[CI] Read the CRCR report token from a Buildkite secret (#54605)
Signed-off-by: Andrey Talman <atalman@fb.com>
Andrey Talman committed
Sep 1, 2026 at 16:29 UTC
16f16876fda8527189464613509188d873bf5e7f
1 file changed
+8
-1
.buildkite/scripts/crcr-report.sh
+8
-1
@@ -37,9 +37,16 @@ fi
37
38
# read_builds only. Needed because a job cannot see its siblings' outcomes:
39
# the agent exposes only its own step, so the job list comes from the REST API.
40
+TOKEN_SECRET_KEY="${CRCR_BUILDKITE_TOKEN_SECRET_KEY:-CRCR_BUILDKITE_API_TOKEN}"
41
BK_TOKEN="${BUILDKITE_API_TOKEN:-}"
42
+if [[ -z "${BK_TOKEN}" ]] && command -v buildkite-agent >/dev/null 2>&1; then
43
+ # Not in the job environment, so read it from a Buildkite secret. The agent
44
+ # redacts values fetched this way from the log.
45
+ BK_TOKEN="$(buildkite-agent secret get "${TOKEN_SECRET_KEY}" 2>/dev/null)" || BK_TOKEN=""
46
+fi
47
if [[ -z "${BK_TOKEN}" ]]; then
42
- echo "BUILDKITE_API_TOKEN unset -- skipping report"
48
+ echo "no Buildkite API token (env BUILDKITE_API_TOKEN or secret" \
49
+ "'${TOKEN_SECRET_KEY}') -- skipping report"
50
exit 0
51
fi
52