From 1f46b16fefccb54e3ccb8d22d9448d8d3ad4df96 Mon Sep 17 00:00:00 2001
From: Micheal Looney <micheal.looney@intercom.io>
Date: Tue, 10 Nov 2026 13:34:59 +0000
Subject: [PATCH] Read Socket Firewall credentials from the shared CI context

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .circleci/config.yml | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 9ad5d45..fb3854b 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -10,19 +10,20 @@ jobs:
           name: Route Bundler through the Socket Firewall registry
           command: |
             set -euo pipefail
-            if [ -z "${SOCKET_GEM_URL:-}" ]; then
+            if [ -z "${SOCKET_FIREWALL_TOKEN:-}" ]; then
               # CircleCI does not share context credentials with forked PRs, so a
               # fork cannot be routed. Say so rather than failing the contributor.
               if [ -n "${CIRCLE_PR_REPONAME:-}" ]; then
                 echo "Forked PR: no Socket Firewall credentials available, gems will come from rubygems.org."
                 exit 0
               fi
-              echo "FATAL: SOCKET_GEM_URL is required (provided by the socket-firewall context)"
+              echo "FATAL: SOCKET_FIREWALL_TOKEN is required (provided by the muster-dev-secrets context)"
               exit 1
             fi
             # Legacy two-argument form: these images ship Bundler 1.x, where
             # `bundle config set --global` does not exist and silently no-ops.
-            bundle config mirror.https://rubygems.org "$SOCKET_GEM_URL"
+            bundle config mirror.https://rubygems.org https://socket-firewall-registry.corporate.intercom.io/rubygems
+            bundle config socket-firewall-registry.corporate.intercom.io "intercom-socket:${SOCKET_FIREWALL_TOKEN}"
             bundle config mirror.https://rubygems.org | grep -q socket-firewall-registry \
               || { echo "FAIL: bundler mirror not pointing at Socket Firewall"; exit 1; }
       - run: bundle install
@@ -37,15 +38,16 @@ jobs:
           name: Route Bundler through the Socket Firewall registry
           command: |
             set -euo pipefail
-            if [ -z "${SOCKET_GEM_URL:-}" ]; then
+            if [ -z "${SOCKET_FIREWALL_TOKEN:-}" ]; then
               if [ -n "${CIRCLE_PR_REPONAME:-}" ]; then
                 echo "Forked PR: no Socket Firewall credentials available, gems will come from rubygems.org."
                 exit 0
               fi
-              echo "FATAL: SOCKET_GEM_URL is required (provided by the socket-firewall context)"
+              echo "FATAL: SOCKET_FIREWALL_TOKEN is required (provided by the muster-dev-secrets context)"
               exit 1
             fi
-            bundle config mirror.https://rubygems.org "$SOCKET_GEM_URL"
+            bundle config mirror.https://rubygems.org https://socket-firewall-registry.corporate.intercom.io/rubygems
+            bundle config socket-firewall-registry.corporate.intercom.io "intercom-socket:${SOCKET_FIREWALL_TOKEN}"
             bundle config mirror.https://rubygems.org | grep -q socket-firewall-registry \
               || { echo "FAIL: bundler mirror not pointing at Socket Firewall"; exit 1; }
       - run: bundle install
@@ -60,15 +62,16 @@ jobs:
           name: Route Bundler through the Socket Firewall registry
           command: |
             set -euo pipefail
-            if [ -z "${SOCKET_GEM_URL:-}" ]; then
+            if [ -z "${SOCKET_FIREWALL_TOKEN:-}" ]; then
               if [ -n "${CIRCLE_PR_REPONAME:-}" ]; then
                 echo "Forked PR: no Socket Firewall credentials available, gems will come from rubygems.org."
                 exit 0
               fi
-              echo "FATAL: SOCKET_GEM_URL is required (provided by the socket-firewall context)"
+              echo "FATAL: SOCKET_FIREWALL_TOKEN is required (provided by the muster-dev-secrets context)"
               exit 1
             fi
-            bundle config mirror.https://rubygems.org "$SOCKET_GEM_URL"
+            bundle config mirror.https://rubygems.org https://socket-firewall-registry.corporate.intercom.io/rubygems
+            bundle config socket-firewall-registry.corporate.intercom.io "intercom-socket:${SOCKET_FIREWALL_TOKEN}"
             bundle config mirror.https://rubygems.org | grep -q socket-firewall-registry \
               || { echo "FAIL: bundler mirror not pointing at Socket Firewall"; exit 1; }
       - run: bundle install
@@ -80,12 +83,12 @@ workflows:
       - test-ruby-2-4:
           name: "Test against Ruby 2.4"
           context:
-            - socket-firewall
+            - muster-dev-secrets
       - test-ruby-2-5:
           name: "Test against Ruby 2.5"
           context:
-            - socket-firewall
+            - muster-dev-secrets
       - test-ruby-2-6:
           name: "Test against Ruby 2.6"
           context:
-            - socket-firewall
+            - muster-dev-secrets