Skip to content

[codex] Cleanup old gateway secret versions #61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Pigbibi merged 1 commit into from
May 31, 2026
Merged

[codex] Cleanup old gateway secret versions #61

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -320,6 +320,40 @@ jobs:
fi

printf '%s' "${secret_value}" | gcloud secrets versions add "${secret_name}" --project "${GCP_PROJECT_ID}" --data-file=- >/dev/null
cleanup_secret_versions "${secret_name}"
}

cleanup_secret_versions() {
local secret_name="$1"
local old_versions

old_versions="$(
gcloud secrets versions list "${secret_name}" \
--project "${GCP_PROJECT_ID}" \
--format=json \
| python -c 'import json,sys
rows = json.load(sys.stdin)

@chatgpt-codex-connector chatgpt-codex-connector Bot May 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Indent embedded Python inside the run block

In .github/workflows/main.yml, these newly added Python lines are not indented under the run: | block. Because YAML block scalar content must remain indented, rows = json.load(sys.stdin) terminates the shell script and becomes top-level YAML, so GitHub Actions cannot parse/load this workflow when this file is present.

Useful? React with 👍 / 👎.

active = [
int(row["name"].rsplit("/", 1)[-1])
for row in rows
if row.get("state") in {"ENABLED", "DISABLED"}
]
if len(active) <= 1:
sys.exit(0)
keep = max(active)
print("\n".join(str(version) for version in active if version != keep))
'
)"

while IFS= read -r version; do
if [ -z "${version}" ]; then
continue
fi
gcloud secrets versions destroy "${version}" \
--secret "${secret_name}" \
--project "${GCP_PROJECT_ID}" \
--quiet >/dev/null
done <<< "${old_versions}"
}

mask_if_present() {
Expand Down