Skip to content

Commit 109e70d

Browse files
pgavlinpgavlin
committed
chore: replace GitHub secrets with ESC
1 parent dde8ebd commit 109e70d

File tree

7 files changed

+109
-34
lines changed

7 files changed

+109
-34
lines changed

‎.github/workflows/pr-tests.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
permissions:
2+
id-token: write
13
name: Run Acceptance Tests from PR
24

35
on:

‎.github/workflows/publish-prerelease.yaml‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,9 @@ on:
55
tags:
66
- v*.*.*-**
77

8-
env:
9-
GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
10-
118
permissions:
12-
contents: write # Needed to publish releases
13-
packages: write # If publishing packages
9+
contents: write # Needed to publish releases
10+
packages: write # If publishing packages
1411
id-token: write
1512
actions: read
1613
attestations: read

‎.github/workflows/publish-release.yaml‎

Lines changed: 34 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,9 @@ on:
66
- v*.*.*
77
- '!v*.*.*-**'
88

9-
env:
10-
GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
11-
129
permissions:
13-
contents: write # Needed to publish releases
14-
packages: write # Needed for publishing packages
10+
contents: write # Needed to publish releases
11+
packages: write # Needed for publishing packages
1512
id-token: write
1613
actions: read
1714
attestations: read
@@ -47,6 +44,21 @@ jobs:
4744
name: s3 blobs
4845
runs-on: ubuntu-latest
4946
steps:
47+
- name: Generate Pulumi Access Token
48+
id: generate_pulumi_token
49+
uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
50+
with:
51+
organization: pulumi
52+
requested-token-type: urn:pulumi:token-type:access_token:organization
53+
export-environment-variables: false
54+
- name: Fetch secrets from ESC
55+
id: esc-secrets
56+
uses: pulumi/esc-action@41fd832f44f4820124b5350b5f84a00f741f234e # v1.3.0
57+
env:
58+
PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
59+
with:
60+
environment: imports/github-secrets
61+
export-environment-variables: false
5062
- name: Checkout Repo
5163
uses: actions/checkout@v3
5264
with:
@@ -60,7 +72,7 @@ jobs:
6072
role-duration-seconds: 3600
6173
role-external-id: upload-pulumi-release
6274
role-session-name: pulumi@githubActions
63-
role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
75+
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_UPLOAD_ROLE_ARN }}
6476
- name: Download release artifacts
6577
run: |
6678
mkdir -p artifacts
@@ -82,14 +94,29 @@ jobs:
8294
- name: Dispatch docs workflow
8395
run-command: pulumictl create cli-docs-build "${{ github.ref_name }}" --event-type "esc-cli"
8496
steps:
97+
- name: Generate Pulumi Access Token
98+
id: generate_pulumi_token
99+
uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
100+
with:
101+
organization: pulumi
102+
requested-token-type: urn:pulumi:token-type:access_token:organization
103+
export-environment-variables: false
104+
- name: Fetch secrets from ESC
105+
id: esc-secrets
106+
uses: pulumi/esc-action@41fd832f44f4820124b5350b5f84a00f741f234e # v1.3.0
107+
env:
108+
PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
109+
with:
110+
environment: imports/github-secrets
111+
export-environment-variables: false
85112
- name: Checkout Repo
86113
uses: actions/checkout@v3
87114
with:
88115
ref: ${{ github.ref_name }}
89116
- name: Install Pulumictl
90117
uses: jaxxstorm/action-install-gh-release@v1.7.1
91118
env:
92-
GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
119+
GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
93120
with:
94121
repo: pulumi/pulumictl
95122
tag: v0.0.45

‎.github/workflows/publish-snapshot.yaml‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,9 @@ on:
88
- 'CHANGELOG_PENDING.md'
99
- 'README.md'
1010

11-
env:
12-
GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
13-
1411
permissions:
15-
contents: write # Needed to publish releases
16-
packages: write # If publishing packages
12+
contents: write # Needed to publish releases
13+
packages: write # If publishing packages
1714
id-token: write
1815
actions: read
1916
attestations: read

‎.github/workflows/stage-lint.yml‎

Lines changed: 33 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,30 @@
1+
permissions:
2+
id-token: write
13
name: Lint
24

35
on:
4-
workflow_call:
5-
6+
workflow_call: null
67
permissions: read-all
78

8-
env:
9-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
10-
119
jobs:
1210
lint:
1311
runs-on: ubuntu-latest
1412
steps:
13+
- name: Generate Pulumi Access Token
14+
id: generate_pulumi_token
15+
uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
16+
with:
17+
organization: pulumi
18+
requested-token-type: urn:pulumi:token-type:access_token:organization
19+
export-environment-variables: false
20+
- name: Fetch secrets from ESC
21+
id: esc-secrets
22+
uses: pulumi/esc-action@41fd832f44f4820124b5350b5f84a00f741f234e # v1.3.0
23+
env:
24+
PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
25+
with:
26+
environment: imports/github-secrets
27+
export-environment-variables: false
1528
- name: Checkout Repo
1629
uses: actions/checkout@v2
1730
- name: Set up Go 1.23
@@ -25,12 +38,6 @@ jobs:
2538
echo "::error go.mod not tidy"
2639
exit 1
2740
fi
28-
29-
# We leverage the golangci-lint action to install
30-
# and maintain the cache,
31-
# but we want to run the command ourselves.
32-
# The action doesn't have an install-only mode,
33-
# so we'll ask it to print its version only.
3441
- name: Install golangci-lint
3542
uses: golangci/golangci-lint-action@v3
3643
with:
@@ -42,6 +49,21 @@ jobs:
4249
check-copyright:
4350
runs-on: ubuntu-latest
4451
steps:
52+
- name: Generate Pulumi Access Token
53+
id: generate_pulumi_token
54+
uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
55+
with:
56+
organization: pulumi
57+
requested-token-type: urn:pulumi:token-type:access_token:organization
58+
export-environment-variables: false
59+
- name: Fetch secrets from ESC
60+
id: esc-secrets
61+
uses: pulumi/esc-action@41fd832f44f4820124b5350b5f84a00f741f234e # v1.3.0
62+
env:
63+
PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
64+
with:
65+
environment: imports/github-secrets
66+
export-environment-variables: false
4567
- name: Checkout Repo
4668
uses: actions/checkout@v2
4769
- name: Install pulumictl

‎.github/workflows/stage-publish.yml‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,30 @@ on:
88
type: string
99

1010
permissions:
11-
contents: write # Needed for publishing releases
12-
packages: write # Needed for publishing packages
13-
14-
env:
15-
GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
11+
contents: write # Needed for publishing releases
12+
packages: write # Needed for publishing packages
13+
id-token: write
1614

1715
jobs:
1816
publish:
1917
name: Publish
2018
runs-on: macos-latest
2119
steps:
20+
- name: Generate Pulumi Access Token
21+
id: generate_pulumi_token
22+
uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
23+
with:
24+
organization: pulumi
25+
requested-token-type: urn:pulumi:token-type:access_token:organization
26+
export-environment-variables: false
27+
- name: Fetch secrets from ESC
28+
id: esc-secrets
29+
uses: pulumi/esc-action@41fd832f44f4820124b5350b5f84a00f741f234e # v1.3.0
30+
env:
31+
PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
32+
with:
33+
environment: imports/github-secrets
34+
export-environment-variables: false
2235
- name: Checkout Repo
2336
uses: actions/checkout@v2
2437
- name: Unshallow clone for tags

‎.github/workflows/stage-test.yml‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
permissions:
2+
id-token: write
13
name: Test
24

35
on:
@@ -22,6 +24,21 @@ jobs:
2224
name: Test
2325
runs-on: ubuntu-latest
2426
steps:
27+
- name: Generate Pulumi Access Token
28+
id: generate_pulumi_token
29+
uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
30+
with:
31+
organization: pulumi
32+
requested-token-type: urn:pulumi:token-type:access_token:organization
33+
export-environment-variables: false
34+
- name: Fetch secrets from ESC
35+
id: esc-secrets
36+
uses: pulumi/esc-action@41fd832f44f4820124b5350b5f84a00f741f234e # v1.3.0
37+
env:
38+
PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
39+
with:
40+
environment: imports/github-secrets
41+
export-environment-variables: false
2542
- name: Checkout Repo
2643
uses: actions/checkout@v2
2744
with:
@@ -45,7 +62,7 @@ jobs:
4562
with:
4663
fail_ci_if_error: false
4764
verbose: true
48-
token: ${{ secrets.CODECOV_TOKEN }}
65+
token: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
4966
strategy:
5067
fail-fast: false
5168
matrix:

0 commit comments

Comments
 (0)