fix: ci cleanup of PubSub topic

.github/workflows/ci.yml

@@ -59,17 +59,14 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
-      - name: Load Key from GitHub Secrets
-        run: |
-          echo '${{ secrets.STACKIT_SERVICE_ACCOUNT_KEY }}' > $RUNNER_TEMP/service_account_key.json
-
       - name: Set up Stackit CLI
         run: |
           echo "Stackit CLI Installation"
           sudo snap install stackit --classic
 
       - name: Import QA Profile and Login
-        if: always()
+        env:
+          STACKIT_SERVICE_ACCOUNT_KEY: ${{ secrets.STACKIT_SERVICE_ACCOUNT_KEY }}
         run: |
           echo '${{ secrets.STACKIT_QA_ENV_JSON }}' > $RUNNER_TEMP/qa-env.json
 
@@ -85,13 +82,10 @@ jobs:
             echo "pubsub-qa should been removed. Creating..."
             stackit config profile import -c "@$RUNNER_TEMP/qa-env.json" --name pubsub-qa
             stackit config profile set pubsub-qa
-            stackit auth activate-service-account --service-account-key-path "$RUNNER_TEMP/service_account_key.json"
+            stackit auth activate-service-account # key is being read out from the env STACKIT_SERVICE_ACCOUNT_KEY
 
       - name: Create PubSub Topic and Subscription
         run: ./scripts/create-pubsub-resources.sh
-        env:
-          REPO_ROOT: ${{ github.workspace }}
-          SA_KEY_PATH: ${{ runner.temp }}/service_account_key.json
 
       - name: Run Unit Tests
         run: make test ENABLE_TEST_COVERAGE=true
@@ -101,12 +95,10 @@ jobs:
           ENVIRONMENT: ${{ env.ENVIRONMENT }}
           TOKEN_CUSTOM_URI: ${{ env.TOKEN_CUSTOM_URI }}
           SERVICE_ACCOUNT_TOKEN: ${{ secrets.STACKIT_SERVICE_ACCOUNT_KEY }}
-          TOKEN: ${{ secrets.TOKEN }}
 
       - name: Cleanup - Delete STACKIT Resources
         if: always()
         run: |
-          cp $RUNNER_TEMP/service_account_key.json key.json
           ./scripts/delete-pubsub-resources.sh
 
       - name: Delete QA Profile

scripts/create-pubsub-resources.sh

@@ -6,19 +6,13 @@ REGION="eu01"
 BASE_URL="https://pubsub.api.qa.stackit.cloud/v1alpha"
 PUBLISHER_MAIL="pubsub-dataplane-sdk-44cqm3i8@sa.stackit.cloud"
 
-echo "Fetching fresh access token..."
-TOKEN=$(stackit auth activate-service-account --only-print-access-token --service-account-key-path "$SA_KEY_PATH" | tr -d '\r\n ')
-echo "SERVICE_ACCOUNT_TOKEN=$TOKEN" >> $GITHUB_ENV
-
-if [ -z "$TOKEN" ] || [ ${#TOKEN} -lt 20 ]; then
-  echo "::error file=scripts/create-pubsub-resources.sh::Retrieved token is empty or too short."
-  exit 1
-fi
+# Get token from stackit cli
+TOKEN=$(stackit auth get-access-token)
 
 #TOPIC
 echo "Creating Topic via curl (Targeting: $REGION)..."
 TOPICRESPONSE=$(curl -sk -w "\n%{http_code}" -X POST "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics" \
-  -H "Authorization: Bearer $TOKEN" \
+  -H "Authorization: Bearer ${TOKEN}" \
   -H "Content-Type: application/json" \
   -d "{\"displayName\": \"ci-topic-$(date +%s)\"}")
 
@@ -37,7 +31,7 @@ echo "TOPIC_ID=$TOPIC_ID" >> $GITHUB_ENV
 
 echo "Waiting for topic to become active..."
 for i in {1..50}; do
-  STATUS=$(curl -sk -H "Authorization: Bearer $TOKEN" "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}" | jq -r '.state')
+  STATUS=$(curl -sk -H "Authorization: Bearer ${TOKEN}" "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}" | jq -r '.state')
   echo "Current topic status: $STATUS"
   if [ "$STATUS" == "active" ]; then
     break
@@ -52,7 +46,7 @@ done
 #SUBSCRIPTION
 echo "Creating Subscription via curl (Targeting: $REGION)..."
 SUBRESPONSE=$(curl -sk -w "\n%{http_code}" -X POST "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions" \
-  -H "Authorization: Bearer $TOKEN" \
+  -H "Authorization: Bearer ${TOKEN}" \
   -H "Content-Type: application/json" \
   -d "{\"displayName\": \"ci-topic-$(date +%s)\"}")
 
@@ -71,7 +65,7 @@ echo "SUBSCRIPTION_ID=$SUBSCRIPTION_ID" >> $GITHUB_ENV
 
 echo "Waiting for subscription to become active..."
 for i in {1..50}; do
-  STATUS=$(curl -sk -H "Authorization: Bearer $TOKEN" "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions/${SUBSCRIPTION_ID}" | jq -r '.state')
+  STATUS=$(curl -sk -H "Authorization: Bearer ${TOKEN}" "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions/${SUBSCRIPTION_ID}" | jq -r '.state')
   echo "Current subscription status: $STATUS"
   if [ "$STATUS" == "active" ]; then
     break
@@ -87,7 +81,7 @@ done
 #ACCESS
 echo "Granting Publisher Access via curl (Targeting: $REGION)..."
 PUBLISHER_RESPONSE=$(curl -sk -w "\n%{http_code}" -X PATCH "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/publishers" \
-  -H "Authorization: Bearer $TOKEN" \
+  -H "Authorization: Bearer ${TOKEN}" \
   -H "Content-Type: application/json" \
   -d "{\"emailAddress\": \"$PUBLISHER_MAIL\"}")
 
@@ -101,7 +95,7 @@ fi
 
 echo "Granting Subscriber Access via curl (Targeting: $REGION)..."
 SUBSCRIBER_RESPONSE=$(curl -sk -w "\n%{http_code}" -X PATCH "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions/${SUBSCRIPTION_ID}/subscribers" \
-  -H "Authorization: Bearer $TOKEN" \
+  -H "Authorization: Bearer ${TOKEN}" \
   -H "Content-Type: application/json" \
   -d "{\"emailAddress\": \"$PUBLISHER_MAIL\"}")
 

scripts/delete-pubsub-resources.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # Configuration
-BASE_URL="https://pubsub.api.eu01.qa/v1alpha"
+BASE_URL="https://pubsub.api.qa.stackit.cloud/v1alpha"
 PROJECT_ID="0ec85b07-ecb2-4253-9ba8-25ae06db1b7a"
 REGION="eu01"
 
@@ -10,14 +10,21 @@ if [ -z "$TOPIC_ID" ]; then
     exit 0
 fi
 
-echo "Cleaning up Subscription: $SUBSCRIPTION_ID"
-curl -s --request DELETE \
-  --url "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}/subscriptions/${SUBSCRIPTION_ID}" \
-  --header "Authorization: Bearer ${STACKIT_SERVICE_ACCOUNT_TOKEN}"
+# Get token from stackit cli
+TOKEN=$(stackit auth get-access-token)
 
-echo "Cleaning up Topic: $TOPIC_ID"
-curl -s --request DELETE \
-  --url "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}" \
-  --header "Authorization: Bearer ${STACKIT_SERVICE_ACCOUNT_TOKEN}"
+# We use force=true query parameter on the topic deletion to perform a cascading delete of the topic
+# and all of its active subscriptions.
+echo "Cleaning up Topic: $TOPIC_ID with force=true"
+DELETE_RESPONSE=$(curl -sk -w "\n%{http_code}" -X DELETE \
+  -H "Authorization: Bearer ${TOKEN}" \
+  --url "${BASE_URL}/projects/${PROJECT_ID}/regions/${REGION}/topics/${TOPIC_ID}?force=true")
 
-echo "Cleanup complete."
+HTTP_STATUS=$(echo "$DELETE_RESPONSE" | tail -n 1)
+DELETE_BODY=$(echo "$DELETE_RESPONSE" | sed '$d')
+
+if [ "$HTTP_STATUS" -ne 202 ]; then
+  echo "::warning file=scripts/delete-pubsub-resources.sh::Failed to delete topic $TOPIC_ID (HTTP $HTTP_STATUS) - Response: $DELETE_BODY"
+else
+  echo "Successfully deleted topic $TOPIC_ID (HTTP $HTTP_STATUS)"
+fi