Skip to content

Commit a9ec3e0

Browse files
tobyhedetobyhede
committed
ci: replace 1Password with protectjs for CI secrets
Migrate CI secrets management from 1Password CLI to @cipherstash/protect (protectjs) using ZeroKMS for encryption/decryption. Changes: - Add scripts/ directory with TypeScript encrypt/decrypt tooling - Replace 1Password template with encrypted secrets file - Update all workflow files to use protectjs decryption - Add node_modules to .gitignore The new approach uses CS_VAULT_CLIENT_KEY and CS_VAULT_CLIENT_ACCESS_KEY GitHub secrets for authentication with ZeroKMS.
1 parent 257927d commit a9ec3e0

File tree

12 files changed

+1133
-52
lines changed

12 files changed

+1133
-52
lines changed

‎.github/secrets.env.encrypted‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
{
2+
"CS_CLIENT_ACCESS_KEY": {
3+
"k": "ct",
4+
"c": "mBbLSVoU8`Do{H^4JdEH-DQ=;S0?!jXuj1GO<~nS77f6pGpQlROf9T!OWofsjl^#8A)M`97s6*4d0;YqiP5Q}aMyTySjc4-4673@C8B(NM?d)d7XuPf8JI)0vuk!)IKt`S^%ik$#2^`^r9+Nxb_`1Qo*(n?oS^3v|KZyn5qEtOAqksWikYQ$VQh6}#1J%G{m*u9K=iaYPbgM7%ZC",
5+
"ob": null,
6+
"bf": null,
7+
"hm": null,
8+
"i": {
9+
"t": "ci_secrets",
10+
"c": "value"
11+
},
12+
"v": 2
13+
},
14+
"CS_CLIENT_ID": {
15+
"k": "ct",
16+
"c": "mBbLxa?ahrJW29+2tZu4UG$>FHmFEjiG510=YV<ZH5o@@I-JnG?;wSK_~l8m@bq$!_4U}2rXu}Z05wRbS!{&Gs!g$9G<a>qATlXu#AZ-+z)vGg7>@rO#&?Nyn#PyM+c#ggbfg(pF{O54Y;|SC5Hwu<&vtJ>^t3onC{{VkhX",
17+
"ob": null,
18+
"bf": null,
19+
"hm": null,
20+
"i": {
21+
"t": "ci_secrets",
22+
"c": "value"
23+
},
24+
"v": 2
25+
},
26+
"CS_CLIENT_KEY": {
27+
"k": "ct",
28+
"c": "mBbL8G4ax6h3T~Q?tDDf%8k~=0b-Ynl7J`f9<S}gEPQu%m@y2iRJq;o5C?v^cDKPsmHvE-(a9!FZ~HhScEwSUAYfYYu#;C|HfSra)}92@p#YZn*?2G}?R>4zJ0Z;L9{dMuI!X+A>=g&*voOs>;NFtYQ<31*#vAI^rYUd<p%(8aTLpW{wSJ0(yKO?p=$E-M_Job5{!X%iEcGZ}V@DO5y0YD;z(S2n1~SCN!mjvRwhTDCSsziHK-_LwTrwEK<ae%M<IdA?(of}{=<khZN^KqCIXX#eK?mkKF;+wlW_MjPGZ6*YZ%578;C8skTj^6#m10Om(Q+M^>(y>*0hkz{!b}eF^i`h<I#$<<Iv6p^j>bwxLEL_MYql(SEdej(3Y6`O$)10zct`!1(oaD2`A94cnf+8)Z+7SNee62O1DW2PGR<(>^3lWbgXMzq6XlbvZrg@l=cyD~(CNWUo((hawMLjb>x=PE#2{IEcyVS|$jr{D@^!2|R>_;<Vq|m<0N&4oQ%xWy=qIIiVQh6}#1J%G{m*u9K=iaYPbgM7%ZC",
29+
"ob": null,
30+
"bf": null,
31+
"hm": null,
32+
"i": {
33+
"t": "ci_secrets",
34+
"c": "value"
35+
},
36+
"v": 2
37+
},
38+
"CS_WORKSPACE_CRN": {
39+
"k": "ct",
40+
"c": "mBbM11wMFh#K#zPwdM~;ju3FfG{A%7YOibQop2IN#?B!h8eK84igixM;ReqD(co=^a(~lA7uWP8T@&Gd64qf-Bn>wluEZeSgL3m3dI-49kfKlVJ2oJ>=6Nj?K<Z&m#1E1h5jT~kc42IFWyBCPT>Z~>Z$R|4I8P{6Im?F",
41+
"ob": null,
42+
"bf": null,
43+
"hm": null,
44+
"i": {
45+
"t": "ci_secrets",
46+
"c": "value"
47+
},
48+
"v": 2
49+
},
50+
"CS_DEFAULT_KEYSET_ID": {
51+
"k": "ct",
52+
"c": "mBbJss<&W}*cPMX<|8MC6Jz1THhfz?pMTD^N5K+iXDom=eL~KfZiZvZ?BX~^Cf)U7IxtS494>ot;NV9~V5`T>A085uF9AWsAR|;F|L`fBbduc_c0%;e8FE}^9C+I-6&+JSH%G}TPNjBXY;|SC5Hwu<&vtJ>^t3onC{{VkhX",
53+
"ob": null,
54+
"bf": null,
55+
"hm": null,
56+
"i": {
57+
"t": "ci_secrets",
58+
"c": "value"
59+
},
60+
"v": 2
61+
},
62+
"CS_TENANT_KEYSET_ID_1": {
63+
"k": "ct",
64+
"c": "mBbLxyC6xC+{EW;;5A`|u`KPxHUzKScK`B&^Jy}8?+{AvGOt<>3Ysz%{Twa+L!gXjsy63HTwS%&1712T=;=KzS_v)L5cf62AYUC~xJMlYv<xX{ZN^r0<9;QYPkWMvl=QLTzHfEYTcvhkY;|SC5Hwu<&vtJ>^t3onC{{VkhX",
65+
"ob": null,
66+
"bf": null,
67+
"hm": null,
68+
"i": {
69+
"t": "ci_secrets",
70+
"c": "value"
71+
},
72+
"v": 2
73+
},
74+
"CS_TENANT_KEYSET_ID_2": {
75+
"k": "ct",
76+
"c": "mBbMJ`*UJyfuK2WYIx}JeqCO~Ha*-O?bCvj0H4BWR!I{IP+g&84Z`0c?^?NS3pgN;u~y8WK){H*3!ky3h!n?FzrMcGlAh+oAZuER+rp|(n*Dxg^gF{wpz@sto!>QMQm6+&?wJE6GNpE5Y;|SC5Hwu<&vtJ>^t3onC{{VkhX",
77+
"ob": null,
78+
"bf": null,
79+
"hm": null,
80+
"i": {
81+
"t": "ci_secrets",
82+
"c": "value"
83+
},
84+
"v": 2
85+
},
86+
"CS_TENANT_KEYSET_ID_3": {
87+
"k": "ct",
88+
"c": "mBbLNuQ68uYA@n#p0N1{dBu*zHdE`M%fbp1-_?W4`AEXO*zc-@=O9><vX;ge`1kF3_H-1Sa}nxWT?6ss2+SoEJs(zXt|KhOAn&FMfI7lmP}}X|TUDIMCU<N$U+mgk1RTf2auY!*P^ETZY;|SC5Hwu<&vtJ>^t3onC{{VkhX",
89+
"ob": null,
90+
"bf": null,
91+
"hm": null,
92+
"i": {
93+
"t": "ci_secrets",
94+
"c": "value"
95+
},
96+
"v": 2
97+
},
98+
"CS_TENANT_KEYSET_NAME_1": {
99+
"k": "ct",
100+
"c": "mBbJ+K&~zqj~hA_s_brbV0D|s7Xp~0205UCF^xN;Ns7e=m`RWayps}t#2`?P9j09-zvbqOuavY5bnQx4PA1>4T;p_tY()ytR_vvAVQh6}#1J%G{m*u9K=iaYPbgM7%ZC",
101+
"ob": null,
102+
"bf": null,
103+
"hm": null,
104+
"i": {
105+
"t": "ci_secrets",
106+
"c": "value"
107+
},
108+
"v": 2
109+
},
110+
"CS_TENANT_KEYSET_NAME_2": {
111+
"k": "ct",
112+
"c": "mBbL}WAbeTps@Mb2F2-O!$sZ17t=Cd3lu>!8?)(EBu0T<4=Esv8cRfl#2{-@)J9now;&lMqA$iiHUU)}y)=fkK>Ciy^P!vSvNxr6VQh6}#1J%G{m*u9K=iaYPbgM7%ZC",
113+
"ob": null,
114+
"bf": null,
115+
"hm": null,
116+
"i": {
117+
"t": "ci_secrets",
118+
"c": "value"
119+
},
120+
"v": 2
121+
},
122+
"CS_TENANT_KEYSET_NAME_3": {
123+
"k": "ct",
124+
"c": "mBbJwjyTKdTw8=TdyJ9#EDfl{7w{Kl<PpWPX_UW3j&Sc3RyQMFYJuSr#2`E~L?Tk=XN`She%njse&wgIpn7u#m7^<}|C5dP9GazeVQh6}#1J%G{m*u9K=iaYPbgM7%ZC",
125+
"ob": null,
126+
"bf": null,
127+
"hm": null,
128+
"i": {
129+
"t": "ci_secrets",
130+
"c": "value"
131+
},
132+
"v": 2
133+
},
134+
"DOCKER_HUB_USERNAME": {
135+
"k": "ct",
136+
"c": "mBbJx*gnX#oukxKVee&yAkZtsA>GGfJHd6wn21L&_@lHCm207NnPl&O{i{{7b!RG7K=s5RjVeiDiAPtDArSLa5ZE?t)<`)rh0?Hop1JJl`6(R?rFLO#b!Eg5G+h19c5guRv^Y;FRyoUu",
137+
"ob": null,
138+
"bf": null,
139+
"hm": null,
140+
"i": {
141+
"t": "ci_secrets",
142+
"c": "value"
143+
},
144+
"v": 2
145+
},
146+
"DOCKER_HUB_PASSWORD": {
147+
"k": "ct",
148+
"c": "mBbK*YbGjRbIEUJ;<LEUwmIp<I@ePaks(deqq%0Sf>l7IpaEQl3416=!<r_6Z}W;m#f;jB7XqPHYk|0|nB5PK(~V~iyGbRG>tEKyAXSugKRW6Htia|<mUj7BLgi3V^LwHGp_oxI<S7T2IHh)BY;|SC5Hwu<&vtJ>^t3onC{{VkhX",
149+
"ob": null,
150+
"bf": null,
151+
"hm": null,
152+
"i": {
153+
"t": "ci_secrets",
154+
"c": "value"
155+
},
156+
"v": 2
157+
},
158+
"MULTITUDES_ACCESS_TOKEN": {
159+
"k": "ct",
160+
"c": "mBbKHz&;-To())kJ?nL;PvuU<0e1LJPzQ$#7Ug-%n=uXD(aTAjP4{L_z#E(X;IhH9Q<Bom)9my&>C4Ym4b`KXe?Y)HqcJ>qx1<#@>U9Bta5E7qM~<xtb!3l$k1C(t$D>Hl4%fG<K?-2U_Jw9o2%6$)PEVsU<^1wCiFODx+jX@$#C3C4W$=2_=PGn==#0x>FNuIo^b_ng2^0#=te%aZNxV53-uVKMgDk<O@Q0j5RLnV*ZHG2}Vy{!aj+==H2MEOhPZv8PR`5-H4)`5uo^HS}LP&x{;?<hs1|7}(Ew*BE1s1H$j75|yFSp1kSfZN^RcCw+3%b1za}1iUBV?ew8UC1a+kTr&?HXitn?U1fTa+AdGdQ}BZsEww@dQRV?;SKnQn+#iAJ-4Oqku_z<i|Q1DvMV3yxY2#tM4=I7r|fl(z4naE24M&32=z*<^2;%GI86I9zO|*v>;~FQGNZ(=~w=mWqVKzEI57qi`6Q)&Rdk68I(64_I^sI#30&bs!?e8=@s6hiH|SuM<^&qZPXfHPmcrvuaUD*Be11*VQh6}#1J%G{m*u9K=iaYPbgM7%ZC",
161+
"ob": null,
162+
"bf": null,
163+
"hm": null,
164+
"i": {
165+
"t": "ci_secrets",
166+
"c": "value"
167+
},
168+
"v": 2
169+
}
170+
}

‎.github/secrets.env.tpl‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎.github/workflows/benchmark.yml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,21 @@ jobs:
2525
- uses: actions/checkout@v4
2626
- uses: ./.github/actions/setup-test
2727

28-
- name: Load secrets
29-
uses: 1password/load-secrets-action@v3
28+
- uses: actions/setup-node@v4
3029
with:
31-
export-env: true
30+
node-version: '20'
31+
cache: 'npm'
32+
cache-dependency-path: scripts/package-lock.json
33+
34+
- name: Install decrypt dependencies
35+
working-directory: scripts
36+
run: npm ci
37+
38+
- name: Decrypt secrets
3239
env:
33-
OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
34-
OP_ENV_FILE: .github/secrets.env.tpl
40+
CS_CLIENT_KEY: ${{ secrets.CS_VAULT_CLIENT_KEY }}
41+
CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_VAULT_CLIENT_ACCESS_KEY }}
42+
run: cd scripts && npm run decrypt
3543

3644
- run: |
3745
mise run postgres:up --extra-args "--detach --wait"
@@ -63,10 +71,4 @@ jobs:
6371
comment-on-alert: true
6472
summary-always: true
6573
auto-push: true
66-
benchmark-data-dir-path: docs
67-
68-
- uses: ./.github/actions/send-slack-notification
69-
with:
70-
channel: engineering
71-
webhook_url: ${{ env.SLACK_NOTIFICATION_WEBHOOK_URL }}
72-
74+
benchmark-data-dir-path: docs

‎.github/workflows/release-aws-marketplace.yml‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -82,13 +82,21 @@ jobs:
8282

8383
- uses: actions/checkout@v4
8484

85-
- name: Load secrets
86-
uses: 1password/load-secrets-action@v3
85+
- uses: actions/setup-node@v4
8786
with:
88-
export-env: true
87+
node-version: '20'
88+
cache: 'npm'
89+
cache-dependency-path: scripts/package-lock.json
90+
91+
- name: Install decrypt dependencies
92+
working-directory: scripts
93+
run: npm ci
94+
95+
- name: Decrypt secrets
8996
env:
90-
OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
91-
OP_ENV_FILE: .github/secrets.env.tpl
97+
CS_CLIENT_KEY: ${{ secrets.CS_VAULT_CLIENT_KEY }}
98+
CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_VAULT_CLIENT_ACCESS_KEY }}
99+
run: cd scripts && npm run decrypt
92100

93101
- uses: jdx/mise-action@v2
94102
with:

‎.github/workflows/release.yml‎

Lines changed: 26 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,21 @@ jobs:
2323
steps:
2424
- uses: actions/checkout@v4
2525

26-
- name: Load secrets
27-
uses: 1password/load-secrets-action@v3
26+
- uses: actions/setup-node@v4
2827
with:
29-
export-env: true
28+
node-version: '20'
29+
cache: 'npm'
30+
cache-dependency-path: scripts/package-lock.json
31+
32+
- name: Install decrypt dependencies
33+
working-directory: scripts
34+
run: npm ci
35+
36+
- name: Decrypt secrets
3037
env:
31-
OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
32-
OP_ENV_FILE: .github/secrets.env.tpl
38+
CS_CLIENT_KEY: ${{ secrets.CS_VAULT_CLIENT_KEY }}
39+
CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_VAULT_CLIENT_ACCESS_KEY }}
40+
run: cd scripts && npm run decrypt
3341

3442
- name: Setup Rust cache
3543
uses: Swatinem/rust-cache@v2
@@ -103,13 +111,21 @@ jobs:
103111
steps:
104112
- uses: actions/checkout@v4
105113

106-
- name: Load secrets
107-
uses: 1password/load-secrets-action@v3
114+
- uses: actions/setup-node@v4
108115
with:
109-
export-env: true
116+
node-version: '20'
117+
cache: 'npm'
118+
cache-dependency-path: scripts/package-lock.json
119+
120+
- name: Install decrypt dependencies
121+
working-directory: scripts
122+
run: npm ci
123+
124+
- name: Decrypt secrets
110125
env:
111-
OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
112-
OP_ENV_FILE: .github/secrets.env.tpl
126+
CS_CLIENT_KEY: ${{ secrets.CS_VAULT_CLIENT_KEY }}
127+
CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_VAULT_CLIENT_ACCESS_KEY }}
128+
run: cd scripts && npm run decrypt
113129

114130
- name: Download digests
115131
uses: actions/download-artifact@v4

‎.github/workflows/test.yml‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,21 @@ jobs:
1919
- uses: actions/checkout@v4
2020
- uses: ./.github/actions/setup-test
2121

22-
- name: Load secrets
23-
uses: 1password/load-secrets-action@v3
22+
- uses: actions/setup-node@v4
2423
with:
25-
export-env: true
24+
node-version: '20'
25+
cache: 'npm'
26+
cache-dependency-path: scripts/package-lock.json
27+
28+
- name: Install decrypt dependencies
29+
working-directory: scripts
30+
run: npm ci
31+
32+
- name: Decrypt secrets
2633
env:
27-
OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
28-
OP_ENV_FILE: .github/secrets.env.tpl
34+
CS_CLIENT_KEY: ${{ secrets.CS_VAULT_CLIENT_KEY }}
35+
CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_VAULT_CLIENT_ACCESS_KEY }}
36+
run: cd scripts && npm run decrypt
2937

3038
- run: |
3139
mise run postgres:up --extra-args "--detach --wait"
@@ -38,8 +46,3 @@ jobs:
3846
run: |
3947
mise run --output prefix test
4048
41-
- uses: ./.github/actions/send-slack-notification
42-
with:
43-
channel: engineering
44-
webhook_url: ${{ env.SLACK_NOTIFICATION_WEBHOOK_URL }}
45-

‎.gitignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,12 @@ rust-toolchain.toml
1818
# credentials for local dev
1919
.env.proxy.docker
2020

21+
# CI secrets plaintext (never commit actual values)
22+
.github/secrets.env.plaintext
23+
24+
# Node modules (scripts directory)
25+
scripts/node_modules/
26+
2127
## benchmark result data
2228
tests/benchmark/results/*.csv
2329
tests/benchmark/benchmark-*.png

0 commit comments

Comments
 (0)