angaza / summon-buildkite-plugin Goto Github PK

Note that this plugin does not play nice when used with other plugins that expect secrets to be available immediately, e.g. upon the environment step.

For example, if this plugin is used along with https://github.com/buildkite-plugins/ecr-buildkite-plugin, the ECR plugin will complain that it doesn't get the AWS values it needs.

I'm not sure of an 'easy' solution, since secrets.yml is coming in from the git repository. Fundamentally, the issue is 'there are tasks that need to run in Buildkite and require secrets before the repo is cloned', which is where this solution will not be applicable.

One way might be to store the secrets.yml file in S3, and then we could run the plugin in the environment step. Thats counter to how we typically use the secrets.yml file though (storing it alongside the repository).

Not something to urgently solve/change, but noting here as it does mean that I'm going to be storing the AWS key info for Buildkite ECR access on the pipeline, as the summon plugin cannot be (its only a power user of ECR; no other access).