Skip to content

Commit 6ff59c5

Browse files
pgavlinpgavlin
committed
Use ESC secrets
1 parent a9d0279 commit 6ff59c5

File tree

4 files changed

+73
-38
lines changed

4 files changed

+73
-38
lines changed

‎.github/workflows/ci.yml

+43-23
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
permissions: write-all # Equivalent to default permissions plus id-token: write
12
on:
23
pull_request:
34
paths-ignore:
@@ -24,14 +25,18 @@ on:
2425

2526
env:
2627
PULUMI_API: https://api.pulumi-staging.io
27-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
2828
AWS_REGION: us-west-2
2929
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3030
GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: [email protected]
3131
GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
3232
GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
3333
GOOGLE_PROJECT_NUMBER: 895284651812
3434
GOLANGCI_LINT_VERSION: v1.64.4
35+
ESC_ACTION_OIDC_AUTH: true
36+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
37+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
38+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
39+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: PULUMI_ACCESS_TOKEN
3540

3641
jobs:
3742

@@ -41,6 +46,9 @@ jobs:
4146
outputs:
4247
gotcloudcreds: ${{ steps.gotcloudcreds.outputs.gotcloudcreds }}
4348
steps:
49+
- name: Fetch secrets from ESC
50+
id: esc-secrets
51+
uses: pulumi/esc-action@v1
4452
- uses: actions/checkout@v3
4553
with:
4654
submodules: recursive
@@ -93,7 +101,7 @@ jobs:
93101
uses: codecov/codecov-action@v5
94102
with:
95103
directory: sdk/java/pulumi/build/reports/jacoco/allTests
96-
token: ${{ secrets.CODECOV_TOKEN }}
104+
token: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
97105
- run: make build_go
98106
- run: make bin/pulumi-java-gen
99107
- run: make bin/pulumi-language-java
@@ -133,6 +141,9 @@ jobs:
133141
strategy:
134142
fail-fast: false
135143
steps:
144+
- name: Fetch secrets from ESC
145+
id: esc-secrets
146+
uses: pulumi/esc-action@v1
136147
- uses: actions/checkout@v3
137148
with:
138149
submodules: recursive
@@ -219,6 +230,9 @@ jobs:
219230
contents: read
220231
id-token: write
221232
steps:
233+
- name: Fetch secrets from ESC
234+
id: esc-secrets
235+
uses: pulumi/esc-action@v1
222236
- uses: actions/checkout@v3
223237
with:
224238
submodules: recursive
@@ -274,33 +288,33 @@ jobs:
274288
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
275289
role-duration-seconds: 3600
276290
role-session-name: ${{ env.PROVIDER }}@githubActions
277-
role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
291+
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
278292
- name: Authenticate to Google Cloud
279293
uses: google-github-actions/auth@v2
280294
with:
281-
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
282-
}}/locations/global/workloadIdentityPools/${{
283-
env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
284-
env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
295+
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
285296
service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
286297
- name: Setup gcloud auth
287298
uses: google-github-actions/setup-gcloud@v2
288299
with:
289300
install_components: gke-gcloud-auth-plugin
290301
- name: Run ${{ matrix.example }} example
291302
env:
292-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
293-
ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
294-
ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
295-
ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
296-
ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
303+
PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
304+
ARM_CLIENT_ID: ${{ steps.esc-secrets.outputs.ARM_CLIENT_ID }}
305+
ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
306+
ARM_SUBSCRIPTION_ID: ${{ steps.esc-secrets.outputs.ARM_SUBSCRIPTION_ID }}
307+
ARM_TENANT_ID: ${{ steps.esc-secrets.outputs.ARM_TENANT_ID }}
297308
run: make test_example.${{ matrix.example }}
298309

299310
go-lint:
300311
runs-on: ubuntu-latest
301312
timeout-minutes: 10
302313
name: Lint pkg
303314
steps:
315+
- name: Fetch secrets from ESC
316+
id: esc-secrets
317+
uses: pulumi/esc-action@v1
304318
- name: Checkout Repo
305319
uses: actions/checkout@v3
306320
with:
@@ -338,6 +352,9 @@ jobs:
338352
- provider-maven
339353
- provider-gradle
340354
steps:
355+
- name: Fetch secrets from ESC
356+
id: esc-secrets
357+
uses: pulumi/esc-action@v1
341358
- uses: actions/checkout@v3
342359
with:
343360
submodules: recursive
@@ -386,7 +403,7 @@ jobs:
386403
path: ~/.m2/repository/com/pulumi
387404
- name: Run ${{ matrix.integration }} integration
388405
env:
389-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
406+
PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
390407
run: make test_integration.${{ matrix.integration }}
391408

392409
test_templates:
@@ -398,6 +415,9 @@ jobs:
398415
contents: read
399416
id-token: write
400417
steps:
418+
- name: Fetch secrets from ESC
419+
id: esc-secrets
420+
uses: pulumi/esc-action@v1
401421
- uses: actions/checkout@v3
402422
with:
403423
submodules: recursive
@@ -449,25 +469,22 @@ jobs:
449469
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
450470
role-duration-seconds: 3600
451471
role-session-name: ${{ env.PROVIDER }}@githubActions
452-
role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
472+
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
453473
- name: Authenticate to Google Cloud
454474
uses: google-github-actions/auth@v2
455475
with:
456-
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
457-
}}/locations/global/workloadIdentityPools/${{
458-
env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
459-
env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
476+
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
460477
service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
461478
- name: Setup gcloud auth
462479
uses: google-github-actions/setup-gcloud@v2
463480
with:
464481
install_components: gke-gcloud-auth-plugin
465482
- env:
466-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
467-
ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
468-
ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
469-
ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
470-
ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
483+
PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
484+
ARM_CLIENT_ID: ${{ steps.esc-secrets.outputs.ARM_CLIENT_ID }}
485+
ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
486+
ARM_SUBSCRIPTION_ID: ${{ steps.esc-secrets.outputs.ARM_SUBSCRIPTION_ID }}
487+
ARM_TENANT_ID: ${{ steps.esc-secrets.outputs.ARM_TENANT_ID }}
471488
run: make test_templates
472489

473490
ci-ok:
@@ -476,6 +493,9 @@ jobs:
476493
if: always()
477494
runs-on: ubuntu-latest
478495
steps:
496+
- name: Fetch secrets from ESC
497+
id: esc-secrets
498+
uses: pulumi/esc-action@v1
479499
- name: CI failed
480500
if: ${{ needs.go-tests.result != 'success' || needs.examples.result != 'success' || needs.go-lint.result != 'success' || needs.test_integrations.result != 'success' || needs.test_templates.result != 'success' }}
481501
run: exit 1

‎.github/workflows/command-dispatch.yml

+11-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
permissions: write-all # Equivalent to default permissions plus id-token: write
2+
env:
3+
ESC_ACTION_OIDC_AUTH: true
4+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
5+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
6+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
7+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false
18
name: Command Dispatch for PR events
29
on:
310
issue_comment:
@@ -9,11 +16,14 @@ jobs:
916
command-dispatch-for-testing:
1017
runs-on: ubuntu-latest
1118
steps:
19+
- name: Fetch secrets from ESC
20+
id: esc-secrets
21+
uses: pulumi/esc-action@v1
1222
- uses: actions/checkout@v3
1323
- name: Run Build
1424
uses: peter-evans/slash-command-dispatch@v4
1525
with:
16-
token: ${{ secrets.PULUMI_BOT_TOKEN }}
26+
token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
1727
reaction-token: ${{ secrets.GITHUB_TOKEN }}
1828
commands: run-acceptance-tests
1929
event-type-suffix: -command

‎.github/workflows/release-java-provider.yml

+9-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
permissions: write-all # Equivalent to default permissions plus id-token: write
12
on:
23
push:
34
tags:
@@ -8,12 +9,19 @@ on:
89
- "README.md"
910

1011
env:
11-
GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
12+
ESC_ACTION_OIDC_AUTH: true
13+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
14+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
15+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
16+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: GITHUB_TOKEN=PULUMI_BOT_TOKEN
1217

1318
jobs:
1419
release-pulumi-language-java:
1520
runs-on: ubuntu-latest
1621
steps:
22+
- name: Fetch secrets from ESC
23+
id: esc-secrets
24+
uses: pulumi/esc-action@v1
1725
- uses: actions/checkout@v3
1826
- name: Fetch Tags
1927
run: |

‎.github/workflows/release-java-sdk-to-maven-central.yml

+10-13
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
permissions: write-all # Equivalent to default permissions plus id-token: write
12
# A successful run of this action creates a staging repo at
23
# s01.oss.sonatype.org. Further manual steps are needed to complete
34
# publishing to Maven Central, see:
@@ -15,24 +16,20 @@ env:
1516
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1617

1718
OSSRH_REPO_URL: https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/
18-
OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
19-
OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
20-
21-
# Include only last 8 hex digits of the key ID included, due to
22-
# limitations of gradle.
23-
SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }}
24-
25-
# Obtained by `gpg --armor --export-secret-key [email protected]`.
26-
SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
27-
28-
# Aka passphrase for the GPG key.
29-
SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
19+
ESC_ACTION_OIDC_AUTH: true
20+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
21+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
22+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
23+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: OSSRH_USERNAME,OSSRH_PASSWORD,SIGNING_KEY_ID,SIGNING_KEY,SIGNING_PASSWORD
3024

3125
jobs:
3226
publish:
3327
runs-on: ubuntu-latest
3428
timeout-minutes: 10
3529
steps:
30+
- name: Fetch secrets from ESC
31+
id: esc-secrets
32+
uses: pulumi/esc-action@v1
3633
- uses: actions/checkout@v3
3734
with:
3835
submodules: recursive
@@ -59,4 +56,4 @@ jobs:
5956
uses: gradle/gradle-build-action@749f47bda3e44aa060e82d7b3ef7e40d953bd629
6057
with:
6158
arguments: pulumi:publishToSonatype closeAndReleaseSonatypeStagingRepository
62-
build-root-directory: sdk/java
59+
build-root-directory: sdk/java

0 commit comments

Comments
 (0)