Environment ASK_REFRESH_TOKEN ignored

Question

Environment ASK_REFRESH_TOKEN ignored

DrPsychick opened this issue 3 years ago · comments

I'm submitting a...


[ ] Regression (a behavior that used to work and stopped working in a new release)
[x] Bug report  
[ ] Performance issue
[ ] Feature request
[ ] Documentation issue or request 
[ ] Other... Please describe:

Expected Behavior

I expect that, ASK_REFRESH_TOKEN, ASK_ACCESS_TOKEN, ASK_VENDOR_ID environment variables, if defined, take precedence over the values in the cli_config file.

Current Behavior

without cli_config it simply crashes
with a cli_config with invalid access_token and refresh_token it correctly displays "Token is invalid/expired."
even when setting the correct environment variables, ask still uses the values from the cli_config file

ASK_DEFAULT_PROFILE=default
ASK_ACCESS_TOKEN="Atza|IwEBIDef..."
ASK_REFRESH_TOKEN="Atzr|IwEBICM..."
ASK_VENDOR_ID="M2C.."

Steps to Reproduce (for bugs)

# set valid credentials via ENV
export ASK_DEFAULT_PROFILE=default
export ASK_ACCESS_TOKEN="Atza|IwEBIDef..."
export ASK_REFRESH_TOKEN="Atzr|IwEBICM..."
export ASK_VENDOR_ID="M2C.."
# edit your `cli_config` and edit `access_token` and `refresh_token` to become invalid

ask dialog --debug --replay mySkill.replay
[...]
Request headers: {"authorization":"Atza|IwEBIPE..." ...
# notice that the token used in the request is NOT the one provided via ENV

Possible Solution

Check why ENV is not working

if ENV is given and there is no cli_config file, it should be created
if ENV is given, it should always take precedence

Your Environment and Context

ask-cli version: 2.24.1
Operating System and version: macOS Big Sur (arm64)
Node.js version used for development: v16.8.0
NPM version used for development: 7.21.0

Gal Aharoni · Answer 1 · Sat Jan 29 2022 23:21:26 GMT+0800 (China Standard Time)

I'm having the exact same problem, trying to setup a CI to deploy my skills using GitHub Actions.
This is my current workflow:

name: Alexa

on:
  workflow_dispatch:

jobs:
  alexa-deploy:
    runs-on: [ubuntu-latest]
    defaults:
      run:
        working-directory: alexa-skill
    env:
      ASK_DEFAULT_PROFILE: "my-skill"
      ASK_ACCESS_TOKEN: ${{ secrets.ASK_ACCESS_TOKEN }}
      ASK_REFRESH_TOKEN: ${{ secrets.ASK_REFRESH_TOKEN }}
      ASK_VENDOR_ID: ${{ secrets.ASK_VENDOR_ID }}
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-node@v2
        with:
          node-version: "14"
          cache: "npm"
          cache-dependency-path: alexa-skill
      - run: npm install -g ask-cli
      - run: ask deploy --profile my-skill

And I'm getting the following:

Run ask deploy --profile walabothome-app-cloud
  ask deploy --profile walabothome-app-cloud
  shell: /usr/bin/bash -e {0}
  env:
    ASK_DEFAULT_PROFILE: my-skill
    ASK_ACCESS_TOKEN: ***
    ASK_REFRESH_TOKEN: ***
    ASK_VENDOR_ID: ***
    AWS_ACCESS_KEY_ID: ***
    AWS_SECRET_ACCESS_KEY: ***
Error: : ENOENT: no such file or directory, op
en '/home/runner/.ask/cli_config'
Error: Process completed with exit code 1.

Attached the raw log as well - alexa-raw-log.txt

Any chance to help with that? Without that working I cannot setup a proper CI flow.

jrglg · Answer 2 · Tue Feb 15 2022 02:29:36 GMT+0800 (China Standard Time)

I'm having the same issue. Why is this still broken?

Camden Foucht · Answer 3 · Fri Mar 18 2022 03:08:19 GMT+0800 (China Standard Time)

@galah92

You can use environment variables when using the __ENVIRONMENT_ASK_PROFILE__. I don't believe the ask-cli supports using environment variables without explicitly using this profile.

You can add this profile in your ask-resources.json file like so:

  # ask-resources.json
  "profiles": {
    "__ENVIRONMENT_ASK_PROFILE__": {
      "skillMetadata": {
        "src": "./skill-package"
      },
      "code": {
        "default": {
          "src": "./lambda"
        }
      },
      "skillInfrastructure": {
        "userConfig": {
          "runtime": "nodejs12.x",
          "handler": "index.handler",
          "awsRegion": "us-east-1"
        },
        "type": "@ask-cli/lambda-deployer"
      }
    }
  }

For deploying in GitHub actions you can just run:

ask deploy or equivalently ask deploy --profile __ENVIRONMENT_ASK_PROFILE__.

It's likely the current errors you're receiving is because you are either specifying a profile or the CLI is using the default profile which does not support environment variables. Thus it will attempt to load you config from~/.ask/cli_config and you'll run into the file not existing or other related errors.

@DrPsychick Using the environment profile should fix the errors you're encountering with the ask dialog command.

Gal Aharoni · Answer 4 · Sun Mar 20 2022 00:17:55 GMT+0800 (China Standard Time)

You can use environment variables when using the __ENVIRONMENT_ASK_PROFILE__. I don't believe the ask-cli supports using environment variables without explicitly using this profile.

It should be supported according to the docs - see here. It specifically states for all environment variables that

When this environment variable exists, ASK CLI uses it instead of the credentials in the configuration file.

And this seems to be broken.

My use case include two different profiles for a single skill (one for a production environment, second for development environment), so using __ENVIRONMENT_ASK_PROFILE__ is not possible.

DrPsychick · Answer 5 · Sun Mar 20 2022 03:54:00 GMT+0800 (China Standard Time)

So, I've tried using the --profile __ENVIRONMENT_ASK_PROFILE__, but that still requires a cli_config...

Then I renamed the default profile in the cli_config to __ENVIRONMENT_ASK_PROFILE__ and tried to pass ASK_REFRESH_TOKEN etc. via ENV - it did not work, it was still using the token from the cli_config.

So the provided solution above by @CamdenFoucht did not work for me as expected.
His PR #430 seems to be a proper solution to use environment variables - I hope we can see it approved and merged soon.

Camden Foucht · Answer 6 · Sun Mar 20 2022 04:03:04 GMT+0800 (China Standard Time)

@DrPsychick

When using __ENVIRONMENT_ASK_PROFILE__ did you specify all of:

AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY
ASK_VENDOR_ID
ASK_REFRESH_TOKEN or ASK_ACCESS_TOKEN

It won't work unless all are specified I believe. I have tested this on the current CLI version and it works for me. https://github.com/alexa/ask-cli/blob/develop/docs/concepts/CI-CD.md

DrPsychick · Answer 7 · Sun Mar 20 2022 04:06:58 GMT+0800 (China Standard Time)

You're right @CamdenFoucht , when specifying all of them it works and takes the values from the ENV. But still requires the cli_config, so your PR is highly appreciated!

Camden Foucht · Answer 8 · Sun Mar 20 2022 04:10:26 GMT+0800 (China Standard Time)

@DrPsychick Hmm. I'm currently doing it without the cli_config, so it should be possible without it!

DrPsychick · Answer 9 · Sun Mar 20 2022 04:18:02 GMT+0800 (China Standard Time)

Again - you're right 😉 Thanks for your help with this!

Gal Aharoni · Answer 10 · Tue Mar 29 2022 09:55:42 GMT+0800 (China Standard Time)

@CamdenFoucht is there a way to support my case? Since I'm using the same code to deploy to two different skills (dev & prod), I can't use the __ENVIRONMENT_ASK_PROFILE__ env var.

Camden Foucht · Answer 11 · Tue Mar 29 2022 14:32:44 GMT+0800 (China Standard Time)

Hey @galah92

Maybe we could write the config files within the github action itself without needing to use ask config. Then we could use multiple profiles for CI/CD. I added a few steps to your github workflow doing this.

name: Alexa

on:
  workflow_dispatch:

jobs:
  alexa-deploy:
    runs-on: [ubuntu-latest]
    env:
      ASK_DEFAULT_PROFILE: "my-skill"
      ASK_ACCESS_TOKEN: ${{ secrets.ASK_ACCESS_TOKEN }}
      ASK_REFRESH_TOKEN: ${{ secrets.ASK_REFRESH_TOKEN }}
      ASK_VENDOR_ID: ${{ secrets.ASK_VENDOR_ID }}
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-node@v2
        with:
          node-version: "14"
      - run: |
            mkdir ~/.ask
            touch ~/.ask/cli_config
            jq -n --arg ask_default_profile "$ASK_DEFAULT_PROFILE" --arg ask_access_token "$ASK_ACCESS_TOKEN"  --arg ask_refresh_token "$ASK_REFRESH_TOKEN" --arg ask_vendor_id "$ASK_VENDOR_ID" '{"profiles": { "my-skill": {"token": {"access_token": "\($ask_access_token)", "refresh_token": "\($ask_refresh_token)", "token_type": "bearer", "expires_in": 3600, "expires_at": "2020-03-29T05:03:21.994Z"}, "vendor_id": "\($ask_vendor_id)", "aws_profile": "default"}}}' > ~/.ask/cli_config
            cat ~/.ask/cli_config
      - run: |
            mkdir ~/.aws
            touch ~/.aws/credentials
            echo [default] > ~/.aws/credentials
            echo aws_access_key_id="$AWS_ACCESS_KEY_ID" >> ~/.aws/credentials
            echo aws_secret_access_key="$AWS_SECRET_ACCESS_KEY" >> ~/.aws/credentials
            cat ~/.aws/credentials
      - run: npm install -g ask-cli
      - run: ask deploy --profile my-skill

Here is some of the outputs from the above steps:

the ~/.ask/cli_config file created

the ~/.aws/credentials file created

Now that the config is created, we can deploy the skill like you want specifying any profile that we configured in the action / that also exists in the ask-resources.json file. You can see in the image that it does a SMAPI skill package deployment and is able to create roles/deploy the lambdas.

Hope this helps!

Camden Foucht · Answer 12 · Fri Apr 29 2022 05:04:46 GMT+0800 (China Standard Time)

I will close this issue since @DrPsychick original issue was solved. @galah92 If you would like to request using a non __ENVIRONMENT_ASK_PROFILE__ profiles in a CI environment please make a feature request and we can get that addressed!