Environment ASK_REFRESH_TOKEN ignored
DrPsychick opened this issue · comments
I'm submitting a...
[ ] Regression (a behavior that used to work and stopped working in a new release)
[x] Bug report
[ ] Performance issue
[ ] Feature request
[ ] Documentation issue or request
[ ] Other... Please describe:
Expected Behavior
I expect that, ASK_REFRESH_TOKEN
, ASK_ACCESS_TOKEN
, ASK_VENDOR_ID
environment variables, if defined, take precedence over the values in the cli_config
file.
Current Behavior
- without
cli_config
it simply crashes - with a
cli_config
with invalidaccess_token
andrefresh_token
it correctly displays "Token is invalid/expired." - even when setting the correct environment variables,
ask
still uses the values from thecli_config
file
ASK_DEFAULT_PROFILE=default
ASK_ACCESS_TOKEN="Atza|IwEBIDef..."
ASK_REFRESH_TOKEN="Atzr|IwEBICM..."
ASK_VENDOR_ID="M2C.."
Steps to Reproduce (for bugs)
# set valid credentials via ENV
export ASK_DEFAULT_PROFILE=default
export ASK_ACCESS_TOKEN="Atza|IwEBIDef..."
export ASK_REFRESH_TOKEN="Atzr|IwEBICM..."
export ASK_VENDOR_ID="M2C.."
# edit your `cli_config` and edit `access_token` and `refresh_token` to become invalid
ask dialog --debug --replay mySkill.replay
[...]
Request headers: {"authorization":"Atza|IwEBIPE..." ...
# notice that the token used in the request is NOT the one provided via ENV
Possible Solution
Check why ENV is not working
- if ENV is given and there is no
cli_config
file, it should be created - if ENV is given, it should always take precedence
Your Environment and Context
- ask-cli version: 2.24.1
- Operating System and version: macOS Big Sur (arm64)
- Node.js version used for development: v16.8.0
- NPM version used for development: 7.21.0
I'm having the exact same problem, trying to setup a CI to deploy my skills using GitHub Actions.
This is my current workflow:
name: Alexa
on:
workflow_dispatch:
jobs:
alexa-deploy:
runs-on: [ubuntu-latest]
defaults:
run:
working-directory: alexa-skill
env:
ASK_DEFAULT_PROFILE: "my-skill"
ASK_ACCESS_TOKEN: ${{ secrets.ASK_ACCESS_TOKEN }}
ASK_REFRESH_TOKEN: ${{ secrets.ASK_REFRESH_TOKEN }}
ASK_VENDOR_ID: ${{ secrets.ASK_VENDOR_ID }}
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v2
with:
node-version: "14"
cache: "npm"
cache-dependency-path: alexa-skill
- run: npm install -g ask-cli
- run: ask deploy --profile my-skill
And I'm getting the following:
Run ask deploy --profile walabothome-app-cloud
ask deploy --profile walabothome-app-cloud
shell: /usr/bin/bash -e {0}
env:
ASK_DEFAULT_PROFILE: my-skill
ASK_ACCESS_TOKEN: ***
ASK_REFRESH_TOKEN: ***
ASK_VENDOR_ID: ***
AWS_ACCESS_KEY_ID: ***
AWS_SECRET_ACCESS_KEY: ***
Error: : ENOENT: no such file or directory, op
en '/home/runner/.ask/cli_config'
Error: Process completed with exit code 1.
Attached the raw log as well - alexa-raw-log.txt
Any chance to help with that? Without that working I cannot setup a proper CI flow.
I'm having the same issue. Why is this still broken?
You can use environment variables when using the __ENVIRONMENT_ASK_PROFILE__
. I don't believe the ask-cli supports using environment variables without explicitly using this profile.
You can add this profile in your ask-resources.json
file like so:
# ask-resources.json
"profiles": {
"__ENVIRONMENT_ASK_PROFILE__": {
"skillMetadata": {
"src": "./skill-package"
},
"code": {
"default": {
"src": "./lambda"
}
},
"skillInfrastructure": {
"userConfig": {
"runtime": "nodejs12.x",
"handler": "index.handler",
"awsRegion": "us-east-1"
},
"type": "@ask-cli/lambda-deployer"
}
}
}
For deploying in GitHub actions you can just run:
ask deploy
or equivalently ask deploy --profile __ENVIRONMENT_ASK_PROFILE__
.
It's likely the current errors you're receiving is because you are either specifying a profile or the CLI is using the default profile which does not support environment variables. Thus it will attempt to load you config from~/.ask/cli_config
and you'll run into the file not existing or other related errors.
@DrPsychick Using the environment profile should fix the errors you're encountering with the ask dialog
command.
You can use environment variables when using the
__ENVIRONMENT_ASK_PROFILE__
. I don't believe the ask-cli supports using environment variables without explicitly using this profile.
It should be supported according to the docs - see here. It specifically states for all environment variables that
When this environment variable exists, ASK CLI uses it instead of the credentials in the configuration file.
And this seems to be broken.
My use case include two different profiles for a single skill (one for a production environment, second for development environment), so using __ENVIRONMENT_ASK_PROFILE__
is not possible.
So, I've tried using the --profile __ENVIRONMENT_ASK_PROFILE__
, but that still requires a cli_config
...
Then I renamed the default
profile in the cli_config
to __ENVIRONMENT_ASK_PROFILE__
and tried to pass ASK_REFRESH_TOKEN
etc. via ENV - it did not work, it was still using the token from the cli_config
.
So the provided solution above by @CamdenFoucht did not work for me as expected.
His PR #430 seems to be a proper solution to use environment variables - I hope we can see it approved and merged soon.
When using __ENVIRONMENT_ASK_PROFILE__
did you specify all of:
- AWS_ACCESS_KEY_ID
- AWS_SECRET_ACCESS_KEY
- ASK_VENDOR_ID
- ASK_REFRESH_TOKEN or ASK_ACCESS_TOKEN
It won't work unless all are specified I believe. I have tested this on the current CLI version and it works for me. https://github.com/alexa/ask-cli/blob/develop/docs/concepts/CI-CD.md
You're right @CamdenFoucht , when specifying all of them it works and takes the values from the ENV. But still requires the cli_config
, so your PR is highly appreciated!
@DrPsychick Hmm. I'm currently doing it without the cli_config, so it should be possible without it!
Again - you're right 😉 Thanks for your help with this!
@CamdenFoucht is there a way to support my case? Since I'm using the same code to deploy to two different skills (dev & prod), I can't use the __ENVIRONMENT_ASK_PROFILE__
env var.
Hey @galah92
Maybe we could write the config files within the github action itself without needing to use ask config. Then we could use multiple profiles for CI/CD. I added a few steps to your github workflow doing this.
name: Alexa
on:
workflow_dispatch:
jobs:
alexa-deploy:
runs-on: [ubuntu-latest]
env:
ASK_DEFAULT_PROFILE: "my-skill"
ASK_ACCESS_TOKEN: ${{ secrets.ASK_ACCESS_TOKEN }}
ASK_REFRESH_TOKEN: ${{ secrets.ASK_REFRESH_TOKEN }}
ASK_VENDOR_ID: ${{ secrets.ASK_VENDOR_ID }}
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v2
with:
node-version: "14"
- run: |
mkdir ~/.ask
touch ~/.ask/cli_config
jq -n --arg ask_default_profile "$ASK_DEFAULT_PROFILE" --arg ask_access_token "$ASK_ACCESS_TOKEN" --arg ask_refresh_token "$ASK_REFRESH_TOKEN" --arg ask_vendor_id "$ASK_VENDOR_ID" '{"profiles": { "my-skill": {"token": {"access_token": "\($ask_access_token)", "refresh_token": "\($ask_refresh_token)", "token_type": "bearer", "expires_in": 3600, "expires_at": "2020-03-29T05:03:21.994Z"}, "vendor_id": "\($ask_vendor_id)", "aws_profile": "default"}}}' > ~/.ask/cli_config
cat ~/.ask/cli_config
- run: |
mkdir ~/.aws
touch ~/.aws/credentials
echo [default] > ~/.aws/credentials
echo aws_access_key_id="$AWS_ACCESS_KEY_ID" >> ~/.aws/credentials
echo aws_secret_access_key="$AWS_SECRET_ACCESS_KEY" >> ~/.aws/credentials
cat ~/.aws/credentials
- run: npm install -g ask-cli
- run: ask deploy --profile my-skill
Here is some of the outputs from the above steps:
the ~/.ask/cli_config file created
the ~/.aws/credentials file created
Now that the config is created, we can deploy the skill like you want specifying any profile that we configured in the action / that also exists in the ask-resources.json
file. You can see in the image that it does a SMAPI skill package deployment and is able to create roles/deploy the lambdas.
Hope this helps!
I will close this issue since @DrPsychick original issue was solved. @galah92 If you would like to request using a non __ENVIRONMENT_ASK_PROFILE__
profiles in a CI environment please make a feature request and we can get that addressed!