Skip to content

Commit 58cc14f

Browse files
pgavlinpgavlin
committed
Use ESC secrets
1 parent a9d0279 commit 58cc14f

File tree

4 files changed

+73
-38
lines changed

4 files changed

+73
-38
lines changed

‎.github/workflows/ci.yml

Lines changed: 43 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,18 @@ on:
2424

2525
env:
2626
PULUMI_API: https://api.pulumi-staging.io
27-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
2827
AWS_REGION: us-west-2
2928
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3029
GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: [email protected]
3130
GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
3231
GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
3332
GOOGLE_PROJECT_NUMBER: 895284651812
3433
GOLANGCI_LINT_VERSION: v1.64.4
34+
ESC_ACTION_OIDC_AUTH: true
35+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
36+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
37+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
38+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: PULUMI_ACCESS_TOKEN=PULUMI_ACCESS_TOKEN
3539

3640
jobs:
3741

@@ -41,6 +45,9 @@ jobs:
4145
outputs:
4246
gotcloudcreds: ${{ steps.gotcloudcreds.outputs.gotcloudcreds }}
4347
steps:
48+
- name: Fetch secrets from ESC
49+
id: esc-secrets
50+
uses: pulumi/esc-action@v1
4451
- uses: actions/checkout@v3
4552
with:
4653
submodules: recursive
@@ -93,7 +100,7 @@ jobs:
93100
uses: codecov/codecov-action@v5
94101
with:
95102
directory: sdk/java/pulumi/build/reports/jacoco/allTests
96-
token: ${{ secrets.CODECOV_TOKEN }}
103+
token: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
97104
- run: make build_go
98105
- run: make bin/pulumi-java-gen
99106
- run: make bin/pulumi-language-java
@@ -133,6 +140,9 @@ jobs:
133140
strategy:
134141
fail-fast: false
135142
steps:
143+
- name: Fetch secrets from ESC
144+
id: esc-secrets
145+
uses: pulumi/esc-action@v1
136146
- uses: actions/checkout@v3
137147
with:
138148
submodules: recursive
@@ -219,6 +229,9 @@ jobs:
219229
contents: read
220230
id-token: write
221231
steps:
232+
- name: Fetch secrets from ESC
233+
id: esc-secrets
234+
uses: pulumi/esc-action@v1
222235
- uses: actions/checkout@v3
223236
with:
224237
submodules: recursive
@@ -274,33 +287,33 @@ jobs:
274287
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
275288
role-duration-seconds: 3600
276289
role-session-name: ${{ env.PROVIDER }}@githubActions
277-
role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
290+
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
278291
- name: Authenticate to Google Cloud
279292
uses: google-github-actions/auth@v2
280293
with:
281-
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
282-
}}/locations/global/workloadIdentityPools/${{
283-
env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
284-
env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
294+
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
285295
service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
286296
- name: Setup gcloud auth
287297
uses: google-github-actions/setup-gcloud@v2
288298
with:
289299
install_components: gke-gcloud-auth-plugin
290300
- name: Run ${{ matrix.example }} example
291301
env:
292-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
293-
ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
294-
ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
295-
ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
296-
ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
302+
PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
303+
ARM_CLIENT_ID: ${{ steps.esc-secrets.outputs.ARM_CLIENT_ID }}
304+
ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
305+
ARM_SUBSCRIPTION_ID: ${{ steps.esc-secrets.outputs.ARM_SUBSCRIPTION_ID }}
306+
ARM_TENANT_ID: ${{ steps.esc-secrets.outputs.ARM_TENANT_ID }}
297307
run: make test_example.${{ matrix.example }}
298308

299309
go-lint:
300310
runs-on: ubuntu-latest
301311
timeout-minutes: 10
302312
name: Lint pkg
303313
steps:
314+
- name: Fetch secrets from ESC
315+
id: esc-secrets
316+
uses: pulumi/esc-action@v1
304317
- name: Checkout Repo
305318
uses: actions/checkout@v3
306319
with:
@@ -338,6 +351,9 @@ jobs:
338351
- provider-maven
339352
- provider-gradle
340353
steps:
354+
- name: Fetch secrets from ESC
355+
id: esc-secrets
356+
uses: pulumi/esc-action@v1
341357
- uses: actions/checkout@v3
342358
with:
343359
submodules: recursive
@@ -386,7 +402,7 @@ jobs:
386402
path: ~/.m2/repository/com/pulumi
387403
- name: Run ${{ matrix.integration }} integration
388404
env:
389-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
405+
PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
390406
run: make test_integration.${{ matrix.integration }}
391407

392408
test_templates:
@@ -398,6 +414,9 @@ jobs:
398414
contents: read
399415
id-token: write
400416
steps:
417+
- name: Fetch secrets from ESC
418+
id: esc-secrets
419+
uses: pulumi/esc-action@v1
401420
- uses: actions/checkout@v3
402421
with:
403422
submodules: recursive
@@ -449,25 +468,22 @@ jobs:
449468
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
450469
role-duration-seconds: 3600
451470
role-session-name: ${{ env.PROVIDER }}@githubActions
452-
role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
471+
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
453472
- name: Authenticate to Google Cloud
454473
uses: google-github-actions/auth@v2
455474
with:
456-
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
457-
}}/locations/global/workloadIdentityPools/${{
458-
env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
459-
env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
475+
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
460476
service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
461477
- name: Setup gcloud auth
462478
uses: google-github-actions/setup-gcloud@v2
463479
with:
464480
install_components: gke-gcloud-auth-plugin
465481
- env:
466-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
467-
ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
468-
ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
469-
ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
470-
ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
482+
PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
483+
ARM_CLIENT_ID: ${{ steps.esc-secrets.outputs.ARM_CLIENT_ID }}
484+
ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
485+
ARM_SUBSCRIPTION_ID: ${{ steps.esc-secrets.outputs.ARM_SUBSCRIPTION_ID }}
486+
ARM_TENANT_ID: ${{ steps.esc-secrets.outputs.ARM_TENANT_ID }}
471487
run: make test_templates
472488

473489
ci-ok:
@@ -476,8 +492,12 @@ jobs:
476492
if: always()
477493
runs-on: ubuntu-latest
478494
steps:
495+
- name: Fetch secrets from ESC
496+
id: esc-secrets
497+
uses: pulumi/esc-action@v1
479498
- name: CI failed
480499
if: ${{ needs.go-tests.result != 'success' || needs.examples.result != 'success' || needs.go-lint.result != 'success' || needs.test_integrations.result != 'success' || needs.test_templates.result != 'success' }}
481500
run: exit 1
482501
- name: CI succeeded
483502
run: exit 0
503+
permissions: write-all # Equivalent to default permissions plus id-token: write

‎.github/workflows/command-dispatch.yml

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,24 @@ jobs:
99
command-dispatch-for-testing:
1010
runs-on: ubuntu-latest
1111
steps:
12+
- name: Fetch secrets from ESC
13+
id: esc-secrets
14+
uses: pulumi/esc-action@v1
1215
- uses: actions/checkout@v3
1316
- name: Run Build
1417
uses: peter-evans/slash-command-dispatch@v4
1518
with:
16-
token: ${{ secrets.PULUMI_BOT_TOKEN }}
19+
token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
1720
reaction-token: ${{ secrets.GITHUB_TOKEN }}
1821
commands: run-acceptance-tests
1922
event-type-suffix: -command
2023
permission: write
2124
issue-type: pull-request
2225
repository: pulumi/pulumi-java
26+
env:
27+
ESC_ACTION_OIDC_AUTH: true
28+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
29+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
30+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
31+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false
32+
permissions: write-all # Equivalent to default permissions plus id-token: write

‎.github/workflows/release-java-provider.yml

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,19 @@ on:
88
- "README.md"
99

1010
env:
11-
GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
11+
ESC_ACTION_OIDC_AUTH: true
12+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
13+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
14+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
15+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: GITHUB_TOKEN=PULUMI_BOT_TOKEN
1216

1317
jobs:
1418
release-pulumi-language-java:
1519
runs-on: ubuntu-latest
1620
steps:
21+
- name: Fetch secrets from ESC
22+
id: esc-secrets
23+
uses: pulumi/esc-action@v1
1724
- uses: actions/checkout@v3
1825
- name: Fetch Tags
1926
run: |
@@ -40,3 +47,4 @@ jobs:
4047
with:
4148
version: latest
4249
args: -p 3 -f .goreleaser.yml --clean --release-notes=CHANGELOG_PENDING.md
50+
permissions: write-all # Equivalent to default permissions plus id-token: write

‎.github/workflows/release-java-sdk-to-maven-central.yml

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,24 +15,20 @@ env:
1515
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1616

1717
OSSRH_REPO_URL: https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/
18-
OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
19-
OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
20-
21-
# Include only last 8 hex digits of the key ID included, due to
22-
# limitations of gradle.
23-
SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }}
24-
25-
# Obtained by `gpg --armor --export-secret-key [email protected]`.
26-
SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
27-
28-
# Aka passphrase for the GPG key.
29-
SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
18+
ESC_ACTION_OIDC_AUTH: true
19+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
20+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
21+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
22+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: SIGNING_KEY_ID=SIGNING_KEY_ID,SIGNING_KEY=SIGNING_KEY,SIGNING_PASSWORD=SIGNING_PASSWORD,OSSRH_USERNAME=OSSRH_USERNAME,OSSRH_PASSWORD=OSSRH_PASSWORD
3023

3124
jobs:
3225
publish:
3326
runs-on: ubuntu-latest
3427
timeout-minutes: 10
3528
steps:
29+
- name: Fetch secrets from ESC
30+
id: esc-secrets
31+
uses: pulumi/esc-action@v1
3632
- uses: actions/checkout@v3
3733
with:
3834
submodules: recursive
@@ -59,4 +55,5 @@ jobs:
5955
uses: gradle/gradle-build-action@749f47bda3e44aa060e82d7b3ef7e40d953bd629
6056
with:
6157
arguments: pulumi:publishToSonatype closeAndReleaseSonatypeStagingRepository
62-
build-root-directory: sdk/java
58+
build-root-directory: sdk/java
59+
permissions: write-all # Equivalent to default permissions plus id-token: write

0 commit comments

Comments
 (0)