Skip to content
This repository was archived by the owner on Sep 22, 2025. It is now read-only.

Commit ef4b531

Browse files
AMBERMW13AMBERMW13
committed
2 parents 6e04c99 + 464734f commit ef4b531

File tree

3 files changed

+95
-10
lines changed

3 files changed

+95
-10
lines changed

‎.github/workflows/promote-staging-to-production.yml‎

Lines changed: 38 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,24 @@ jobs:
1414
steps:
1515
- uses: actions/checkout@v4
1616

17+
- name: Configure AWS credentials for vault access
18+
uses: aws-actions/configure-aws-credentials@v4
19+
with:
20+
role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }}
21+
aws-region: us-east-1
22+
23+
- name: Get secrets from vault
24+
id: vault-secrets
25+
uses: aws-actions/aws-secretsmanager-get-secrets@v2
26+
with:
27+
secret-ids: |
28+
,/vault/liquibase
29+
parse-json-secrets: true
30+
1731
- name: Configure AWS Credentials
1832
uses: aws-actions/configure-aws-credentials@v4
1933
with:
20-
role-to-assume: ${{ secrets.AWS_ADMIN_GITHUB_OIDC_ROLE_ARN_DOCS }}
34+
role-to-assume: ${{ env.AWS_ADMIN_GITHUB_OIDC_ROLE_ARN_DOCS }}
2135
aws-region: us-east-1
2236

2337
- name: Promote Staging Content to Production
@@ -29,27 +43,46 @@ jobs:
2943
permissions: write-all
3044
env:
3145
TF_VAR_env: "prod"
32-
SPACELIFT_API_KEY_ENDPOINT: ${{ secrets.SPACELIFT_API_KEY_ENDPOINT }}
33-
SPACELIFT_API_KEY_ID: ${{ secrets.SPACELIFT_API_KEY_ID }}
34-
SPACELIFT_API_KEY_SECRET: ${{ secrets.SPACELIFT_API_KEY_SECRET }}
3546
defaults:
3647
run:
3748
working-directory: scripts/redirect_creation
3849
steps:
3950
- uses: actions/checkout@v4
4051

52+
- name: Configure AWS credentials for vault access
53+
uses: aws-actions/configure-aws-credentials@v4
54+
with:
55+
role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }}
56+
aws-region: us-east-1
57+
58+
- name: Get secrets from vault
59+
id: vault-secrets
60+
uses: aws-actions/aws-secretsmanager-get-secrets@v2
61+
with:
62+
secret-ids: |
63+
,/vault/liquibase
64+
parse-json-secrets: true
65+
4166
- name: Install spacectl
4267
uses: spacelift-io/setup-spacectl@main
4368
env:
4469
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
70+
SPACELIFT_API_KEY_ENDPOINT: ${{ env.SPACELIFT_API_KEY_ENDPOINT }}
71+
SPACELIFT_API_KEY_ID: ${{ env.SPACELIFT_API_KEY_ID }}
72+
SPACELIFT_API_KEY_SECRET: ${{ env.SPACELIFT_API_KEY_SECRET }}
4573

4674
- name: Configure AWS Credentials
4775
uses: aws-actions/configure-aws-credentials@v4
4876
with:
49-
role-to-assume: ${{ secrets.AWS_ADMIN_GITHUB_OIDC_ROLE_ARN_DOCS }}
77+
role-to-assume: ${{ env.AWS_ADMIN_GITHUB_OIDC_ROLE_ARN_DOCS }}
5078
aws-region: us-east-1
5179

5280
- name: Deploy infrastructure
81+
env:
82+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
83+
SPACELIFT_API_KEY_ENDPOINT: ${{ env.SPACELIFT_API_KEY_ENDPOINT }}
84+
SPACELIFT_API_KEY_ID: ${{ env.SPACELIFT_API_KEY_ID }}
85+
SPACELIFT_API_KEY_SECRET: ${{ env.SPACELIFT_API_KEY_SECRET }}
5386
run: |
5487
spacectl stack set-current-commit --id liquibase-docs-prod --sha ${{ github.sha }}
5588
spacectl stack deploy --id liquibase-docs-prod --auto-confirm

‎.github/workflows/send-docs-redirects-to-staging.yml‎

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,7 @@ jobs:
1818
permissions: write-all
1919
env:
2020
TF_VAR_env: "staging"
21-
SPACELIFT_API_KEY_ENDPOINT: ${{ secrets.SPACELIFT_API_KEY_ENDPOINT }}
22-
SPACELIFT_API_KEY_ID: ${{ secrets.SPACELIFT_API_KEY_ID }}
23-
SPACELIFT_API_KEY_SECRET: ${{ secrets.SPACELIFT_API_KEY_SECRET }}
21+
2422
defaults:
2523
run:
2624
working-directory: scripts/redirect_creation
@@ -30,15 +28,32 @@ jobs:
3028
with:
3129
ref: ${{ github.event.inputs.branch }}
3230

31+
- name: Configure AWS credentials for vault access
32+
uses: aws-actions/configure-aws-credentials@v4
33+
with:
34+
role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }}
35+
aws-region: us-east-1
36+
37+
- name: Get secrets from vault
38+
id: vault-secrets
39+
uses: aws-actions/aws-secretsmanager-get-secrets@v2
40+
with:
41+
secret-ids: |
42+
,/vault/liquibase
43+
parse-json-secrets: true
44+
3345
- name: Install spacectl
3446
uses: spacelift-io/setup-spacectl@main
3547
env:
3648
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
49+
SPACELIFT_API_KEY_ENDPOINT: ${{ env.SPACELIFT_API_KEY_ENDPOINT }}
50+
SPACELIFT_API_KEY_ID: ${{ env.SPACELIFT_API_KEY_ID }}
51+
SPACELIFT_API_KEY_SECRET: ${{ env.SPACELIFT_API_KEY_SECRET }}
3752

3853
- name: Configure AWS Credentials
3954
uses: aws-actions/configure-aws-credentials@v4
4055
with:
41-
role-to-assume: ${{ secrets.AWS_ADMIN_GITHUB_OIDC_ROLE_ARN_DOCS }}
56+
role-to-assume: ${{ env.AWS_ADMIN_GITHUB_OIDC_ROLE_ARN_DOCS }}
4257
aws-region: us-east-1
4358

4459
- name: Check website redirects format
@@ -73,6 +88,11 @@ jobs:
7388
run: terraform validate -no-color
7489

7590
- name: Preview infrastructure
91+
env:
92+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
93+
SPACELIFT_API_KEY_ENDPOINT: ${{ env.SPACELIFT_API_KEY_ENDPOINT }}
94+
SPACELIFT_API_KEY_ID: ${{ env.SPACELIFT_API_KEY_ID }}
95+
SPACELIFT_API_KEY_SECRET: ${{ env.SPACELIFT_API_KEY_SECRET }}
7696
run: |
7797
spacectl stack local-preview --id liquibase-docs-staging > ${GITHUB_WORKSPACE}/plan.out
7898
cat ${GITHUB_WORKSPACE}/plan.out
@@ -123,6 +143,11 @@ jobs:
123143
124144
- name: Deploy infrastructure
125145
if: ${{ github.event_name == 'push' }}
146+
env:
147+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
148+
SPACELIFT_API_KEY_ENDPOINT: ${{ env.SPACELIFT_API_KEY_ENDPOINT }}
149+
SPACELIFT_API_KEY_ID: ${{ env.SPACELIFT_API_KEY_ID }}
150+
SPACELIFT_API_KEY_SECRET: ${{ env.SPACELIFT_API_KEY_SECRET }}
126151
run: |
127152
spacectl stack set-current-commit --id liquibase-docs-staging --sha ${{ github.sha }}
128153
spacectl stack deploy --id liquibase-docs-staging --auto-confirm

‎.github/workflows/send-enterprise-redirects-to-staging.yml‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,15 +27,32 @@ jobs:
2727
with:
2828
ref: ${{ github.event.inputs.branch }}
2929

30+
- name: Configure AWS credentials for vault access
31+
uses: aws-actions/configure-aws-credentials@v4
32+
with:
33+
role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }}
34+
aws-region: us-east-1
35+
36+
- name: Get secrets from vault
37+
id: vault-secrets
38+
uses: aws-actions/aws-secretsmanager-get-secrets@v2
39+
with:
40+
secret-ids: |
41+
,/vault/liquibase
42+
parse-json-secrets: true
43+
3044
- name: Install spacectl
3145
uses: spacelift-io/setup-spacectl@main
3246
env:
3347
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
48+
SPACELIFT_API_KEY_ENDPOINT: ${{ env.SPACELIFT_API_KEY_ENDPOINT }}
49+
SPACELIFT_API_KEY_ID: ${{ env.SPACELIFT_API_KEY_ID }}
50+
SPACELIFT_API_KEY_SECRET: ${{ env.SPACELIFT_API_KEY_SECRET }}
3451

3552
- name: Configure AWS Credentials
3653
uses: aws-actions/configure-aws-credentials@v4
3754
with:
38-
role-to-assume: ${{ secrets.AWS_ADMIN_GITHUB_OIDC_ROLE_ARN_DOCS }}
55+
role-to-assume: ${{ env.AWS_ADMIN_GITHUB_OIDC_ROLE_ARN_DOCS }}
3956
aws-region: us-east-1
4057

4158
- name: Check website redirects format
@@ -70,6 +87,11 @@ jobs:
7087
run: terraform validate -no-color
7188

7289
- name: Preview infrastructure
90+
env:
91+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
92+
SPACELIFT_API_KEY_ENDPOINT: ${{ env.SPACELIFT_API_KEY_ENDPOINT }}
93+
SPACELIFT_API_KEY_ID: ${{ env.SPACELIFT_API_KEY_ID }}
94+
SPACELIFT_API_KEY_SECRET: ${{ env.SPACELIFT_API_KEY_SECRET }}
7395
run: |
7496
spacectl stack local-preview --id liquibase-docs-staging > ${GITHUB_WORKSPACE}/plan.out
7597
cat ${GITHUB_WORKSPACE}/plan.out
@@ -120,6 +142,11 @@ jobs:
120142
121143
- name: Deploy infrastructure
122144
if: ${{ github.event_name == 'push' }}
145+
env:
146+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
147+
SPACELIFT_API_KEY_ENDPOINT: ${{ env.SPACELIFT_API_KEY_ENDPOINT }}
148+
SPACELIFT_API_KEY_ID: ${{ env.SPACELIFT_API_KEY_ID }}
149+
SPACELIFT_API_KEY_SECRET: ${{ env.SPACELIFT_API_KEY_SECRET }}
123150
run: |
124151
spacectl stack set-current-commit --id liquibase-docs-staging --sha ${{ github.sha }}
125152
spacectl stack deploy --id liquibase-docs-staging --auto-confirm

0 commit comments

Comments
 (0)