From a39c79579f9340f626509ea2e0f7dd4ab13219b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Paul=20Gro=C3=9Fmann?= Date: Mon, 6 Jul 2026 18:30:06 +0200 Subject: [PATCH 1/4] fix: ci cleanup of PubSub topic --- scripts/delete-pubsub-resources.sh | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/scripts/delete-pubsub-resources.sh b/scripts/delete-pubsub-resources.sh index 73272bc..7605fe6 100755 --- a/scripts/delete-pubsub-resources.sh +++ b/scripts/delete-pubsub-resources.sh @@ -10,14 +10,18 @@ if [ -z "$TOPIC_ID" ]; then exit 0 fi -echo "Cleaning up Subscription: $SUBSCRIPTION_ID" -curl -s --request DELETE \ - --url "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions/${SUBSCRIPTION_ID}" \ - --header "Authorization: Bearer ${STACKIT_SERVICE_ACCOUNT_TOKEN}" +# We use force=true query parameter on the topic deletion to perform a cascading delete of the topic +# and all of its active subscriptions. +echo "Cleaning up Topic: $TOPIC_ID with force=true" +DELETE_RESPONSE=$(curl -sk -w "\n%{http_code}" -X DELETE \ + --url "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}?force=true" \ + --header "Authorization: Bearer ${STACKIT_SERVICE_ACCOUNT_TOKEN}") -echo "Cleaning up Topic: $TOPIC_ID" -curl -s --request DELETE \ - --url "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}" \ - --header "Authorization: Bearer ${STACKIT_SERVICE_ACCOUNT_TOKEN}" +HTTP_STATUS=$(echo "$DELETE_RESPONSE" | tail -n 1) +DELETE_BODY=$(echo "$DELETE_RESPONSE" | sed '$d') -echo "Cleanup complete." \ No newline at end of file +if [ "$HTTP_STATUS" -ne 202 ]; then + echo "::warning file=scripts/delete-pubsub-resources.sh::Failed to delete topic $TOPIC_ID (HTTP $HTTP_STATUS) - Response: $DELETE_BODY" +else + echo "Successfully deleted topic $TOPIC_ID (HTTP $HTTP_STATUS)" +fi From a37824bff6ee43197da44de47387acccd54a685a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Paul=20Gro=C3=9Fmann?= Date: Mon, 6 Jul 2026 18:37:26 +0200 Subject: [PATCH 2/4] fix: corrected base url in delete-pubsub-resources.sh --- scripts/delete-pubsub-resources.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/delete-pubsub-resources.sh b/scripts/delete-pubsub-resources.sh index 7605fe6..1858058 100755 --- a/scripts/delete-pubsub-resources.sh +++ b/scripts/delete-pubsub-resources.sh @@ -1,7 +1,7 @@ #!/bin/bash # Configuration -BASE_URL="https://pubsub.api.eu01.qa/v1alpha" +BASE_URL="https://pubsub.api.qa.stackit.cloud/v1alpha" PROJECT_ID="0ec85b07-ecb2-4253-9ba8-25ae06db1b7a" REGION="eu01" From 14c052380c503f41ab91f91a5396bf58c4e389d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Paul=20Gro=C3=9Fmann?= Date: Tue, 7 Jul 2026 12:51:58 +0200 Subject: [PATCH 3/4] refactor: getting of token and use of stackit curl so that the topic is being cleaned up correctly --- .github/workflows/ci.yml | 14 +++----------- scripts/create-pubsub-resources.sh | 25 ++++++------------------- scripts/delete-pubsub-resources.sh | 5 ++--- 3 files changed, 11 insertions(+), 33 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3c9509d..c0c3de6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -59,17 +59,14 @@ jobs: with: go-version-file: 'go.mod' - - name: Load Key from GitHub Secrets - run: | - echo '${{ secrets.STACKIT_SERVICE_ACCOUNT_KEY }}' > $RUNNER_TEMP/service_account_key.json - - name: Set up Stackit CLI run: | echo "Stackit CLI Installation" sudo snap install stackit --classic - name: Import QA Profile and Login - if: always() + env: + STACKIT_SERVICE_ACCOUNT_KEY: ${{ secrets.STACKIT_SERVICE_ACCOUNT_KEY }} run: | echo '${{ secrets.STACKIT_QA_ENV_JSON }}' > $RUNNER_TEMP/qa-env.json @@ -85,13 +82,10 @@ jobs: echo "pubsub-qa should been removed. Creating..." stackit config profile import -c "@$RUNNER_TEMP/qa-env.json" --name pubsub-qa stackit config profile set pubsub-qa - stackit auth activate-service-account --service-account-key-path "$RUNNER_TEMP/service_account_key.json" + stackit auth activate-service-account # key is being read out from the env STACKIT_SERVICE_ACCOUNT_KEY - name: Create PubSub Topic and Subscription run: ./scripts/create-pubsub-resources.sh - env: - REPO_ROOT: ${{ github.workspace }} - SA_KEY_PATH: ${{ runner.temp }}/service_account_key.json - name: Run Unit Tests run: make test ENABLE_TEST_COVERAGE=true @@ -101,12 +95,10 @@ jobs: ENVIRONMENT: ${{ env.ENVIRONMENT }} TOKEN_CUSTOM_URI: ${{ env.TOKEN_CUSTOM_URI }} SERVICE_ACCOUNT_TOKEN: ${{ secrets.STACKIT_SERVICE_ACCOUNT_KEY }} - TOKEN: ${{ secrets.TOKEN }} - name: Cleanup - Delete STACKIT Resources if: always() run: | - cp $RUNNER_TEMP/service_account_key.json key.json ./scripts/delete-pubsub-resources.sh - name: Delete QA Profile diff --git a/scripts/create-pubsub-resources.sh b/scripts/create-pubsub-resources.sh index 282533c..98a613b 100755 --- a/scripts/create-pubsub-resources.sh +++ b/scripts/create-pubsub-resources.sh @@ -6,19 +6,9 @@ REGION="eu01" BASE_URL="https://pubsub.api.qa.stackit.cloud/v1alpha" PUBLISHER_MAIL="pubsub-dataplane-sdk-44cqm3i8@sa.stackit.cloud" -echo "Fetching fresh access token..." -TOKEN=$(stackit auth activate-service-account --only-print-access-token --service-account-key-path "$SA_KEY_PATH" | tr -d '\r\n ') -echo "SERVICE_ACCOUNT_TOKEN=$TOKEN" >> $GITHUB_ENV - -if [ -z "$TOKEN" ] || [ ${#TOKEN} -lt 20 ]; then - echo "Error: Retrieved token is empty or too short." - exit 1 -fi - #TOPIC echo "Creating Topic via curl (Targeting: $REGION)..." -TOPICRESPONSE=$(curl -sk -w "\n%{http_code}" -X POST "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics" \ - -H "Authorization: Bearer $TOKEN" \ +TOPICRESPONSE=$(stackit curl -sk -w "\n%{http_code}" -X POST "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics" \ -H "Content-Type: application/json" \ -d "{\"displayName\": \"ci-topic-$(date +%s)\"}") @@ -38,7 +28,7 @@ echo "TOPIC_ID=$TOPIC_ID" >> $GITHUB_ENV echo "Waiting for topic to become active..." for i in {1..50}; do - STATUS=$(curl -sk -H "Authorization: Bearer $TOKEN" "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}" | jq -r '.state') + STATUS=$(stackit curl -sk "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}" | jq -r '.state') echo "Current topic status: $STATUS" if [ "$STATUS" == "active" ]; then break @@ -52,8 +42,7 @@ done #SUBSCRIPTION echo "Creating Subscription via curl (Targeting: $REGION)..." -SUBRESPONSE=$(curl -sk -w "\n%{http_code}" -X POST "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions" \ - -H "Authorization: Bearer $TOKEN" \ +SUBRESPONSE=$(stackit curl -sk -w "\n%{http_code}" -X POST "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions" \ -H "Content-Type: application/json" \ -d "{\"displayName\": \"ci-topic-$(date +%s)\"}") @@ -73,7 +62,7 @@ echo "SUBSCRIPTION_ID=$SUBSCRIPTION_ID" >> $GITHUB_ENV echo "Waiting for subscription to become active..." for i in {1..50}; do - STATUS=$(curl -sk -H "Authorization: Bearer $TOKEN" "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions/${SUBSCRIPTION_ID}" | jq -r '.state') + STATUS=$(stackit curl -sk "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions/${SUBSCRIPTION_ID}" | jq -r '.state') echo "Current subscription status: $STATUS" if [ "$STATUS" == "active" ]; then break @@ -88,8 +77,7 @@ done #ACCESS echo "Granting Publisher Access via curl (Targeting: $REGION)..." -GPARESPONSE=$(curl -sk -w "\n%{http_code}" -X PUT "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/publishers/$PUBLISHER_MAIL" \ - -H "Authorization: Bearer $TOKEN" \ +GPARESPONSE=$(stackit curl -sk -w "\n%{http_code}" -X PUT "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/publishers/$PUBLISHER_MAIL" \ -H "Content-Type: application/json" \ -d "{\"displayName\": \"ci-topic-$(date +%s)\"}") @@ -102,8 +90,7 @@ fi echo "Response SUBSCRIPTION Body: $GPARESPONSE" echo "Granting Subscriber Access via curl (Targeting: $REGION)..." -GSARESPONSE=$(curl -sk -w "\n%{http_code}" -X PUT "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions/$SUBSCRIPTION_ID/subscribers/$PUBLISHER_MAIL" \ - -H "Authorization: Bearer $TOKEN" \ +GSARESPONSE=$(stackit curl -sk -w "\n%{http_code}" -X PUT "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions/$SUBSCRIPTION_ID/subscribers/$PUBLISHER_MAIL" \ -H "Content-Type: application/json" \ -d "{\"displayName\": \"ci-topic-$(date +%s)\"}") diff --git a/scripts/delete-pubsub-resources.sh b/scripts/delete-pubsub-resources.sh index 1858058..55213ab 100755 --- a/scripts/delete-pubsub-resources.sh +++ b/scripts/delete-pubsub-resources.sh @@ -13,9 +13,8 @@ fi # We use force=true query parameter on the topic deletion to perform a cascading delete of the topic # and all of its active subscriptions. echo "Cleaning up Topic: $TOPIC_ID with force=true" -DELETE_RESPONSE=$(curl -sk -w "\n%{http_code}" -X DELETE \ - --url "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}?force=true" \ - --header "Authorization: Bearer ${STACKIT_SERVICE_ACCOUNT_TOKEN}") +DELETE_RESPONSE=$(stackit curl -sk -w "\n%{http_code}" -X DELETE \ + --url "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}?force=true") HTTP_STATUS=$(echo "$DELETE_RESPONSE" | tail -n 1) DELETE_BODY=$(echo "$DELETE_RESPONSE" | sed '$d') From e5ad460e01256bcb178112f15044e788bda8739b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Paul=20Gro=C3=9Fmann?= Date: Tue, 7 Jul 2026 13:04:22 +0200 Subject: [PATCH 4/4] refactor: back to curl with but now with stackit auth get-access-token --- scripts/create-pubsub-resources.sh | 19 +++++++++++++------ scripts/delete-pubsub-resources.sh | 6 +++++- 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/scripts/create-pubsub-resources.sh b/scripts/create-pubsub-resources.sh index d390d5a..727e3fe 100755 --- a/scripts/create-pubsub-resources.sh +++ b/scripts/create-pubsub-resources.sh @@ -6,9 +6,13 @@ REGION="eu01" BASE_URL="https://pubsub.api.qa.stackit.cloud/v1alpha" PUBLISHER_MAIL="pubsub-dataplane-sdk-44cqm3i8@sa.stackit.cloud" +# Get token from stackit cli +TOKEN=$(stackit auth get-access-token) + #TOPIC echo "Creating Topic via curl (Targeting: $REGION)..." -TOPICRESPONSE=$(stackit curl -sk -w "\n%{http_code}" -X POST "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics" \ +TOPICRESPONSE=$(curl -sk -w "\n%{http_code}" -X POST "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics" \ + -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d "{\"displayName\": \"ci-topic-$(date +%s)\"}") @@ -27,7 +31,7 @@ echo "TOPIC_ID=$TOPIC_ID" >> $GITHUB_ENV echo "Waiting for topic to become active..." for i in {1..50}; do - STATUS=$(stackit curl -sk "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}" | jq -r '.state') + STATUS=$(curl -sk -H "Authorization: Bearer ${TOKEN}" "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}" | jq -r '.state') echo "Current topic status: $STATUS" if [ "$STATUS" == "active" ]; then break @@ -41,7 +45,8 @@ done #SUBSCRIPTION echo "Creating Subscription via curl (Targeting: $REGION)..." -SUBRESPONSE=$(stackit curl -sk -w "\n%{http_code}" -X POST "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions" \ +SUBRESPONSE=$(curl -sk -w "\n%{http_code}" -X POST "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions" \ + -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d "{\"displayName\": \"ci-topic-$(date +%s)\"}") @@ -60,7 +65,7 @@ echo "SUBSCRIPTION_ID=$SUBSCRIPTION_ID" >> $GITHUB_ENV echo "Waiting for subscription to become active..." for i in {1..50}; do - STATUS=$(stackit curl -sk "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions/${SUBSCRIPTION_ID}" | jq -r '.state') + STATUS=$(curl -sk -H "Authorization: Bearer ${TOKEN}" "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions/${SUBSCRIPTION_ID}" | jq -r '.state') echo "Current subscription status: $STATUS" if [ "$STATUS" == "active" ]; then break @@ -75,7 +80,8 @@ done #ACCESS echo "Granting Publisher Access via curl (Targeting: $REGION)..." -PUBLISHER_RESPONSE=$(stackit curl -sk -w "\n%{http_code}" -X PATCH "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/publishers" \ +PUBLISHER_RESPONSE=$(curl -sk -w "\n%{http_code}" -X PATCH "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/publishers" \ + -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d "{\"emailAddress\": \"$PUBLISHER_MAIL\"}") @@ -88,7 +94,8 @@ if [ "$HTTP_STATUS" -ne 202 ]; then fi echo "Granting Subscriber Access via curl (Targeting: $REGION)..." -SUBSCRIBER_RESPONSE=$(stackit curl -sk -w "\n%{http_code}" -X PATCH "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions/${SUBSCRIPTION_ID}/subscribers" \ +SUBSCRIBER_RESPONSE=$(curl -sk -w "\n%{http_code}" -X PATCH "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions/${SUBSCRIPTION_ID}/subscribers" \ + -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d "{\"emailAddress\": \"$PUBLISHER_MAIL\"}") diff --git a/scripts/delete-pubsub-resources.sh b/scripts/delete-pubsub-resources.sh index 55213ab..d965cfa 100755 --- a/scripts/delete-pubsub-resources.sh +++ b/scripts/delete-pubsub-resources.sh @@ -10,10 +10,14 @@ if [ -z "$TOPIC_ID" ]; then exit 0 fi +# Get token from stackit cli +TOKEN=$(stackit auth get-access-token) + # We use force=true query parameter on the topic deletion to perform a cascading delete of the topic # and all of its active subscriptions. echo "Cleaning up Topic: $TOPIC_ID with force=true" -DELETE_RESPONSE=$(stackit curl -sk -w "\n%{http_code}" -X DELETE \ +DELETE_RESPONSE=$(curl -sk -w "\n%{http_code}" -X DELETE \ + -H "Authorization: Bearer ${TOKEN}" \ --url "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}?force=true") HTTP_STATUS=$(echo "$DELETE_RESPONSE" | tail -n 1)