Skip to content

Improve infisical workflow #2206

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
djeebus wants to merge 3 commits into
base: main
Choose a base branch
from
+24 −17
Draft

Improve infisical workflow #2206

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
41c6f7d
improve infisical workflow
djeebus Mar 23, 2026
780de28
Supplement the new env vars with old makefile include
djeebus Mar 23, 2026
c7fb9d6
keep the versions consistent
djeebus Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 18 additions & 11 deletions .github/actions/deploy-setup/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,30 +4,28 @@ inputs:
environment:
description: "Target environment for deployment, e.g. staging"
required: true
infisical_client_id:
description: "Infisical client ID for accessing secrets"
required: true
infisical_client_secret:
description: "Infisical client secret for accessing secrets"
required: true
install_gcloud:
description: "Whether to install the gcloud CLI (needed for gsutil/docker auth)"
required: false
default: "false"
infisical_machine_identity_id:
description: "Infisical machine identity ID for accessing secrets"
required: true

runs:
using: "composite"
steps:
- uses: Infisical/secrets-action@v1.0.9
- name: Pull infisical secrets into temporary file
uses: Infisical/secrets-action@v1.0.15
with:
client-id: ${{ inputs.infisical_client_id }}
client-secret: ${{ inputs.infisical_client_secret }}
env-slug: ${{ inputs.environment }}
method: "oidc"
identity-id: ${{ inputs.infisical_machine_identity_id }}
project-slug: "infra-deployment"
env-slug: ${{ inputs.environment }}
export-type: "file"
file-output-path: "/.env.infisical"

- name: Load Environment Variables
- name: Transform infisical secrets into make include file, load a few as environment variables
id: load-env
run: |
echo ${{ inputs.environment }} > .last_used_env
Expand All @@ -44,6 +42,15 @@ runs:
echo "GH_WORKLOAD_IDENTITY_PROVIDER=${GH_WORKLOAD_IDENTITY_PROVIDER}" >> $GITHUB_ENV
shell: bash

- name: Load environment variables from Infisical
uses: Infisical/secrets-action@v1.0.15
with:
method: "oidc"
identity-id: ${{ inputs.infisical_machine_identity_id }}
project-slug: "infra-deployment-env"
Copy link
Copy Markdown

@claude claude bot Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The project slug changed from infra-deployment to infra-deployment-env. If this slug does not exist in Infisical (or the secrets inside use different key names than before), the action will either fail or export empty values. Downstream steps (google-github-actions/auth, terraform init, all make targets) depend on GCP_PROJECT_ID, GH_WORKLOAD_IDENTITY_PROVIDER, TERRAFORM_STATE_BUCKET, and GCP_REGION being set -- none of these produce obvious errors if missing until they silently fail mid-workflow. Please confirm the new slug is correct and all required keys are present.

env-slug: ${{ inputs.environment }}
export-type: "env"

- name: Setup Service Account
uses: google-github-actions/auth@v2
with:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/build-and-upload-job.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ jobs:
deploy:
name: Build and upload job to the ${{ inputs.environment }} environment
runs-on: ci-builder
environment: ${{ inputs.environment }}
permissions:
contents: read
id-token: write
Expand All @@ -45,9 +46,8 @@ jobs:
uses: ./.github/actions/deploy-setup
with:
environment: ${{ inputs.environment }}
infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
install_gcloud: "true"
infisical_machine_identity_id: ${{ vars.INFISICAL_MACHINE_IDENTITY_ID }}

- name: Set up Docker
env:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/deploy-infra.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ jobs:
deploy:
name: Deploy Infra to the ${{ inputs.environment }} environment
runs-on: ubuntu-22.04
environment: ${{ inputs.environment }}
permissions:
contents: read
id-token: write
Expand All @@ -43,9 +44,8 @@ jobs:
uses: ./.github/actions/deploy-setup
with:
environment: ${{ inputs.environment }}
infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
install_gcloud: "true"
infisical_machine_identity_id: ${{ vars.INFISICAL_MACHINE_IDENTITY_ID }}

- name: Run Terraform state migrations
if: inputs.plan_only == 'false'
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/deploy-job.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ jobs:
deploy:
name: Deploy job to the ${{ inputs.environment }} environment
runs-on: ubuntu-22.04
environment: ${{ inputs.environment }}
permissions:
contents: read
id-token: write
Expand All @@ -46,8 +47,7 @@ jobs:
uses: ./.github/actions/deploy-setup
with:
environment: ${{ inputs.environment }}
infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
infisical_machine_identity_id: ${{ vars.INFISICAL_MACHINE_IDENTITY_ID }}

- name: Run Terraform state migrations
if: inputs.plan_only == 'false'
Expand Down
Loading