflows/main.yml → .github/workflows/vale.yml
View file
Open in desktop
File renamed without changes.
Empty file added .nojekyll
View file
Open in desktop
Empty file.
4 changes: 2 additions & 2 deletions _resourcepdf/overrides/main.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,8 +44,8 @@
{% endif %}
<meta property="og:type" content="website" />
<meta property="og:title" content="{{ title }}" />
<meta property="og:image" content="https://docs.percona.com/percona-backup-mongodb/_images/mongodb.png" />
<meta property="og:url" content="https://docs.percona.com/percona-backup-mongodb/" />
<meta property="og:image" content="https://docs.percona.com/percona-backup-mongodb/latest/_images/mongodb.png" />
<meta property="og:url" content="https://docs.percona.com/percona-backup-mongodb/latest/index.html" />
{% endblock %}

{% block site_nav %}
Expand Down
4 changes: 4 additions & 0 deletions mkdocs-base.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,10 @@ extra_javascript:
- js/consent.js
- js/rating.js

extra:
version:
provider: mike

markdown_extensions:
abbr: {}
attr_list: {}
Expand Down