Skip to content

Commit e99b4f9

Browse files
pgavlinpgavlin
committed
Use ESC secrets
1 parent a9d0279 commit e99b4f9

File tree

4 files changed

+77
-38
lines changed

4 files changed

+77
-38
lines changed

‎.github/workflows/ci.yml

+44-23
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
permissions:
2+
id-token: write
13
on:
24
pull_request:
35
paths-ignore:
@@ -24,14 +26,18 @@ on:
2426

2527
env:
2628
PULUMI_API: https://api.pulumi-staging.io
27-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
2829
AWS_REGION: us-west-2
2930
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3031
GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: [email protected]
3132
GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
3233
GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
3334
GOOGLE_PROJECT_NUMBER: 895284651812
3435
GOLANGCI_LINT_VERSION: v1.64.4
36+
ESC_ACTION_OIDC_AUTH: true
37+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
38+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
39+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
40+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: PULUMI_ACCESS_TOKEN=PULUMI_ACCESS_TOKEN
3541

3642
jobs:
3743

@@ -41,6 +47,9 @@ jobs:
4147
outputs:
4248
gotcloudcreds: ${{ steps.gotcloudcreds.outputs.gotcloudcreds }}
4349
steps:
50+
- name: Fetch secrets from ESC
51+
id: esc-secrets
52+
uses: pulumi/esc-action@v1
4453
- uses: actions/checkout@v3
4554
with:
4655
submodules: recursive
@@ -93,7 +102,7 @@ jobs:
93102
uses: codecov/codecov-action@v5
94103
with:
95104
directory: sdk/java/pulumi/build/reports/jacoco/allTests
96-
token: ${{ secrets.CODECOV_TOKEN }}
105+
token: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
97106
- run: make build_go
98107
- run: make bin/pulumi-java-gen
99108
- run: make bin/pulumi-language-java
@@ -133,6 +142,9 @@ jobs:
133142
strategy:
134143
fail-fast: false
135144
steps:
145+
- name: Fetch secrets from ESC
146+
id: esc-secrets
147+
uses: pulumi/esc-action@v1
136148
- uses: actions/checkout@v3
137149
with:
138150
submodules: recursive
@@ -219,6 +231,9 @@ jobs:
219231
contents: read
220232
id-token: write
221233
steps:
234+
- name: Fetch secrets from ESC
235+
id: esc-secrets
236+
uses: pulumi/esc-action@v1
222237
- uses: actions/checkout@v3
223238
with:
224239
submodules: recursive
@@ -274,33 +289,33 @@ jobs:
274289
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
275290
role-duration-seconds: 3600
276291
role-session-name: ${{ env.PROVIDER }}@githubActions
277-
role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
292+
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
278293
- name: Authenticate to Google Cloud
279294
uses: google-github-actions/auth@v2
280295
with:
281-
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
282-
}}/locations/global/workloadIdentityPools/${{
283-
env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
284-
env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
296+
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
285297
service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
286298
- name: Setup gcloud auth
287299
uses: google-github-actions/setup-gcloud@v2
288300
with:
289301
install_components: gke-gcloud-auth-plugin
290302
- name: Run ${{ matrix.example }} example
291303
env:
292-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
293-
ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
294-
ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
295-
ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
296-
ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
304+
PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
305+
ARM_CLIENT_ID: ${{ steps.esc-secrets.outputs.ARM_CLIENT_ID }}
306+
ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
307+
ARM_SUBSCRIPTION_ID: ${{ steps.esc-secrets.outputs.ARM_SUBSCRIPTION_ID }}
308+
ARM_TENANT_ID: ${{ steps.esc-secrets.outputs.ARM_TENANT_ID }}
297309
run: make test_example.${{ matrix.example }}
298310

299311
go-lint:
300312
runs-on: ubuntu-latest
301313
timeout-minutes: 10
302314
name: Lint pkg
303315
steps:
316+
- name: Fetch secrets from ESC
317+
id: esc-secrets
318+
uses: pulumi/esc-action@v1
304319
- name: Checkout Repo
305320
uses: actions/checkout@v3
306321
with:
@@ -338,6 +353,9 @@ jobs:
338353
- provider-maven
339354
- provider-gradle
340355
steps:
356+
- name: Fetch secrets from ESC
357+
id: esc-secrets
358+
uses: pulumi/esc-action@v1
341359
- uses: actions/checkout@v3
342360
with:
343361
submodules: recursive
@@ -386,7 +404,7 @@ jobs:
386404
path: ~/.m2/repository/com/pulumi
387405
- name: Run ${{ matrix.integration }} integration
388406
env:
389-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
407+
PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
390408
run: make test_integration.${{ matrix.integration }}
391409

392410
test_templates:
@@ -398,6 +416,9 @@ jobs:
398416
contents: read
399417
id-token: write
400418
steps:
419+
- name: Fetch secrets from ESC
420+
id: esc-secrets
421+
uses: pulumi/esc-action@v1
401422
- uses: actions/checkout@v3
402423
with:
403424
submodules: recursive
@@ -449,25 +470,22 @@ jobs:
449470
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
450471
role-duration-seconds: 3600
451472
role-session-name: ${{ env.PROVIDER }}@githubActions
452-
role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
473+
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
453474
- name: Authenticate to Google Cloud
454475
uses: google-github-actions/auth@v2
455476
with:
456-
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
457-
}}/locations/global/workloadIdentityPools/${{
458-
env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
459-
env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
477+
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
460478
service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
461479
- name: Setup gcloud auth
462480
uses: google-github-actions/setup-gcloud@v2
463481
with:
464482
install_components: gke-gcloud-auth-plugin
465483
- env:
466-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
467-
ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
468-
ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
469-
ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
470-
ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
484+
PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
485+
ARM_CLIENT_ID: ${{ steps.esc-secrets.outputs.ARM_CLIENT_ID }}
486+
ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
487+
ARM_SUBSCRIPTION_ID: ${{ steps.esc-secrets.outputs.ARM_SUBSCRIPTION_ID }}
488+
ARM_TENANT_ID: ${{ steps.esc-secrets.outputs.ARM_TENANT_ID }}
471489
run: make test_templates
472490

473491
ci-ok:
@@ -476,6 +494,9 @@ jobs:
476494
if: always()
477495
runs-on: ubuntu-latest
478496
steps:
497+
- name: Fetch secrets from ESC
498+
id: esc-secrets
499+
uses: pulumi/esc-action@v1
479500
- name: CI failed
480501
if: ${{ needs.go-tests.result != 'success' || needs.examples.result != 'success' || needs.go-lint.result != 'success' || needs.test_integrations.result != 'success' || needs.test_templates.result != 'success' }}
481502
run: exit 1

‎.github/workflows/command-dispatch.yml

+12-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
permissions:
2+
id-token: write
13
name: Command Dispatch for PR events
24
on:
35
issue_comment:
@@ -9,14 +11,23 @@ jobs:
911
command-dispatch-for-testing:
1012
runs-on: ubuntu-latest
1113
steps:
14+
- name: Fetch secrets from ESC
15+
id: esc-secrets
16+
uses: pulumi/esc-action@v1
1217
- uses: actions/checkout@v3
1318
- name: Run Build
1419
uses: peter-evans/slash-command-dispatch@v4
1520
with:
16-
token: ${{ secrets.PULUMI_BOT_TOKEN }}
21+
token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
1722
reaction-token: ${{ secrets.GITHUB_TOKEN }}
1823
commands: run-acceptance-tests
1924
event-type-suffix: -command
2025
permission: write
2126
issue-type: pull-request
2227
repository: pulumi/pulumi-java
28+
env:
29+
ESC_ACTION_OIDC_AUTH: true
30+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
31+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
32+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
33+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false

‎.github/workflows/release-java-provider.yml

+10-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
permissions:
2+
id-token: write
13
on:
24
push:
35
tags:
@@ -8,12 +10,19 @@ on:
810
- "README.md"
911

1012
env:
11-
GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
13+
ESC_ACTION_OIDC_AUTH: true
14+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
15+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
16+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
17+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: GITHUB_TOKEN=PULUMI_BOT_TOKEN
1218

1319
jobs:
1420
release-pulumi-language-java:
1521
runs-on: ubuntu-latest
1622
steps:
23+
- name: Fetch secrets from ESC
24+
id: esc-secrets
25+
uses: pulumi/esc-action@v1
1726
- uses: actions/checkout@v3
1827
- name: Fetch Tags
1928
run: |

‎.github/workflows/release-java-sdk-to-maven-central.yml

+11-13
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
permissions:
2+
id-token: write
13
# A successful run of this action creates a staging repo at
24
# s01.oss.sonatype.org. Further manual steps are needed to complete
35
# publishing to Maven Central, see:
@@ -15,24 +17,20 @@ env:
1517
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1618

1719
OSSRH_REPO_URL: https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/
18-
OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
19-
OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
20-
21-
# Include only last 8 hex digits of the key ID included, due to
22-
# limitations of gradle.
23-
SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }}
24-
25-
# Obtained by `gpg --armor --export-secret-key [email protected]`.
26-
SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
27-
28-
# Aka passphrase for the GPG key.
29-
SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
20+
ESC_ACTION_OIDC_AUTH: true
21+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
22+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
23+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
24+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: OSSRH_USERNAME=OSSRH_USERNAME,OSSRH_PASSWORD=OSSRH_PASSWORD,SIGNING_KEY_ID=SIGNING_KEY_ID,SIGNING_KEY=SIGNING_KEY,SIGNING_PASSWORD=SIGNING_PASSWORD
3025

3126
jobs:
3227
publish:
3328
runs-on: ubuntu-latest
3429
timeout-minutes: 10
3530
steps:
31+
- name: Fetch secrets from ESC
32+
id: esc-secrets
33+
uses: pulumi/esc-action@v1
3634
- uses: actions/checkout@v3
3735
with:
3836
submodules: recursive
@@ -59,4 +57,4 @@ jobs:
5957
uses: gradle/gradle-build-action@749f47bda3e44aa060e82d7b3ef7e40d953bd629
6058
with:
6159
arguments: pulumi:publishToSonatype closeAndReleaseSonatypeStagingRepository
62-
build-root-directory: sdk/java
60+
build-root-directory: sdk/java

0 commit comments

Comments
 (0)