Skip to content

Commit 6e911ce

Browse files
blampeblampe
authored
Use ESC for secrets (#1895)
Refs pulumi/ci-mgmt#1481.
1 parent cbe2941 commit 6e911ce

18 files changed

+209
-332
lines changed

‎.ci-mgmt.yaml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,27 +33,30 @@ env:
3333
NODE_VERSION: "20.x"
3434
PYTHON_VERSION: "3.9"
3535

36+
esc:
37+
enabled: true
38+
3639
actions:
3740
preTest:
3841
- name: Configure AWS Credentials
3942
uses: aws-actions/configure-aws-credentials@v4
4043
with:
41-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
44+
aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
4245
aws-region: ${{ env.AWS_REGION }}
43-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
46+
aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
4447
role-duration-seconds: 7200
4548
role-session-name: aws@githubActions
46-
role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
49+
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
4750
preBuild:
4851
- name: Configure AWS Credentials
4952
uses: aws-actions/configure-aws-credentials@v4
5053
with:
51-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
54+
aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
5255
aws-region: ${{ env.AWS_REGION }}
53-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
56+
aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
5457
role-duration-seconds: 7200
5558
role-session-name: aws@githubActions
56-
role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
59+
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
5760

5861
releaseVerification:
5962
nodejs: examples/cluster

‎.github/workflows/build_provider.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,14 @@ jobs:
4242
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
4343
with:
4444
persist-credentials: false
45-
- id: esc-secrets
46-
name: Map environment to ESC outputs
47-
uses: ./.github/actions/esc-action
45+
- env:
46+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
47+
ESC_ACTION_OIDC_AUTH: "true"
48+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
49+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
50+
id: esc-secrets
51+
name: Fetch secrets from ESC
52+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
4853
# Without ldid cross-compiling Node binaries on a Linux worker intended to work on darwin-arm64 fails to sign the
4954
# binaries properly and they do not work as expected. See https://github.com/pulumi/pulumi-awsx/issues/1490
5055
- uses: MOZGIII/install-ldid-action@v1

‎.github/workflows/build_sdk.yml‎

Lines changed: 8 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -10,35 +10,18 @@ on:
1010
type: string
1111

1212
env:
13-
AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }}
14-
AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }}
1513
AWS_REGION: us-west-2
16-
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
1714
DOTNET_VERSION: 6.x
18-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1915
GO_VERSION: 1.21.x
2016
GOLANGCI_LINT_VERSION: v1.64.8
2117
JAVA_VERSION: "11"
22-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
2318
NODE_VERSION: 20.x
24-
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
2519
PROVIDER: eks
26-
PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
27-
PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
28-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
2920
PULUMI_API: https://api.pulumi-staging.io
30-
PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
3121
PULUMI_ENABLE_RESOURCE_REFERENCES: "1"
3222
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
3323
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
3424
PYTHON_VERSION: "3.9"
35-
RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }}
36-
RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }}
37-
S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }}
38-
SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
39-
SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
40-
SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
41-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
4225
TF_APPEND_USER_AGENT: pulumi
4326
PROVIDER_VERSION: ${{ inputs.version }}
4427

@@ -65,9 +48,14 @@ jobs:
6548
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
6649
with:
6750
persist-credentials: false
68-
- id: esc-secrets
69-
name: Map environment to ESC outputs
70-
uses: ./.github/actions/esc-action
51+
- env:
52+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
53+
ESC_ACTION_OIDC_AUTH: "true"
54+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
55+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
56+
id: esc-secrets
57+
name: Fetch secrets from ESC
58+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
7159
- name: Cache examples generation
7260
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
7361
with:

‎.github/workflows/command-dispatch.yml‎

Lines changed: 8 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,18 @@
11
# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
22

33
env:
4-
AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }}
5-
AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }}
64
AWS_REGION: us-west-2
7-
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
85
DOTNET_VERSION: 6.x
9-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
106
GO_VERSION: 1.21.x
117
GOLANGCI_LINT_VERSION: v1.64.8
128
JAVA_VERSION: "11"
13-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
149
NODE_VERSION: 20.x
15-
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
1610
PROVIDER: eks
17-
PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
18-
PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
19-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
2011
PULUMI_API: https://api.pulumi-staging.io
21-
PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
2212
PULUMI_ENABLE_RESOURCE_REFERENCES: "1"
2313
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
2414
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
2515
PYTHON_VERSION: "3.9"
26-
RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }}
27-
RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }}
28-
S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }}
29-
SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
30-
SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
31-
SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
32-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
3316
TF_APPEND_USER_AGENT: pulumi
3417

3518
jobs:
@@ -44,9 +27,14 @@ jobs:
4427
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
4528
with:
4629
persist-credentials: false
47-
- id: esc-secrets
48-
name: Map environment to ESC outputs
49-
uses: ./.github/actions/esc-action
30+
- env:
31+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
32+
ESC_ACTION_OIDC_AUTH: "true"
33+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
34+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
35+
id: esc-secrets
36+
name: Fetch secrets from ESC
37+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
5038
- uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4
5139
with:
5240
commands: |

‎.github/workflows/eks-cron.yml‎

Lines changed: 56 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,10 @@
11
env:
2-
ALT_AWS_ACCESS_KEY_ID: ${{ secrets.ALT_AWS_ACCESS_KEY_ID }}
3-
ALT_AWS_SECRET_ACCESS_KEY: ${{ secrets.ALT_AWS_SECRET_ACCESS_KEY }}
42
AWS_REGION: us-west-2
5-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
63
GOLANGCI_LINT_VERSION: v1.64.8
7-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
8-
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
9-
NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
104
PROVIDER: eks
11-
PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
12-
PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
13-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
145
PULUMI_API: https://api.pulumi-staging.io
15-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
166
PYPI_USERNAME: __token__
17-
PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
187
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
19-
SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
20-
SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
21-
SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
228
PULUMI_ENABLE_RESOURCE_REFERENCES: 1
239
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
2410
GOVERSION: "1.23.x"
@@ -191,9 +177,20 @@ jobs:
191177
runs-on: ubuntu-latest
192178
env:
193179
PROVIDER_VERSION: ${{ needs.prerequisites.outputs.version }}
180+
permissions:
181+
contents: read
182+
id-token: write # For ESC secrets.
194183
steps:
195184
- name: Checkout Repo
196185
uses: actions/checkout@v4
186+
- env:
187+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
188+
ESC_ACTION_OIDC_AUTH: "true"
189+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
190+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
191+
id: esc-secrets
192+
name: Fetch secrets from ESC
193+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
197194
- name: Install Go
198195
uses: actions/setup-go@v5
199196
with:
@@ -244,12 +241,12 @@ jobs:
244241
- name: Configure AWS Credentials
245242
uses: aws-actions/configure-aws-credentials@v4
246243
with:
247-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
244+
aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
248245
aws-region: ${{ env.AWS_REGION }}
249-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
246+
aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
250247
role-duration-seconds: 7200
251248
role-session-name: ${{ env.PROVIDER }}@githubActions
252-
role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
249+
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
253250
- name: Link nodejs binary for testing
254251
run: |
255252
cd ${{ github.workspace }}/bin
@@ -278,9 +275,20 @@ jobs:
278275
runs-on: ubuntu-latest
279276
env:
280277
PROVIDER_VERSION: ${{ needs.prerequisites.outputs.version }}
278+
permissions:
279+
contents: read
280+
id-token: write # For ESC secrets.
281281
steps:
282282
- name: Checkout Repo
283283
uses: actions/checkout@v4
284+
- env:
285+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
286+
ESC_ACTION_OIDC_AUTH: "true"
287+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
288+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
289+
id: esc-secrets
290+
name: Fetch secrets from ESC
291+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
284292
- name: Install Go
285293
uses: actions/setup-go@v5
286294
with:
@@ -344,12 +352,12 @@ jobs:
344352
- name: Configure AWS Credentials
345353
uses: aws-actions/configure-aws-credentials@v4
346354
with:
347-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
355+
aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
348356
aws-region: ${{ env.AWS_REGION }}
349-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
357+
aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
350358
role-duration-seconds: 7200
351359
role-session-name: ${{ env.PROVIDER }}@githubActions
352-
role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
360+
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
353361
- name: Link nodejs binary for testing
354362
run: |
355363
cd ${{ github.workspace }}/bin
@@ -377,9 +385,20 @@ jobs:
377385
runs-on: ubuntu-latest
378386
env:
379387
PROVIDER_VERSION: ${{ needs.prerequisites.outputs.version }}
388+
permissions:
389+
contents: read
390+
id-token: write # For ESC secrets.
380391
steps:
381392
- name: Checkout Repo
382393
uses: actions/checkout@v4
394+
- env:
395+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
396+
ESC_ACTION_OIDC_AUTH: "true"
397+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
398+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
399+
id: esc-secrets
400+
name: Fetch secrets from ESC
401+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
383402
- name: Install Go
384403
uses: actions/setup-go@v5
385404
with:
@@ -443,12 +462,12 @@ jobs:
443462
- name: Configure AWS Credentials
444463
uses: aws-actions/configure-aws-credentials@v4
445464
with:
446-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
465+
aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
447466
aws-region: ${{ env.AWS_REGION }}
448-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
467+
aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
449468
role-duration-seconds: 7200
450469
role-session-name: ${{ env.PROVIDER }}@githubActions
451-
role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
470+
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
452471
- name: Link nodejs binary for testing
453472
run: |
454473
cd ${{ github.workspace }}/bin
@@ -463,9 +482,20 @@ jobs:
463482
runs-on: ubuntu-latest
464483
env:
465484
PROVIDER_VERSION: ${{ needs.prerequisites.outputs.version }}
485+
permissions:
486+
contents: read
487+
id-token: write # For ESC secrets.
466488
steps:
467489
- name: Checkout Repo
468490
uses: actions/checkout@v4
491+
- env:
492+
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
493+
ESC_ACTION_OIDC_AUTH: "true"
494+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
495+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
496+
id: esc-secrets
497+
name: Fetch secrets from ESC
498+
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
469499
- name: Install Go
470500
uses: actions/setup-go@v5
471501
with:
@@ -527,12 +557,12 @@ jobs:
527557
- name: Configure AWS Credentials
528558
uses: aws-actions/configure-aws-credentials@v4
529559
with:
530-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
560+
aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
531561
aws-region: ${{ env.AWS_REGION }}
532-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
562+
aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
533563
role-duration-seconds: 7200
534564
role-session-name: ${{ env.PROVIDER }}@githubActions
535-
role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
565+
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
536566
- name: Link nodejs binary for testing
537567
run: |
538568
cd ${{ github.workspace }}/bin

0 commit comments

Comments
 (0)