Skip to content

Commit b16b2f7

Browse files
blampeblampe
authored
Use ESC for secrets (#914)
Refs pulumi/ci-mgmt#1481.
1 parent 0f7bdd8 commit b16b2f7

File tree

8 files changed

+210
-147
lines changed

8 files changed

+210
-147
lines changed

‎.ci-mgmt.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,5 @@ timeout: 0.0000001
99
envOverride:
1010
AWS_REGION: us-west-2
1111
PULUMI_API: https://api.pulumi-staging.io
12+
esc:
13+
enabled: true

‎.github/workflows/build.yml‎

Lines changed: 48 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -24,23 +24,8 @@ env:
2424
PYTHONVERSION: "3.11.8"
2525
DOTNETVERSION: "8.0.x"
2626
JAVAVERSION: "11"
27-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
2827
AWS_REGION: us-west-2
29-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
30-
AWS_UPLOAD_ROLE_ARN: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
31-
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
32-
JAVA_SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
33-
JAVA_SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
34-
JAVA_SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
35-
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
36-
NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
37-
OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
38-
OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
3928
PULUMI_API: https://api.pulumi-staging.io
40-
PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
41-
PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
42-
RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }}
43-
RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }}
4429

4530
jobs:
4631
prerequisites:
@@ -54,9 +39,14 @@ jobs:
5439
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
5540
with:
5641
lfs: true
57-
- id: esc-secrets
58-
name: Map environment to ESC outputs
59-
uses: ./.github/actions/esc-action
42+
- env:
43+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
44+
ESC_ACTION_OIDC_AUTH: "true"
45+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
46+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
47+
id: esc-secrets
48+
name: Fetch secrets from ESC
49+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
6050
- id: version
6151
name: Set Provider Version
6252
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
@@ -187,9 +177,14 @@ jobs:
187177
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
188178
with:
189179
lfs: true
190-
- id: esc-secrets
191-
name: Map environment to ESC outputs
192-
uses: ./.github/actions/esc-action
180+
- env:
181+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
182+
ESC_ACTION_OIDC_AUTH: "true"
183+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
184+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
185+
id: esc-secrets
186+
name: Fetch secrets from ESC
187+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
193188
- id: version
194189
name: Set Provider Version
195190
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
@@ -336,9 +331,14 @@ jobs:
336331
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
337332
with:
338333
lfs: true
339-
- id: esc-secrets
340-
name: Map environment to ESC outputs
341-
uses: ./.github/actions/esc-action
334+
- env:
335+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
336+
ESC_ACTION_OIDC_AUTH: "true"
337+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
338+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
339+
id: esc-secrets
340+
name: Fetch secrets from ESC
341+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
342342
- name: check if this commit needs release
343343
if: ${{ env.RELEASE_BOT_ENDPOINT != '' }}
344344
uses: pulumi/action-release-by-pr-label@main
@@ -375,9 +375,14 @@ jobs:
375375
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
376376
with:
377377
lfs: true
378-
- id: esc-secrets
379-
name: Map environment to ESC outputs
380-
uses: ./.github/actions/esc-action
378+
- env:
379+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
380+
ESC_ACTION_OIDC_AUTH: "true"
381+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
382+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
383+
id: esc-secrets
384+
name: Fetch secrets from ESC
385+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
381386
- id: version
382387
name: Set Provider Version
383388
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
@@ -500,9 +505,14 @@ jobs:
500505
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
501506
with:
502507
lfs: true
503-
- id: esc-secrets
504-
name: Map environment to ESC outputs
505-
uses: ./.github/actions/esc-action
508+
- env:
509+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
510+
ESC_ACTION_OIDC_AUTH: "true"
511+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
512+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
513+
id: esc-secrets
514+
name: Fetch secrets from ESC
515+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
506516
- id: version
507517
name: Set Provider Version
508518
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
@@ -576,9 +586,14 @@ jobs:
576586
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
577587
with:
578588
lfs: true
579-
- id: esc-secrets
580-
name: Map environment to ESC outputs
581-
uses: ./.github/actions/esc-action
589+
- env:
590+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
591+
ESC_ACTION_OIDC_AUTH: "true"
592+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
593+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
594+
id: esc-secrets
595+
name: Fetch secrets from ESC
596+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
582597
- id: version
583598
name: Set Provider Version
584599
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0

‎.github/workflows/command-dispatch.yml‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,8 @@
11
# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
22

33
env:
4-
AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }}
5-
AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }}
64
AWS_REGION: us-west-2
7-
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
85
PULUMI_API: https://api.pulumi-staging.io
9-
PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
10-
RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }}
11-
RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }}
12-
S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }}
13-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
146

157
jobs:
168
command-dispatch-for-testing:
@@ -24,9 +16,14 @@ jobs:
2416
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2517
with:
2618
persist-credentials: false
27-
- id: esc-secrets
28-
name: Map environment to ESC outputs
29-
uses: ./.github/actions/esc-action
19+
- env:
20+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
21+
ESC_ACTION_OIDC_AUTH: "true"
22+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
23+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
24+
id: esc-secrets
25+
name: Fetch secrets from ESC
26+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
3027
- uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4
3128
with:
3229
commands: |

‎.github/workflows/prerelease.yml‎

Lines changed: 48 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,8 @@ env:
1515
PYTHONVERSION: "3.11.8"
1616
DOTNETVERSION: "8.0.x"
1717
JAVAVERSION: "11"
18-
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
1918
AWS_REGION: us-west-2
20-
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
21-
AWS_UPLOAD_ROLE_ARN: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
22-
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
23-
JAVA_SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
24-
JAVA_SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
25-
JAVA_SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
26-
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
27-
NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
28-
OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
29-
OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
3019
PULUMI_API: https://api.pulumi-staging.io
31-
PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
32-
PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
33-
RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }}
34-
RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }}
3520
IS_PRERELEASE: true
3621

3722
jobs:
@@ -43,9 +28,14 @@ jobs:
4328
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
4429
with:
4530
lfs: true
46-
- id: esc-secrets
47-
name: Map environment to ESC outputs
48-
uses: ./.github/actions/esc-action
31+
- env:
32+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
33+
ESC_ACTION_OIDC_AUTH: "true"
34+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
35+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
36+
id: esc-secrets
37+
name: Fetch secrets from ESC
38+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
4939
- id: version
5040
name: Set Provider Version
5141
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
@@ -176,9 +166,14 @@ jobs:
176166
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
177167
with:
178168
lfs: true
179-
- id: esc-secrets
180-
name: Map environment to ESC outputs
181-
uses: ./.github/actions/esc-action
169+
- env:
170+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
171+
ESC_ACTION_OIDC_AUTH: "true"
172+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
173+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
174+
id: esc-secrets
175+
name: Fetch secrets from ESC
176+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
182177
- id: version
183178
name: Set Provider Version
184179
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
@@ -334,9 +329,14 @@ jobs:
334329
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
335330
with:
336331
lfs: true
337-
- id: esc-secrets
338-
name: Map environment to ESC outputs
339-
uses: ./.github/actions/esc-action
332+
- env:
333+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
334+
ESC_ACTION_OIDC_AUTH: "true"
335+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
336+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
337+
id: esc-secrets
338+
name: Fetch secrets from ESC
339+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
340340
- id: version
341341
name: Set Provider Version
342342
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
@@ -459,9 +459,14 @@ jobs:
459459
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
460460
with:
461461
lfs: true
462-
- id: esc-secrets
463-
name: Map environment to ESC outputs
464-
uses: ./.github/actions/esc-action
462+
- env:
463+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
464+
ESC_ACTION_OIDC_AUTH: "true"
465+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
466+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
467+
id: esc-secrets
468+
name: Fetch secrets from ESC
469+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
465470
- id: version
466471
name: Set Provider Version
467472
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
@@ -535,9 +540,14 @@ jobs:
535540
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
536541
with:
537542
lfs: true
538-
- id: esc-secrets
539-
name: Map environment to ESC outputs
540-
uses: ./.github/actions/esc-action
543+
- env:
544+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
545+
ESC_ACTION_OIDC_AUTH: "true"
546+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
547+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
548+
id: esc-secrets
549+
name: Fetch secrets from ESC
550+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
541551
- id: version
542552
name: Set Provider Version
543553
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
@@ -631,9 +641,14 @@ jobs:
631641
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
632642
with:
633643
lfs: true
634-
- id: esc-secrets
635-
name: Map environment to ESC outputs
636-
uses: ./.github/actions/esc-action
644+
- env:
645+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
646+
ESC_ACTION_OIDC_AUTH: "true"
647+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
648+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
649+
id: esc-secrets
650+
name: Fetch secrets from ESC
651+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
637652
- id: version
638653
name: Set Provider Version
639654
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0

0 commit comments

Comments
 (0)