Switch some secrets to variables and perform some housekeeping

.github/examples/build-deploy-artifact-remote-repository.yml

@@ -62,8 +62,9 @@ jobs:
       # The commit details should be an automation account, with a shared email;
       # the SSH config in secrets use these credentials, and the user should be
       # able to access the remote repo (eg add as a user).
-      git_name: GAIN Automation
-      git_email: geeks+client.gha@thisisgain.com
+      # Git user details, including SSH keys, should be stored in Keeper.
+      git_name: ${{ vars.git_name }}
+      git_email: ${{ vars.git_email }}
       source_key: theme
       # Skip adding the default set of files.
       add_files_defaults: false

.github/examples/build-deploy-pantheon-multidev.yml

@@ -51,8 +51,9 @@ jobs:
       # The commit details should be an automation account, with a shared email;
       # the SSH config in secrets use these credentials, and the user should be
       # able to access the remote repo (eg add as a user).
-      git_name: GAIN Automation
-      git_email: geeks+client.gha@thisisgain.com
+      # Git user details, including SSH keys, should be stored in Keeper.
+      git_name: ${{ vars.git_name }}
+      git_email: ${{ vars.git_email }}
       # Set the multidev_safe flag. This will create a shorter branch name that
       # is safe to use as a multidev site name.
       multidev_safe: true

.github/examples/build-test-pull-request-tests.yml

@@ -72,8 +72,12 @@ jobs:
     uses: thisisgain/.github/.github/workflows/03-deploy-artifact.yml@main
     with:
       container: registry.gitlab.com/freelygive/docker/drupal-php-node:p8.3-cli-n20
-      git_name: GAIN Automation
-      git_email: geeks+client.gha@thisisgain.com
+      # The commit details should be an automation account, with a shared email;
+      # the SSH config in secrets use these credentials, and the user should be
+      # able to access the remote repo (eg add as a user).
+      # Git user details, including SSH keys, should be stored in Keeper.
+      git_name: ${{ vars.git_name }}
+      git_email: ${{ vars.git_email }}
       source_key: composer
       add_files_defaults: false
       add_files: >-

.github/examples/deploy-acquia-acli.yml

@@ -30,8 +30,9 @@ jobs:
       # The commit details should be an automation account, with a shared email;
       # the SSH config in secrets use these credentials, and the user should be
       # able to access the remote repo (eg add as a user).
-      git_name: GAIN Automation
-      git_email: geeks+client.gha@thisisgain.com
+      # Git user details, including SSH keys, should be stored in Keeper.
+      git_name: ${{ vars.git_name }}
+      git_email: ${{ vars.git_email }}
       # The target branch is used for deploying a tag: ACLI requires a push to a
       # branch at the same time. The branch name is automatically detected if
       # this is triggered by a push to a branch.

.github/examples/deploy-pantheon-default.yml

@@ -32,8 +32,9 @@ jobs:
       # The commit details should be an automation account, with a shared email;
       # the SSH config in secrets use these credentials, and the user should be
       # able to access the remote repo (eg add as a user).
-      git_name: GAIN Automation
-      git_email: geeks+client.gha@thisisgain.com
+      # Git user details, including SSH keys, should be stored in Keeper.
+      git_name: ${{ vars.git_name }}
+      git_email: ${{ vars.git_email }}
     # If the repository is in the GAIN GitHub, you can use this shortcut to pass
     # all secrets through without needing to define them.
     secrets: inherit

.github/examples/deploy-release-remote-repository.yml

@@ -53,7 +53,9 @@ jobs:
     with:
       target_branch: ${{ inputs.target_branch }}
       push_to_remote: true
-      # The committer in this case is the user who triggered the workflow.
+      # When code is automatically pushed, we use a shared account to associate
+      # the commit/push with. In this case, because a person is triggering the
+      # build and push, the committer is the user who triggered the workflow.
       git_name: ${{ github.event.sender.login }}
       git_email: ${{ github.event.sender.id }}+${{ github.event.sender.login }}@users.noreply.github.com
     secrets:

.github/workflows/00-acquia-backup-databases.yml

@@ -7,25 +7,25 @@ name: Backup Acquia databases using ACLI.
 on:
   workflow_call:
     inputs:
-      filter:
-        description: 'Optionally, provide a filter for the databases. See: https://docs.acquia.com/acquia-cloud-platform/add-ons/acquia-cli/commands/api:applications:database-list'
+      php_version:
+        description: 'Optionally, specify a PHP version to install. Default: 8.3.'
         type: string
         required: false
-      php_version:
-        description: 'Optionally, specify a PHP version to install. Default: 8.2.'
+        default: '8.3'
+      filter:
+        description: 'Optionally, provide a filter for the databases. See: https://docs.acquia.com/acquia-cloud-platform/add-ons/acquia-cli/commands/api:applications:database-list'
         type: string
         required: false
-        default: '8.2'
     secrets:
-      ACQUIA_ENVIRONMENT_ID:
-        description: 'Acquia environment ID.'
-        required: true
       ACLI_CLIENT_ID:
         description: 'The client ID for authenticating with ACLI.'
         required: true
       ACLI_CLIENT_SECRET:
         description: 'The client secret for authenticating with ACLI.'
         required: true
+      ACQUIA_ENVIRONMENT_ID:
+        description: 'Acquia environment ID.'
+        required: true
 
 defaults:
   run:

.github/workflows/00-create-ci-settings.yml

@@ -11,28 +11,18 @@ on:
         description: 'The Docker image to use.'
         type: string
         required: true
-      source_key:
-        description: 'The source cache key suffix, or empty to perform a clean checkout.'
-        type: string
-        default: 'composer'
       target_key:
         description: 'The target cache key suffix, or empty to throw away.'
         type: string
         default: 'settings'
+      source_key:
+        description: 'The source cache key suffix, or empty to perform a clean checkout.'
+        type: string
+        default: 'composer'
       docroot:
         description: 'The docroot where Drupal is installed.'
         type: string
         default: 'docroot'
-    secrets:
-      ACQUIA_ENVIRONMENT_ID:
-        description: 'Acquia environment ID.'
-        required: true
-      ACLI_CLIENT_ID:
-        description: 'The client ID for authenticating with ACLI.'
-        required: true
-      ACLI_CLIENT_SECRET:
-        description: 'The client secret for authenticating with ACLI.'
-        required: true
 
 defaults:
   run:

.github/workflows/00-drush-site-install.yml

@@ -12,6 +12,26 @@ on:
         description: 'The Docker image to use.'
         type: string
         required: true
+      db_image:
+        description: 'A Docker database image, eg mysql:5.7 or mariadb:10.3. Default: mariadb:10.3.'
+        type: string
+        default: 'mariadb:10.3'
+      db_user:
+        description: 'The database username. Default: db.'
+        type: string
+        default: 'db'
+      db_pass:
+        description: 'The database password. Default: db.'
+        type: string
+        default: 'db'
+      db_name:
+        description: 'The database name. Default: db.'
+        type: string
+        default: 'db'
+      db_root_pass:
+        description: 'The database root password. Default: root.'
+        type: string
+        default: 'root'
       source_key:
         description: 'The source cache key suffix, or empty to perform a clean checkout.'
         type: string
@@ -36,13 +56,13 @@ jobs:
     container: ${{ inputs.container }}
     services:
       db:
-        image: mariadb:10.3
+        image: ${{ inputs.db_image }}
         ports: [3306]
         env:
-          MYSQL_USER: db
-          MYSQL_PASSWORD: db
-          MYSQL_DATABASE: db
-          MYSQL_ROOT_PASSWORD: root
+          MYSQL_USER: ${{ inputs.db_user }}
+          MYSQL_PASSWORD: ${{ inputs.db_pass }}
+          MYSQL_DATABASE: ${{ inputs.db_name }}
+          MYSQL_ROOT_PASSWORD: ${{ inputs.db_root_pass }}
         options: --health-cmd="mysqladmin ping" --health-interval=5s --health-timeout=2s --health-retries=3
     steps:
       - name: Disable Git safe directories as we are in a container.

.github/workflows/00-pantheon-create-multidev.yml

@@ -20,6 +20,11 @@ on:
         type: string
         required: false
         default: 't'
+      php_version:
+        description: 'Optionally, specify a PHP version to install. Default: 8.3.'
+        type: string
+        required: false
+        default: '8.3'
     secrets:
       PANTHEON_MACHINE_TOKEN:
         description: 'Machine token authorised to the Pantheon site.'
@@ -51,12 +56,12 @@ jobs:
           strip_prefix: ${{ inputs.strip_prefix }}
           safe_prefix: ${{ inputs.safe_prefix }}
 
-      - name: Install PHP
+      - name: Install PHP.
         uses: shivammathur/setup-php@master
         with:
-          php-version: '8.2'
+          php-version: ${{ inputs.php_version }}
 
-      - name: Install Terminus
+      - name: Install Terminus.
         uses: pantheon-systems/terminus-github-actions@v1
         with:
           pantheon-machine-token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}

.github/workflows/00-pantheon-remove-branch.yml

@@ -21,21 +21,18 @@ on:
         type: string
         required: false
         default: 't'
+      php_version:
+        description: 'Optionally, specify a PHP version to install. Default: 8.3.'
+        type: string
+        required: false
+        default: '8.3'
     secrets:
-      REMOTE_REPO:
-        description: 'The remote repository URL.'
-        required: true
-      REMOTE_SSH_KEY:
-        description: 'Private SSH key authorised to push to the remote repository.'
-        required: true
-      SSH_CONFIG:
-        description: 'SSH configuration. Can be an empty secret, or not included.'
-      KNOWN_HOSTS:
-        description: 'SSH known hosts. Set using `ssh-keyscan` command.'
-        required: true
       PANTHEON_MACHINE_TOKEN:
         description: 'Machine token authorised to the Pantheon site.'
         required: true
+      REMOTE_REPO:
+        description: 'The remote repository URL.'
+        required: true
 
 defaults:
   run:
@@ -62,10 +59,10 @@ jobs:
           strip_prefix: ${{ inputs.strip_prefix }}
           safe_prefix: ${{ inputs.safe_prefix }}
 
-      - name: Installing PHP
+      - name: Install PHP.
         uses: shivammathur/setup-php@master
         with:
-          php-version: '8.2'
+          php-version: ${{ inputs.php_version }}
 
       - name: Install Terminus.
         uses: pantheon-systems/terminus-github-actions@v1
@@ -91,7 +88,7 @@ jobs:
           echo ${multidev_list} >> ${GITHUB_OUTPUT}
           echo "${delimiter}" >> "${GITHUB_OUTPUT}"
 
-      - name: Delete a multidev environment.
+      - name: Delete the multidev environment.
         # If there was a multidev environment, delete it, and the branch.
         if: steps.check_existing.outputs.multidev_list != ''
         continue-on-error: true

.github/workflows/01-build-composer.yml

@@ -7,21 +7,21 @@ name: Build and validate Composer.
 on:
   workflow_call:
     inputs:
-      directory:
-        description: 'The directory in which to run commands.'
-        type: string
-        default: './'
       container:
         description: 'The Docker image to use.'
         type: string
         required: true
-      source_key:
-        description: 'The source cache key suffix, or empty to perform a clean checkout.'
+      directory:
+        description: 'The directory in which to run commands.'
         type: string
+        default: './'
       target_key:
         description: 'The target cache key suffix, or empty to throw away.'
         type: string
         default: 'composer'
+      source_key:
+        description: 'The source cache key suffix, or empty to perform a clean checkout.'
+        type: string
       ssh_config:
         description: 'Whether to run SSH configuration for asset access.'
         type: boolean

.github/workflows/01-build-npm.yml

@@ -7,17 +7,10 @@ name: Build and validate an NPM package.
 on:
   workflow_call:
     inputs:
-      directory:
-        description: 'The directory in which to run commands.'
-        type: string
-        required: true
       container:
         description: 'The Docker image to use.'
         type: string
         required: true
-      source_key:
-        description: 'The source cache key suffix, or empty to perform a clean checkout.'
-        type: string
       target_key:
         description: 'The target cache key suffix, or empty to throw away.'
         type: string
@@ -26,14 +19,17 @@ on:
         description: 'The target path for the cache.'
         type: string
         default: './*'
-      target_modules:
-        description: 'Whether to keep the `node_modules` directory from the target build.'
-        type: boolean
-        default: true
+      source_key:
+        description: 'The source cache key suffix, or empty to perform a clean checkout.'
+        type: string
       ssh_config:
         description: 'Whether to run SSH configuration for asset access.'
         type: boolean
         default: false
+      directory:
+        description: 'The directory in which to run commands.'
+        type: string
+        required: true
       run_build:
         description: 'Whether to run `npm run build`.'
         type: boolean
@@ -46,6 +42,10 @@ on:
         description: 'Whether to run `npm run test`.'
         type: boolean
         default: false
+      target_modules:
+        description: 'Whether to keep the `node_modules` directory from the target build.'
+        type: boolean
+        default: true
     secrets:
       REMOTE_SSH_KEY:
         description: 'Private SSH key to retrieve any authenticated assets.'

.github/workflows/02-test-blt.yml

@@ -16,6 +16,26 @@ on:
         description: 'The source cache key suffix, or empty to perform a clean checkout.'
         type: string
         default: 'composer'
+      db_image:
+        description: 'A Docker database image, eg mysql:5.7 or mariadb:10.3. Default: mysql:5.7.'
+        type: string
+        default: 'mysql:5.7'
+      db_user:
+        description: 'The database username. Default: db.'
+        type: string
+        default: 'db'
+      db_pass:
+        description: 'The database password. Default: db.'
+        type: string
+        default: 'db'
+      db_name:
+        description: 'The database name. Default: db.'
+        type: string
+        default: 'db'
+      db_root_pass:
+        description: 'The database root password. Default: root.'
+        type: string
+        default: 'root'
       copy_ci_settings:
         description: 'Whether to copy the settings.ci.php to settings.local.php.'
         type: boolean
@@ -58,13 +78,13 @@ jobs:
     container: ${{ inputs.container }}
     services:
       db:
-        image: mysql:5.7
+        image: ${{ inputs.db_image }}
         ports: [ 3306 ]
         env:
-          MYSQL_USER: db
-          MYSQL_PASSWORD: db
-          MYSQL_DATABASE: db
-          MYSQL_ROOT_PASSWORD: root
+          MYSQL_USER: ${{ inputs.db_user }}
+          MYSQL_PASSWORD: ${{ inputs.db_pass }}
+          MYSQL_DATABASE: ${{ inputs.db_name }}
+          MYSQL_ROOT_PASSWORD: ${{ inputs.db_root_pass }}
         options: --health-cmd="mysqladmin ping" --health-interval=5s --health-timeout=2s --health-retries=3
     steps:
       - name: Restore build from a previous step.