We are using github actions and cumulusci as part of our ci/cd pipeline. In each of our repositories (packages in SF context), we have a .github/workflows folder and inside it are our yaml files that trigger automatically based on events. One such event, for example, is whenever a new pull request is opened. When a PR is opened, part of the workflow is creating a scratch org and deploying the new changes to that scratch org to ensure that everything works properly before those changes can actually be merged into our develop branch. We use a connected app in our DevHub to authenticate the scratch orgs. This is done automatically by running
sfdx auth:jwt:grant --clientid 04580y4051234051
--jwtkeyfile /Users/jdoe/JWT/server.key --username email@example.com
--setdefaultdevhubusername --setalias my-hub-org
The clientid is the consumer key that is generated when you create a connected app and the jwtkeyfile is a private key.
However, we also have another workflow specifically for our packaging orgs. The purpose of this is to automate our releases. Are we able to use our DevHub org to authenticate packaging orgs, similarly to what we're doing to scratch orgs? Or, does the connected app have to live in our packaging org instead?