From 8c827f912b210dda1b8ed3289a186a52ab4070d2 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 15:39:13 +0200 Subject: [PATCH 01/21] feat: update github application permission to allow curent scaleway execution --- github-ci/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/github-ci/main.tf b/github-ci/main.tf index 58584d8..4ef0100 100644 --- a/github-ci/main.tf +++ b/github-ci/main.tf @@ -17,7 +17,7 @@ resource "scaleway_iam_policy" "github_ci" { rule { project_ids = [var.project_id] - permission_set_names = ["ObjectStorageReadOnly"] + permission_set_names = ["KubernetesFullAccess","VPCFullAccess", "ObjectStorageObjectsWrite"] } } From 78fd5df899cf78e54990c4c76556edafd098c06a Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 15:44:40 +0200 Subject: [PATCH 02/21] test --- .github/workflows/scaleway-auth-check.yml | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index b6b0d1e..bed78c7 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -13,9 +13,24 @@ on: - 'github-ci/**' permissions: - contents: read + contents: write # Required for Infinisical OIDC + jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: Infisical/secrets-action@v1.0.7 + with: + method: "oidc" + env-slug: "staging" + project-slug: "platform-p-qc1" + identity-id: "7bd0594e-a8d2-48f9-aa26-da309bca7094" + - name: test + run: | + env + + list-buckets: runs-on: ubuntu-latest # Reference a dedicated environment so secret usage is scoped to it From 0bf263fbbdb2ed995258fae7773c407589ee3f5b Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 15:50:24 +0200 Subject: [PATCH 03/21] test --- .github/workflows/scaleway-auth-check.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index bed78c7..7543c84 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -13,7 +13,8 @@ on: - 'github-ci/**' permissions: - contents: write # Required for Infinisical OIDC + id-token: write + contents: read jobs: From b33cead37e15f917683d5d098d1f1ebb8f7c349a Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 15:56:01 +0200 Subject: [PATCH 04/21] test --- .github/workflows/scaleway-auth-check.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index 7543c84..9399c04 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -24,9 +24,10 @@ jobs: - uses: Infisical/secrets-action@v1.0.7 with: method: "oidc" + identity-id: "7bd0594e-a8d2-48f9-aa26-da309bca7094" env-slug: "staging" + secret-path: "ci" project-slug: "platform-p-qc1" - identity-id: "7bd0594e-a8d2-48f9-aa26-da309bca7094" - name: test run: | env From 5c2fe132435c12036173f9368c49ce4889904599 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:01:30 +0200 Subject: [PATCH 05/21] test --- .github/workflows/scaleway-auth-check.yml | 67 ++++++++++++----------- 1 file changed, 36 insertions(+), 31 deletions(-) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index 9399c04..066bee0 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -17,6 +17,8 @@ permissions: contents: read +env: + SCW_DEFAULT_PROJECT_ID: jobs: build: runs-on: ubuntu-latest @@ -28,38 +30,41 @@ jobs: env-slug: "staging" secret-path: "ci" project-slug: "platform-p-qc1" + - uses: hashicorp/setup-terraform@v4 + with: + terraform_version: "1.14.8" - name: test - run: | - env + working-directory: cluster/scaleway + run: terraform plan - list-buckets: - runs-on: ubuntu-latest - # Reference a dedicated environment so secret usage is scoped to it - # (satisfies zizmor's secrets-outside-env audit, and gives a place to attach - # protection rules later). Auto-created on first run with no protection. - environment: scaleway - steps: - # Fail fast and clearly if the secrets aren't set, instead of letting the - # CLI emit a confusing auth error (or worse, appear to pass). - - name: Assert credentials are present - env: - SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }} - SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }} - run: | - if [ -z "$SCW_ACCESS_KEY" ] || [ -z "$SCW_SECRET_KEY" ]; then - echo "::error::SCW_ACCESS_KEY and/or SCW_SECRET_KEY are not set. Run 'gh secret set' (see github-ci/README.md)." - exit 1 - fi + # list-buckets: + # runs-on: ubuntu-latest + # # Reference a dedicated environment so secret usage is scoped to it + # # (satisfies zizmor's secrets-outside-env audit, and gives a place to attach + # # protection rules later). Auto-created on first run with no protection. + # environment: scaleway + # steps: + # # Fail fast and clearly if the secrets aren't set, instead of letting the + # # CLI emit a confusing auth error (or worse, appear to pass). + # - name: Assert credentials are present + # env: + # SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }} + # SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }} + # run: | + # if [ -z "$SCW_ACCESS_KEY" ] || [ -z "$SCW_SECRET_KEY" ]; then + # echo "::error::SCW_ACCESS_KEY and/or SCW_SECRET_KEY are not set. Run 'gh secret set' (see github-ci/README.md)." + # exit 1 + # fi - - name: List fr-par Object Storage buckets - uses: scaleway/action-scw@2e34a1eb35cf3cac627f24643a101fea269cbd83 # v0.0.3 - with: - version: v2.41.0 - access-key: ${{ secrets.SCW_ACCESS_KEY }} - secret-key: ${{ secrets.SCW_SECRET_KEY }} - # Public identifiers (not credentials) the scw CLI wants even for a - # project-scoped key. Repo variables, not secrets. - default-organization-id: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }} - default-project-id: ${{ vars.SCW_DEFAULT_PROJECT_ID }} - args: object bucket list region=fr-par + # - name: List fr-par Object Storage buckets + # uses: scaleway/action-scw@2e34a1eb35cf3cac627f24643a101fea269cbd83 # v0.0.3 + # with: + # version: v2.41.0 + # access-key: ${{ secrets.SCW_ACCESS_KEY }} + # secret-key: ${{ secrets.SCW_SECRET_KEY }} + # # Public identifiers (not credentials) the scw CLI wants even for a + # # project-scoped key. Repo variables, not secrets. + # default-organization-id: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }} + # default-project-id: ${{ vars.SCW_DEFAULT_PROJECT_ID }} + # args: object bucket list region=fr-par From 911e2da8a022fc24af0312fa1555a65b8d848477 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:02:55 +0200 Subject: [PATCH 06/21] test --- .github/workflows/scaleway-auth-check.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index 066bee0..8943a3c 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -23,6 +23,7 @@ jobs: build: runs-on: ubuntu-latest steps: + - uses: actions/checkout@v6 - uses: Infisical/secrets-action@v1.0.7 with: method: "oidc" From 8c18568496c5a5579a73ca38627c50475b6d77b2 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:03:48 +0200 Subject: [PATCH 07/21] test --- .github/workflows/scaleway-auth-check.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index 8943a3c..4463711 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -34,9 +34,9 @@ jobs: - uses: hashicorp/setup-terraform@v4 with: terraform_version: "1.14.8" - - name: test + - name: init working-directory: cluster/scaleway - run: terraform plan + run: terraform init # list-buckets: From 3796bda2b972d8f39a94c1a55da66900895f631a Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:09:51 +0200 Subject: [PATCH 08/21] test --- .github/workflows/scaleway-auth-check.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index 4463711..7f0138b 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -37,6 +37,12 @@ jobs: - name: init working-directory: cluster/scaleway run: terraform init + # Terraform "s3" backend, which is used by the infrastructure to store the state remotely, is primarily integrated with AWS, and not with Scaleway. + # This imply to have AWS credentials environments variable containing Scaleway credentials. + # See documentation here : https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/guides/backend_guide#alternative-store-terraform-state-in-scaleway-object-storage-with-locking + env: + AWS_ACCESS_KEY_ID: $SCW_SECRET_KEY + AWS_SECRET_ACCESS_KEY: $SCW_ACCESS_KEY # list-buckets: From f900dfdc8311d73f18e3bc3aeaa7bab2ebfa34a8 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:14:10 +0200 Subject: [PATCH 09/21] test --- github-ci/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/github-ci/main.tf b/github-ci/main.tf index 4ef0100..217ec09 100644 --- a/github-ci/main.tf +++ b/github-ci/main.tf @@ -17,7 +17,7 @@ resource "scaleway_iam_policy" "github_ci" { rule { project_ids = [var.project_id] - permission_set_names = ["KubernetesFullAccess","VPCFullAccess", "ObjectStorageObjectsWrite"] + permission_set_names = ["KubernetesFullAccess","VPCFullAccess", "ObjectStorageObjectsWrite", "ObjectStorageBucketsRead"] } } From 8fbdc64e467803d0820f5b0b3442dce15fcb27a7 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:18:54 +0200 Subject: [PATCH 10/21] test --- github-ci/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/github-ci/main.tf b/github-ci/main.tf index 217ec09..b6c0365 100644 --- a/github-ci/main.tf +++ b/github-ci/main.tf @@ -17,7 +17,7 @@ resource "scaleway_iam_policy" "github_ci" { rule { project_ids = [var.project_id] - permission_set_names = ["KubernetesFullAccess","VPCFullAccess", "ObjectStorageObjectsWrite", "ObjectStorageBucketsRead"] + permission_set_names = ["KubernetesFullAccess","VPCFullAccess", "ObjectStorageBucketsRead", "ObjectStorageObjectsRead", "ObjectStorageObjectsWrite"] } } From 0c794eca5930135965d1e2b720951155e17ea253 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:20:21 +0200 Subject: [PATCH 11/21] test --- github-ci/main.tf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/github-ci/main.tf b/github-ci/main.tf index b6c0365..36f73fa 100644 --- a/github-ci/main.tf +++ b/github-ci/main.tf @@ -17,7 +17,8 @@ resource "scaleway_iam_policy" "github_ci" { rule { project_ids = [var.project_id] - permission_set_names = ["KubernetesFullAccess","VPCFullAccess", "ObjectStorageBucketsRead", "ObjectStorageObjectsRead", "ObjectStorageObjectsWrite"] + # permission_set_names = ["KubernetesFullAccess","VPCFullAccess", "ObjectStorageBucketsRead", "ObjectStorageObjectsRead", "ObjectStorageObjectsWrite"] + permission_set_names = ["KubernetesFullAccess","VPCFullAccess", "ObjectStorageFullAccess"] } } From c47f6766b4cf1d60e1e7deadbdae3448a6a180f0 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:26:33 +0200 Subject: [PATCH 12/21] test --- .github/workflows/scaleway-auth-check.yml | 27 +++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index 7f0138b..1d7a2d7 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -43,8 +43,31 @@ jobs: env: AWS_ACCESS_KEY_ID: $SCW_SECRET_KEY AWS_SECRET_ACCESS_KEY: $SCW_ACCESS_KEY - - + test: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + - uses: Infisical/secrets-action@v1.0.7 + with: + method: "oidc" + identity-id: "7bd0594e-a8d2-48f9-aa26-da309bca7094" + env-slug: "staging" + secret-path: "ci" + project-slug: "platform-p-qc1" + - name: Use CLI + uses: scaleway/action-scw@v0 + with: + save-config: true + export-config: true + version: v2.24.0 + # access-key: ${{ secrets.SCW_ACCESS_KEY }} + # secret-key: ${{ secrets.SCW_SECRET_KEY }} + default-organization-id: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }} + default-project-id: ${{ vars.SCW_DEFAULT_PROJECT_ID }} + args: object bucket list region=fr-par + - name: b + run: | + scw # list-buckets: # runs-on: ubuntu-latest # # Reference a dedicated environment so secret usage is scoped to it From 8ffc4c1039147cc4407d0b74238022c3a78070ac Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:26:56 +0200 Subject: [PATCH 13/21] test --- .github/workflows/scaleway-auth-check.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index 1d7a2d7..4ef2ddd 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -65,9 +65,6 @@ jobs: default-organization-id: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }} default-project-id: ${{ vars.SCW_DEFAULT_PROJECT_ID }} args: object bucket list region=fr-par - - name: b - run: | - scw # list-buckets: # runs-on: ubuntu-latest # # Reference a dedicated environment so secret usage is scoped to it From 795ddeac7978d33e86f89f949147fe4e357961fb Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:32:08 +0200 Subject: [PATCH 14/21] test --- .github/workflows/scaleway-auth-check.yml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index 4ef2ddd..ab8cb9c 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -46,22 +46,22 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: Infisical/secrets-action@v1.0.7 - with: - method: "oidc" - identity-id: "7bd0594e-a8d2-48f9-aa26-da309bca7094" - env-slug: "staging" - secret-path: "ci" - project-slug: "platform-p-qc1" + # - uses: actions/checkout@v6 + # - uses: Infisical/secrets-action@v1.0.7 + # with: + # method: "oidc" + # identity-id: "7bd0594e-a8d2-48f9-aa26-da309bca7094" + # env-slug: "staging" + # secret-path: "ci" + # project-slug: "platform-p-qc1" - name: Use CLI uses: scaleway/action-scw@v0 with: save-config: true export-config: true version: v2.24.0 - # access-key: ${{ secrets.SCW_ACCESS_KEY }} - # secret-key: ${{ secrets.SCW_SECRET_KEY }} + access-key: ${{ secrets.SCW_ACCESS_KEY }} + secret-key: ${{ secrets.SCW_SECRET_KEY }} default-organization-id: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }} default-project-id: ${{ vars.SCW_DEFAULT_PROJECT_ID }} args: object bucket list region=fr-par From 04cf1c90c88fb780123f9951344fcd20f0c121c0 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:33:08 +0200 Subject: [PATCH 15/21] test --- .github/workflows/scaleway-auth-check.yml | 59 ++++++++++++----------- 1 file changed, 30 insertions(+), 29 deletions(-) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index ab8cb9c..48c40f9 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -65,33 +65,34 @@ jobs: default-organization-id: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }} default-project-id: ${{ vars.SCW_DEFAULT_PROJECT_ID }} args: object bucket list region=fr-par - # list-buckets: - # runs-on: ubuntu-latest - # # Reference a dedicated environment so secret usage is scoped to it - # # (satisfies zizmor's secrets-outside-env audit, and gives a place to attach - # # protection rules later). Auto-created on first run with no protection. - # environment: scaleway - # steps: - # # Fail fast and clearly if the secrets aren't set, instead of letting the - # # CLI emit a confusing auth error (or worse, appear to pass). - # - name: Assert credentials are present - # env: - # SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }} - # SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }} - # run: | - # if [ -z "$SCW_ACCESS_KEY" ] || [ -z "$SCW_SECRET_KEY" ]; then - # echo "::error::SCW_ACCESS_KEY and/or SCW_SECRET_KEY are not set. Run 'gh secret set' (see github-ci/README.md)." - # exit 1 - # fi + + list-buckets: + runs-on: ubuntu-latest + # Reference a dedicated environment so secret usage is scoped to it + # (satisfies zizmor's secrets-outside-env audit, and gives a place to attach + # protection rules later). Auto-created on first run with no protection. + environment: scaleway + steps: + # Fail fast and clearly if the secrets aren't set, instead of letting the + # CLI emit a confusing auth error (or worse, appear to pass). + - name: Assert credentials are present + env: + SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }} + SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }} + run: | + if [ -z "$SCW_ACCESS_KEY" ] || [ -z "$SCW_SECRET_KEY" ]; then + echo "::error::SCW_ACCESS_KEY and/or SCW_SECRET_KEY are not set. Run 'gh secret set' (see github-ci/README.md)." + exit 1 + fi - # - name: List fr-par Object Storage buckets - # uses: scaleway/action-scw@2e34a1eb35cf3cac627f24643a101fea269cbd83 # v0.0.3 - # with: - # version: v2.41.0 - # access-key: ${{ secrets.SCW_ACCESS_KEY }} - # secret-key: ${{ secrets.SCW_SECRET_KEY }} - # # Public identifiers (not credentials) the scw CLI wants even for a - # # project-scoped key. Repo variables, not secrets. - # default-organization-id: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }} - # default-project-id: ${{ vars.SCW_DEFAULT_PROJECT_ID }} - # args: object bucket list region=fr-par + - name: List fr-par Object Storage buckets + uses: scaleway/action-scw@2e34a1eb35cf3cac627f24643a101fea269cbd83 # v0.0.3 + with: + version: v2.41.0 + access-key: ${{ secrets.SCW_ACCESS_KEY }} + secret-key: ${{ secrets.SCW_SECRET_KEY }} + # Public identifiers (not credentials) the scw CLI wants even for a + # project-scoped key. Repo variables, not secrets. + default-organization-id: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }} + default-project-id: ${{ vars.SCW_DEFAULT_PROJECT_ID }} + args: object bucket list region=fr-par From 859845606b7c26b2abc4cc0416134efc780e0797 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:35:14 +0200 Subject: [PATCH 16/21] test --- .github/workflows/scaleway-auth-check.yml | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index 48c40f9..7ad70fe 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -65,7 +65,7 @@ jobs: default-organization-id: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }} default-project-id: ${{ vars.SCW_DEFAULT_PROJECT_ID }} args: object bucket list region=fr-par - + list-buckets: runs-on: ubuntu-latest # Reference a dedicated environment so secret usage is scoped to it @@ -75,15 +75,15 @@ jobs: steps: # Fail fast and clearly if the secrets aren't set, instead of letting the # CLI emit a confusing auth error (or worse, appear to pass). - - name: Assert credentials are present - env: - SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }} - SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }} - run: | - if [ -z "$SCW_ACCESS_KEY" ] || [ -z "$SCW_SECRET_KEY" ]; then - echo "::error::SCW_ACCESS_KEY and/or SCW_SECRET_KEY are not set. Run 'gh secret set' (see github-ci/README.md)." - exit 1 - fi + # - name: Assert credentials are present + # env: + # SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }} + # SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }} + # run: | + # if [ -z "$SCW_ACCESS_KEY" ] || [ -z "$SCW_SECRET_KEY" ]; then + # echo "::error::SCW_ACCESS_KEY and/or SCW_SECRET_KEY are not set. Run 'gh secret set' (see github-ci/README.md)." + # exit 1 + # fi - name: List fr-par Object Storage buckets uses: scaleway/action-scw@2e34a1eb35cf3cac627f24643a101fea269cbd83 # v0.0.3 @@ -91,8 +91,6 @@ jobs: version: v2.41.0 access-key: ${{ secrets.SCW_ACCESS_KEY }} secret-key: ${{ secrets.SCW_SECRET_KEY }} - # Public identifiers (not credentials) the scw CLI wants even for a - # project-scoped key. Repo variables, not secrets. default-organization-id: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }} default-project-id: ${{ vars.SCW_DEFAULT_PROJECT_ID }} args: object bucket list region=fr-par From 088b1d54e0962c1cf37ec2e2cd0731e05569b96c Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:35:52 +0200 Subject: [PATCH 17/21] test --- .github/workflows/scaleway-auth-check.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index 7ad70fe..7fdf4f2 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -45,6 +45,7 @@ jobs: AWS_SECRET_ACCESS_KEY: $SCW_ACCESS_KEY test: runs-on: ubuntu-latest + environment: scaleway steps: # - uses: actions/checkout@v6 # - uses: Infisical/secrets-action@v1.0.7 From bd176a16d0f33d84aa4f82b99bdff8d646b17f1e Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:36:49 +0200 Subject: [PATCH 18/21] test --- .github/workflows/scaleway-auth-check.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index 7fdf4f2..e787bdb 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -58,9 +58,7 @@ jobs: - name: Use CLI uses: scaleway/action-scw@v0 with: - save-config: true - export-config: true - version: v2.24.0 + version: v2.56.0 access-key: ${{ secrets.SCW_ACCESS_KEY }} secret-key: ${{ secrets.SCW_SECRET_KEY }} default-organization-id: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }} From 805ad2dcdef90e75b1bf4044f89cb94acf4b67a2 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:44:52 +0200 Subject: [PATCH 19/21] test --- .github/workflows/scaleway-auth-check.yml | 40 ++++------------------- 1 file changed, 7 insertions(+), 33 deletions(-) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index e787bdb..f350a80 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -36,13 +36,16 @@ jobs: terraform_version: "1.14.8" - name: init working-directory: cluster/scaleway - run: terraform init + run: | + export AWS_ACCESS_KEY_ID=$SCW_SECRET_KEY + export AWS_SECRET_ACCESS_KEY=$SCW_ACCESS_KEY + terraform init # Terraform "s3" backend, which is used by the infrastructure to store the state remotely, is primarily integrated with AWS, and not with Scaleway. # This imply to have AWS credentials environments variable containing Scaleway credentials. # See documentation here : https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/guides/backend_guide#alternative-store-terraform-state-in-scaleway-object-storage-with-locking - env: - AWS_ACCESS_KEY_ID: $SCW_SECRET_KEY - AWS_SECRET_ACCESS_KEY: $SCW_ACCESS_KEY + # env: + # AWS_ACCESS_KEY_ID: $SCW_SECRET_KEY + # AWS_SECRET_ACCESS_KEY: $SCW_ACCESS_KEY test: runs-on: ubuntu-latest environment: scaleway @@ -64,32 +67,3 @@ jobs: default-organization-id: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }} default-project-id: ${{ vars.SCW_DEFAULT_PROJECT_ID }} args: object bucket list region=fr-par - - list-buckets: - runs-on: ubuntu-latest - # Reference a dedicated environment so secret usage is scoped to it - # (satisfies zizmor's secrets-outside-env audit, and gives a place to attach - # protection rules later). Auto-created on first run with no protection. - environment: scaleway - steps: - # Fail fast and clearly if the secrets aren't set, instead of letting the - # CLI emit a confusing auth error (or worse, appear to pass). - # - name: Assert credentials are present - # env: - # SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }} - # SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }} - # run: | - # if [ -z "$SCW_ACCESS_KEY" ] || [ -z "$SCW_SECRET_KEY" ]; then - # echo "::error::SCW_ACCESS_KEY and/or SCW_SECRET_KEY are not set. Run 'gh secret set' (see github-ci/README.md)." - # exit 1 - # fi - - - name: List fr-par Object Storage buckets - uses: scaleway/action-scw@2e34a1eb35cf3cac627f24643a101fea269cbd83 # v0.0.3 - with: - version: v2.41.0 - access-key: ${{ secrets.SCW_ACCESS_KEY }} - secret-key: ${{ secrets.SCW_SECRET_KEY }} - default-organization-id: ${{ vars.SCW_DEFAULT_ORGANIZATION_ID }} - default-project-id: ${{ vars.SCW_DEFAULT_PROJECT_ID }} - args: object bucket list region=fr-par From f2e6bc9a329a65c32ed39ab90d905aa59e448aa7 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:45:54 +0200 Subject: [PATCH 20/21] test --- .github/workflows/scaleway-auth-check.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index f350a80..84009e3 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -39,6 +39,8 @@ jobs: run: | export AWS_ACCESS_KEY_ID=$SCW_SECRET_KEY export AWS_SECRET_ACCESS_KEY=$SCW_ACCESS_KEY + echo $AWS_SECRET_ACCESS_KEY + echo $AWS_ACCESS_KEY_ID terraform init # Terraform "s3" backend, which is used by the infrastructure to store the state remotely, is primarily integrated with AWS, and not with Scaleway. # This imply to have AWS credentials environments variable containing Scaleway credentials. From d93697842e6abb793e070853a002712aa9dfe1b9 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Thu, 11 Jun 2026 16:47:18 +0200 Subject: [PATCH 21/21] test --- .github/workflows/scaleway-auth-check.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/scaleway-auth-check.yml b/.github/workflows/scaleway-auth-check.yml index 84009e3..95a55d1 100644 --- a/.github/workflows/scaleway-auth-check.yml +++ b/.github/workflows/scaleway-auth-check.yml @@ -37,11 +37,7 @@ jobs: - name: init working-directory: cluster/scaleway run: | - export AWS_ACCESS_KEY_ID=$SCW_SECRET_KEY - export AWS_SECRET_ACCESS_KEY=$SCW_ACCESS_KEY - echo $AWS_SECRET_ACCESS_KEY - echo $AWS_ACCESS_KEY_ID - terraform init + AWS_ACCESS_KEY_ID=$SCW_SECRET_KEY AWS_SECRET_ACCESS_KEY=$SCW_ACCESS_KEY terraform init # Terraform "s3" backend, which is used by the infrastructure to store the state remotely, is primarily integrated with AWS, and not with Scaleway. # This imply to have AWS credentials environments variable containing Scaleway credentials. # See documentation here : https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/guides/backend_guide#alternative-store-terraform-state-in-scaleway-object-storage-with-locking