diff --git a/.buildkite/hooks/pre-exit b/.buildkite/hooks/pre-exit index 0f784b64dee2..d9eb37828ea5 100755 --- a/.buildkite/hooks/pre-exit +++ b/.buildkite/hooks/pre-exit @@ -2,10 +2,23 @@ set -euo pipefail -if [[ "$BUILDKITE_PIPELINE_SLUG" == "docs-build-pr" ]] && [[ "$BUILDKITE_STEP_KEY" == "build-pr" ]]; then +# Do not call GitHub from this hook. build-pr can run longer than the +# ephemeral VAULT_GITHUB_TOKEN TTL. Upload a short follow-up step instead +# so the environment hook mints a fresh token for the status POST. +if [[ "${BUILDKITE_PIPELINE_SLUG:-}" == "docs-build-pr" ]] && [[ "${BUILDKITE_STEP_KEY:-}" == "build-pr" ]]; then status_state=failure if [[ "${BUILDKITE_COMMAND_EXIT_STATUS:-1}" -eq 0 ]]; then status_state=success fi - "${BUILDKITE_BUILD_CHECKOUT_PATH}/.buildkite/scripts/build_pr_commit_status.sh" "$status_state" || true + + echo "Uploading GitHub status step (${status_state})" + + # Checkout is required so build_pr_commit_status.sh is on disk. The job + # is short; the environment hook mints a fresh VAULT_GITHUB_TOKEN. + cat <