Skip to content

Commit 0dee61d

Browse files
pixman20pixman20
authored
[BRE-831] migrate secrets akv (#340)
1 parent 86d18ed commit 0dee61d

File tree

9 files changed

+232
-28
lines changed

9 files changed

+232
-28
lines changed

‎.github/workflows/a11y-eval-all.yml

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ jobs:
1717
build-and-test:
1818
name: Build and test
1919
runs-on: ubuntu-24.04
20+
permissions:
21+
id-token: write
22+
contents: read
23+
packages: read
2024
steps:
2125
- name: Checkout
2226
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -27,12 +31,29 @@ jobs:
2731
cache-dependency-path: "**/package-lock.json"
2832
node-version: "23"
2933

34+
- name: Log in to Azure
35+
uses: bitwarden/gh-actions/azure-login@main
36+
with:
37+
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
38+
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
39+
client_id: ${{ secrets.AZURE_CLIENT_ID }}
40+
41+
- name: Get Azure Key Vault secrets
42+
id: get-kv-secrets
43+
uses: bitwarden/gh-actions/get-keyvault-secrets@main
44+
with:
45+
keyvault: gh-browser-interactions
46+
secrets: "ENV-FILE,BW-INSTALLATION-ID,BW-INSTALLATION-KEY"
47+
48+
- name: Log out from Azure
49+
uses: bitwarden/gh-actions/azure-logout@main
50+
3051
- name: Create dotenv file
3152
run: |
3253
sudo setcap 'cap_net_bind_service=+ep' `which node`
33-
echo "${{ secrets.ENV_FILE }}" | base64 --decode > .env
34-
echo "BW_INSTALLATION_ID=${{ secrets.BW_INSTALLATION_ID }}" >> .env
35-
echo "BW_INSTALLATION_KEY=${{ secrets.BW_INSTALLATION_KEY }}" >> .env
54+
echo "${{ steps.get-kv-secrets.outputs.ENV-FILE }}" | base64 --decode > .env
55+
echo "BW_INSTALLATION_ID=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-ID }}" >> .env
56+
echo "BW_INSTALLATION_KEY=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-KEY }}" >> .env
3657
3758
- name: Create feature flags file
3859
run: echo "{\"flagValues\":${{ inputs.FEATURE_FLAGS }}}" > flags.json

‎.github/workflows/a11y-eval-browser.yml

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ jobs:
1717
build-and-test:
1818
name: Build and test
1919
runs-on: ubuntu-24.04
20+
permissions:
21+
id-token: write
22+
contents: read
23+
packages: read
2024
steps:
2125
- name: Checkout
2226
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -27,12 +31,29 @@ jobs:
2731
cache-dependency-path: "**/package-lock.json"
2832
node-version: "23"
2933

34+
- name: Log in to Azure
35+
uses: bitwarden/gh-actions/azure-login@main
36+
with:
37+
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
38+
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
39+
client_id: ${{ secrets.AZURE_CLIENT_ID }}
40+
41+
- name: Get Azure Key Vault secrets
42+
id: get-kv-secrets
43+
uses: bitwarden/gh-actions/get-keyvault-secrets@main
44+
with:
45+
keyvault: gh-browser-interactions
46+
secrets: "ENV-FILE,BW-INSTALLATION-ID,BW-INSTALLATION-KEY"
47+
48+
- name: Log out from Azure
49+
uses: bitwarden/gh-actions/azure-logout@main
50+
3051
- name: Create dotenv file
3152
run: |
3253
sudo setcap 'cap_net_bind_service=+ep' `which node`
33-
echo "${{ secrets.ENV_FILE }}" | base64 --decode > .env
34-
echo "BW_INSTALLATION_ID=${{ secrets.BW_INSTALLATION_ID }}" >> .env
35-
echo "BW_INSTALLATION_KEY=${{ secrets.BW_INSTALLATION_KEY }}" >> .env
54+
echo "${{ steps.get-kv-secrets.outputs.ENV-FILE }}" | base64 --decode > .env
55+
echo "BW_INSTALLATION_ID=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-ID }}" >> .env
56+
echo "BW_INSTALLATION_KEY=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-KEY }}" >> .env
3657
3758
- name: Create feature flags file
3859
run: echo "{\"flagValues\":${{ inputs.FEATURE_FLAGS }}}" > flags.json

‎.github/workflows/a11y-eval-web.yml

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ jobs:
1313
build-and-test:
1414
name: Build and test
1515
runs-on: ubuntu-24.04
16+
permissions:
17+
id-token: write
18+
contents: read
19+
packages: read
1620
steps:
1721
- name: Checkout
1822
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -23,12 +27,29 @@ jobs:
2327
cache-dependency-path: "**/package-lock.json"
2428
node-version: "23"
2529

30+
- name: Log in to Azure
31+
uses: bitwarden/gh-actions/azure-login@main
32+
with:
33+
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
34+
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
35+
client_id: ${{ secrets.AZURE_CLIENT_ID }}
36+
37+
- name: Get Azure Key Vault secrets
38+
id: get-kv-secrets
39+
uses: bitwarden/gh-actions/get-keyvault-secrets@main
40+
with:
41+
keyvault: gh-browser-interactions
42+
secrets: "ENV-FILE,BW-INSTALLATION-ID,BW-INSTALLATION-KEY"
43+
44+
- name: Log out from Azure
45+
uses: bitwarden/gh-actions/azure-logout@main
46+
2647
- name: Create dotenv file
2748
run: |
2849
sudo setcap 'cap_net_bind_service=+ep' `which node`
29-
echo "${{ secrets.ENV_FILE }}" | base64 --decode > .env
30-
echo "BW_INSTALLATION_ID=${{ secrets.BW_INSTALLATION_ID }}" >> .env
31-
echo "BW_INSTALLATION_KEY=${{ secrets.BW_INSTALLATION_KEY }}" >> .env
50+
echo "${{ steps.get-kv-secrets.outputs.ENV-FILE }}" | base64 --decode > .env
51+
echo "BW_INSTALLATION_ID=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-ID }}" >> .env
52+
echo "BW_INSTALLATION_KEY=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-KEY }}" >> .env
3253
3354
- name: Create feature flags file
3455
run: echo "{\"flagValues\":${{ inputs.FEATURE_FLAGS }}}" > flags.json

‎.github/workflows/scan.yml

Lines changed: 40 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,23 +32,41 @@ jobs:
3232
contents: read
3333
pull-requests: write
3434
security-events: write
35+
id-token: write
3536

3637
steps:
3738
- name: Check out repo
3839
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3940
with:
4041
ref: ${{ github.event.pull_request.head.sha }}
4142

43+
- name: Log in to Azure
44+
uses: bitwarden/gh-actions/azure-login@main
45+
with:
46+
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
47+
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
48+
client_id: ${{ secrets.AZURE_CLIENT_ID }}
49+
50+
- name: Get Azure Key Vault secrets
51+
id: get-kv-secrets
52+
uses: bitwarden/gh-actions/get-keyvault-secrets@main
53+
with:
54+
keyvault: gh-org-bitwarden
55+
secrets: "CHECKMARX-TENANT,CHECKMARX-CLIENT-ID,CHECKMARX-SECRET"
56+
57+
- name: Log out from Azure
58+
uses: bitwarden/gh-actions/azure-logout@main
59+
4260
- name: Scan with Checkmarx
4361
uses: checkmarx/ast-github-action@ef93013c95adc60160bc22060875e90800d3ecfc # 2.3.19
4462
env:
4563
INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}"
4664
with:
4765
project_name: ${{ github.repository }}
48-
cx_tenant: ${{ secrets.CHECKMARX_TENANT }}
66+
cx_tenant: ${{ steps.get-kv-secrets.outputs.CHECKMARX-TENANT }}
4967
base_uri: https://ast.checkmarx.net/
50-
cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }}
51-
cx_client_secret: ${{ secrets.CHECKMARX_SECRET }}
68+
cx_client_id: ${{ steps.get-kv-secrets.outputs.CHECKMARX-CLIENT-ID }}
69+
cx_client_secret: ${{ steps.get-kv-secrets.outputs.CHECKMARX-SECRET }}
5270
additional_params: |
5371
--report-format sarif \
5472
--filter "state=TO_VERIFY;PROPOSED_NOT_EXPLOITABLE;CONFIRMED;URGENT" \
@@ -68,6 +86,7 @@ jobs:
6886
permissions:
6987
contents: read
7088
pull-requests: write
89+
id-token: write
7190

7291
steps:
7392
- name: Check out repo
@@ -76,10 +95,27 @@ jobs:
7695
fetch-depth: 0
7796
ref: ${{ github.event.pull_request.head.sha }}
7897

98+
- name: Log in to Azure
99+
uses: bitwarden/gh-actions/azure-login@main
100+
with:
101+
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
102+
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
103+
client_id: ${{ secrets.AZURE_CLIENT_ID }}
104+
105+
- name: Get Azure Key Vault secrets
106+
id: get-kv-secrets
107+
uses: bitwarden/gh-actions/get-keyvault-secrets@main
108+
with:
109+
keyvault: gh-org-bitwarden
110+
secrets: "SONAR-TOKEN"
111+
112+
- name: Log out from Azure
113+
uses: bitwarden/gh-actions/azure-logout@main
114+
79115
- name: Scan with SonarCloud
80116
uses: sonarsource/sonarqube-scan-action@aa494459d7c39c106cc77b166de8b4250a32bb97 # v5.1.0
81117
env:
82-
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
118+
SONAR_TOKEN: ${{ steps.get-kv-secrets.outputs.SONAR-TOKEN }}
83119
with:
84120
args: >
85121
-Dsonar.organization=${{ github.repository_owner }}

‎.github/workflows/test-all-custom-flags.yml

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ jobs:
2121
build-and-test:
2222
name: Build and test
2323
runs-on: ubuntu-24.04
24+
permissions:
25+
id-token: write
26+
contents: read
27+
packages: read
2428
steps:
2529
- name: Checkout
2630
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -31,12 +35,29 @@ jobs:
3135
cache-dependency-path: "**/package-lock.json"
3236
node-version: "23"
3337

38+
- name: Log in to Azure
39+
uses: bitwarden/gh-actions/azure-login@main
40+
with:
41+
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
42+
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
43+
client_id: ${{ secrets.AZURE_CLIENT_ID }}
44+
45+
- name: Get Azure Key Vault secrets
46+
id: get-kv-secrets
47+
uses: bitwarden/gh-actions/get-keyvault-secrets@main
48+
with:
49+
keyvault: gh-browser-interactions
50+
secrets: "ENV-FILE,BW-INSTALLATION-ID,BW-INSTALLATION-KEY"
51+
52+
- name: Log out from Azure
53+
uses: bitwarden/gh-actions/azure-logout@main
54+
3455
- name: Create dotenv file
3556
run: |
3657
sudo setcap 'cap_net_bind_service=+ep' `which node`
37-
echo "${{ secrets.ENV_FILE }}" | base64 --decode > .env
38-
echo "BW_INSTALLATION_ID=${{ secrets.BW_INSTALLATION_ID }}" >> .env
39-
echo "BW_INSTALLATION_KEY=${{ secrets.BW_INSTALLATION_KEY }}" >> .env
58+
echo "${{ steps.get-kv-secrets.outputs.ENV-FILE }}" | base64 --decode > .env
59+
echo "BW_INSTALLATION_ID=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-ID }}" >> .env
60+
echo "BW_INSTALLATION_KEY=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-KEY }}" >> .env
4061
4162
- name: Create feature flags file
4263
run: echo "{\"flagValues\":${{ inputs.FEATURE_FLAGS || '{}' }}}" > flags.json

‎.github/workflows/test-all.yml

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ jobs:
2020
build-and-test:
2121
name: Build and test
2222
runs-on: ubuntu-24.04
23+
permissions:
24+
id-token: write
25+
contents: read
26+
packages: read
2327
steps:
2428
- name: Checkout
2529
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -30,12 +34,29 @@ jobs:
3034
cache-dependency-path: "**/package-lock.json"
3135
node-version: "23"
3236

37+
- name: Log in to Azure
38+
uses: bitwarden/gh-actions/azure-login@main
39+
with:
40+
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
41+
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
42+
client_id: ${{ secrets.AZURE_CLIENT_ID }}
43+
44+
- name: Get Azure Key Vault secrets
45+
id: get-kv-secrets
46+
uses: bitwarden/gh-actions/get-keyvault-secrets@main
47+
with:
48+
keyvault: gh-browser-interactions
49+
secrets: "ENV-FILE,BW-INSTALLATION-ID,BW-INSTALLATION-KEY"
50+
51+
- name: Log out from Azure
52+
uses: bitwarden/gh-actions/azure-logout@main
53+
3354
- name: Create dotenv file
3455
run: |
3556
sudo setcap 'cap_net_bind_service=+ep' `which node`
36-
echo "${{ secrets.ENV_FILE }}" | base64 --decode > .env
37-
echo "BW_INSTALLATION_ID=${{ secrets.BW_INSTALLATION_ID }}" >> .env
38-
echo "BW_INSTALLATION_KEY=${{ secrets.BW_INSTALLATION_KEY }}" >> .env
57+
echo "${{ steps.get-kv-secrets.outputs.ENV-FILE }}" | base64 --decode > .env
58+
echo "BW_INSTALLATION_ID=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-ID }}" >> .env
59+
echo "BW_INSTALLATION_KEY=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-KEY }}" >> .env
3960
echo "REMOTE_VAULT_CONFIG_MATCH=${{ inputs.REMOTE_VAULT_CONFIG_MATCH || vars.BW_REMOTE_VAULT_CONFIG_MATCH }}" >> .env
4061
4162
- name: Download extension artifact

‎.github/workflows/test-autofill.yml

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ jobs:
1717
build-and-test:
1818
name: Build and test
1919
runs-on: ubuntu-24.04
20+
permissions:
21+
id-token: write
22+
contents: read
23+
packages: read
2024
steps:
2125
- name: Checkout
2226
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -27,12 +31,29 @@ jobs:
2731
cache-dependency-path: "**/package-lock.json"
2832
node-version: "23"
2933

34+
- name: Log in to Azure
35+
uses: bitwarden/gh-actions/azure-login@main
36+
with:
37+
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
38+
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
39+
client_id: ${{ secrets.AZURE_CLIENT_ID }}
40+
41+
- name: Get Azure Key Vault secrets
42+
id: get-kv-secrets
43+
uses: bitwarden/gh-actions/get-keyvault-secrets@main
44+
with:
45+
keyvault: gh-browser-interactions
46+
secrets: "ENV-FILE,BW-INSTALLATION-ID,BW-INSTALLATION-KEY"
47+
48+
- name: Log out from Azure
49+
uses: bitwarden/gh-actions/azure-logout@main
50+
3051
- name: Create dotenv file
3152
run: |
3253
sudo setcap 'cap_net_bind_service=+ep' `which node`
33-
echo "${{ secrets.ENV_FILE }}" | base64 --decode > .env
34-
echo "BW_INSTALLATION_ID=${{ secrets.BW_INSTALLATION_ID }}" >> .env
35-
echo "BW_INSTALLATION_KEY=${{ secrets.BW_INSTALLATION_KEY }}" >> .env
54+
echo "${{ steps.get-kv-secrets.outputs.ENV-FILE }}" | base64 --decode > .env
55+
echo "BW_INSTALLATION_ID=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-ID }}" >> .env
56+
echo "BW_INSTALLATION_KEY=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-KEY }}" >> .env
3657
3758
- name: Create feature flags file
3859
run: echo "{\"flagValues\":${{ inputs.FEATURE_FLAGS }}}" > flags.json

‎.github/workflows/test-notification.yml

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ jobs:
1717
build-and-test:
1818
name: Build and test
1919
runs-on: ubuntu-24.04
20+
permissions:
21+
id-token: write
22+
contents: read
23+
packages: read
2024
steps:
2125
- name: Checkout
2226
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -27,12 +31,29 @@ jobs:
2731
cache-dependency-path: "**/package-lock.json"
2832
node-version: "23"
2933

34+
- name: Log in to Azure
35+
uses: bitwarden/gh-actions/azure-login@main
36+
with:
37+
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
38+
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
39+
client_id: ${{ secrets.AZURE_CLIENT_ID }}
40+
41+
- name: Get Azure Key Vault secrets
42+
id: get-kv-secrets
43+
uses: bitwarden/gh-actions/get-keyvault-secrets@main
44+
with:
45+
keyvault: gh-browser-interactions
46+
secrets: "ENV-FILE,BW-INSTALLATION-ID,BW-INSTALLATION-KEY"
47+
48+
- name: Log out from Azure
49+
uses: bitwarden/gh-actions/azure-logout@main
50+
3051
- name: Create dotenv file
3152
run: |
3253
sudo setcap 'cap_net_bind_service=+ep' `which node`
33-
echo "${{ secrets.ENV_FILE }}" | base64 --decode > .env
34-
echo "BW_INSTALLATION_ID=${{ secrets.BW_INSTALLATION_ID }}" >> .env
35-
echo "BW_INSTALLATION_KEY=${{ secrets.BW_INSTALLATION_KEY }}" >> .env
54+
echo "${{ steps.get-kv-secrets.outputs.ENV-FILE }}" | base64 --decode > .env
55+
echo "BW_INSTALLATION_ID=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-ID }}" >> .env
56+
echo "BW_INSTALLATION_KEY=${{ steps.get-kv-secrets.outputs.BW-INSTALLATION-KEY }}" >> .env
3657
3758
- name: Create feature flags file
3859
run: echo "{\"flagValues\":${{ inputs.FEATURE_FLAGS }}}" > flags.json

0 commit comments

Comments
 (0)