Skip to content

Stop passing the unused integration test secret - #488

Open
oysand wants to merge 1 commit into
equinor:mainfrom
oysand:stop-passing-unused-integration-test-secret
Open

Stop passing the unused integration test secret#488
oysand wants to merge 1 commit into
equinor:mainfrom
oysand:stop-passing-unused-integration-test-secret

Conversation

@oysand

@oysand oysand commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Why

INTEGRATION_TEST_AZURE_CLIENT_SECRET existed so the armada integration tests could read the MQTT credentials from FlotillaTestsKv. As of equinor/armada#100 those credentials are generated per test run and nothing is read from the key vault, so passing this secret does nothing.

Removing it here is what lets armada drop the declaration — GitHub rejects a caller passing a secret the reusable workflow does not declare, so the callers have to go first — and lets the secret and its service principal be retired.

No behaviour change: the workflow already ignores it.

Depends on

equinor/armada#100 should merge first, so the workflow has stopped reading it.

Ready for review checklist:

  • A self-review has been performed
  • All commits run individually
  • Temporary changes have been removed, like logging, TODO, etc.
  • The PR has been tested locally
  • This change doesn't need a new test
  • Relevant issues are linked
  • There is no remaining work from this PR that requires new issues
  • The changes do not introduce dead code as unused imports, functions etc.

Merge order

This is one of five PRs that remove the need for any external secret to run the armada
integration tests. They must merge in this order:

  1. Let the broker take its credentials at runtime flotilla#2908 — broker takes its credentials at runtime
    Make the MQTT CA certificate configurable isar#1166 — MQTT CA certificate configurable
    then wait for the :dev images to publish
  2. Generate MQTT credentials per test run armada#100 — generate MQTT credentials per test run
  3. Stop passing the unused integration test secret flotilla#2918, Stop passing the unused integration test secret isar-robot#402, Stop passing the unused integration test secret #488 — stop passing the unused secret
  4. armada follow-up — drop the now-unused secret declaration, retire the key vault

Out of order it breaks: armada's reusable workflow currently declares
INTEGRATION_TEST_AZURE_CLIENT_SECRET as required: true and every caller uses @main, so a
caller that stops passing it before step 2 fails immediately. Conversely step 2 needs the new
broker and the configurable ISAR CA already published, because it feeds the broker its
credentials through the environment.

@oysand
oysand force-pushed the stop-passing-unused-integration-test-secret branch from 15fc0b7 to 8efa0f4 Compare August 25, 2026 10:30
@oysand
oysand force-pushed the stop-passing-unused-integration-test-secret branch from 02d24b9 to d3bf417 Compare August 27, 2026 12:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants