Skip to content

Conversation

karouf
Copy link
Member

@karouf karouf commented Sep 19, 2025

Transition to Secure GitHub Actions Workflows (STEP-18 Compliance)

As part of our security enhancements, we have done the legwork to migrate approximately 100 of our 420 repositories left to no longer store secrets on GitHub servers, complying with STEP-18. We need your help to finalize this transition.
This change is required by Platform Security for all repositories that use GitHub Actions workflows.

Why This Change?

  • To eliminate the storage of sensitive data on GitHub servers, securing our operations.

What to Do?

  • Review this PR to confirm that your workflows behave as expected with the new secrets handling method.
  • Test the workflows manually if possible, especially on this PR branch.
  • Ensure to merge this PR by 15th September. Past this date, any remaining PRs will be force merged by the Platform Security team.

Need Help?

Next Steps

  • Post-merger, be vigilant for any potential failures and address them promptly to maintain smooth operations.

@karouf
Copy link
Member Author

karouf commented Sep 22, 2025

Compilation issues are not related to the changes made for STEP-18. I can reproduce locally and tried building the Docker image for commit d4d6ae1 which was fine before and it's now failing...

@karouf karouf marked this pull request as ready for review September 22, 2025 08:06
@karouf karouf merged commit 4b8161f into main Sep 22, 2025
5 of 7 checks passed
@karouf karouf deleted the EN-2932-Migrate-secrets-usage-to-STEP-18-for-Doctolib-Org branch September 22, 2025 13:41
karouf added a commit that referenced this pull request Sep 24, 2025
karouf added a commit that referenced this pull request Oct 6, 2025
As discussed with @benassipaul and @bpaquet this repo needs to use an
ARN to push the Docker image but as an org we don't want to expose this
ARN so it will be set up as a GHA secret.

- **Revert "feat(EN-2932): Migrate github secrets to vault (#56)"**
- **Revert "feat(EN-2932): Migrate github secrets to vault (#55)"**
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant