From 69cafb65a56d3f34f442385b3cd353fd7700d7db Mon Sep 17 00:00:00 2001 From: Pat Gavlin Date: Thu, 24 Jul 2025 11:54:11 -0600 Subject: [PATCH] These changes migrate this repo's GitHub Actions Workflows to use ESC secrets instead of GitHub Secrets. The changes are largely mechanical: - Common configuration for all ESC actions within a workflow is added to the workflow's environment variables - Permissions are expanded as necessary for workflows that do not grant `id-token: write` permissions - `read-all` permissions are replaced with the union of all explicit read permissions and `id-token: write` - Default permissions are replaced with `write-all`, which is the equivalent of all explicit write permissions and `id-token: write` - Explicit permissions are modified to grant `id-token: write` - A step that fetches ESC secrets and populates environment variables is added to each step that reads secrets - Direct references to secrets within the job are replaced with references to the step's outputs All ESC actions are configured to fetch secrets from a shared ESC environment that contains secrets migrated from GitHub Actions. The ESC action performs its own OIDC exchange to obtain a Pulumi Access Token. --- .github/workflows/add-to-project.yaml | 12 ++++- .github/workflows/command-dispatch.yml | 12 ++++- .github/workflows/test-examples.yml | 64 ++++++++++++++++++-------- 3 files changed, 68 insertions(+), 20 deletions(-) diff --git a/.github/workflows/add-to-project.yaml b/.github/workflows/add-to-project.yaml index c61d54ab4..4fc25a1b3 100644 --- a/.github/workflows/add-to-project.yaml +++ b/.github/workflows/add-to-project.yaml @@ -1,3 +1,10 @@ +permissions: write-all # Equivalent to default permissions plus id-token: write +env: + ESC_ACTION_OIDC_AUTH: true + ESC_ACTION_OIDC_ORGANIZATION: pulumi + ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization + ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false name: Add issues to project on: issues: @@ -8,8 +15,11 @@ jobs: add-to-project: runs-on: ubuntu-latest steps: + - name: Fetch secrets from ESC + id: esc-secrets + uses: pulumi/esc-action@v1 - name: Add to DevRel uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2 with: project-url: https://github.com/orgs/pulumi/projects/47 - github-token: ${{ secrets.PULUMI_BOT_GHA_MARKETING }} + github-token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_GHA_MARKETING }} diff --git a/.github/workflows/command-dispatch.yml b/.github/workflows/command-dispatch.yml index 346b34895..3615a0f2b 100644 --- a/.github/workflows/command-dispatch.yml +++ b/.github/workflows/command-dispatch.yml @@ -1,3 +1,10 @@ +permissions: write-all # Equivalent to default permissions plus id-token: write +env: + ESC_ACTION_OIDC_AUTH: true + ESC_ACTION_OIDC_ORGANIZATION: pulumi + ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization + ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false name: Command dispatch for testing on: issue_comment: @@ -8,6 +15,9 @@ jobs: command-dispatch-for-testing: runs-on: ubuntu-latest steps: + - name: Fetch secrets from ESC + id: esc-secrets + uses: pulumi/esc-action@v1 - name: Checkout Repo uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Run Build @@ -18,4 +28,4 @@ jobs: permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/examples - token: ${{ secrets.EVENT_PAT }} + token: ${{ steps.esc-secrets.outputs.EVENT_PAT }} diff --git a/.github/workflows/test-examples.yml b/.github/workflows/test-examples.yml index c2a580780..1d4ff3cea 100644 --- a/.github/workflows/test-examples.yml +++ b/.github/workflows/test-examples.yml @@ -1,3 +1,10 @@ +permissions: write-all # Equivalent to default permissions plus id-token: write +env: + ESC_ACTION_OIDC_AUTH: true + ESC_ACTION_OIDC_ORGANIZATION: pulumi + ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization + ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false name: Test examples on: pull_request: @@ -18,6 +25,9 @@ jobs: id-token: write contents: read steps: + - name: Fetch secrets from ESC + id: esc-secrets + uses: pulumi/esc-action@v1 - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Set up the environment @@ -26,7 +36,7 @@ jobs: with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }} + aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }} github-token: ${{ secrets.GITHUB_TOKEN }} - name: Lint @@ -40,6 +50,9 @@ jobs: id-token: write contents: read steps: + - name: Fetch secrets from ESC + id: esc-secrets + uses: pulumi/esc-action@v1 - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Set up the environment @@ -48,7 +61,7 @@ jobs: with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }} + aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }} github-token: ${{ secrets.GITHUB_TOKEN }} - name: unit tests @@ -70,7 +83,7 @@ jobs: - name: Set up Python uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: - python-version: 3.9 # Adjust the version as needed + python-version: 3.9 # Adjust the version as needed # Step 3: Install Make (already installed on Ubuntu, but explicit just in case) - name: Ensure Make is Installed @@ -90,6 +103,9 @@ jobs: id-token: write contents: read steps: + - name: Fetch secrets from ESC + id: esc-secrets + uses: pulumi/esc-action@v1 - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Set up the environment @@ -98,7 +114,7 @@ jobs: with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }} + aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }} github-token: ${{ secrets.GITHUB_TOKEN }} - name: unit tests @@ -114,6 +130,9 @@ jobs: id-token: write contents: read steps: + - name: Fetch secrets from ESC + id: esc-secrets + uses: pulumi/esc-action@v1 - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Set up the environment @@ -122,7 +141,7 @@ jobs: with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }} + aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }} github-token: ${{ secrets.GITHUB_TOKEN }} - name: unit tests @@ -136,6 +155,9 @@ jobs: id-token: write contents: read steps: + - name: Fetch secrets from ESC + id: esc-secrets + uses: pulumi/esc-action@v1 - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Set up the environment @@ -144,7 +166,7 @@ jobs: with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }} + aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }} github-token: ${{ secrets.GITHUB_TOKEN }} - name: unit tests @@ -169,13 +191,16 @@ jobs: steps: # Run as first step so we don't delete things that have just been installed + - name: Fetch secrets from ESC + id: esc-secrets + uses: pulumi/esc-action@v1 - name: Free Disk Space (Ubuntu) uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 with: tool-cache: false swap-storage: false dotnet: false - + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Set up the environment @@ -184,7 +209,7 @@ jobs: with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }} + aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }} github-token: ${{ secrets.GITHUB_TOKEN }} - name: Run tests @@ -194,20 +219,20 @@ jobs: AWS_SECRET_ACCESS_KEY: ${{ steps.setup.outputs.aws-secret-access-key }} AWS_SESSION_TOKEN: ${{ steps.setup.outputs.aws-session-token }} AWS_REGION: ${{ steps.setup.outputs.aws-region }} - ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }} - ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }} + ARM_CLIENT_ID: ${{ steps.esc-secrets.outputs.ARM_CLIENT_ID }} + ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }} ARM_ENVIRONMENT: public ARM_LOCATION: westus - ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }} - ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }} + ARM_SUBSCRIPTION_ID: ${{ steps.esc-secrets.outputs.ARM_SUBSCRIPTION_ID }} + ARM_TENANT_ID: ${{ steps.esc-secrets.outputs.ARM_TENANT_ID }} GOOGLE_PROJECT: ${{ steps.setup.outputs.google-project-name }} GOOGLE_REGION: ${{ steps.setup.outputs.google-region }} GOOGLE_ZONE: ${{ steps.setup.outputs.google-zone }} - DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }} - PACKET_AUTH_TOKEN: ${{ secrets.PACKET_AUTH_TOKEN }} - PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }} + DIGITALOCEAN_TOKEN: ${{ steps.esc-secrets.outputs.DIGITALOCEAN_TOKEN }} + PACKET_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.PACKET_AUTH_TOKEN }} + PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }} PULUMI_API: https://api.pulumi-staging.io - SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} + SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }} strategy: fail-fast: false @@ -236,6 +261,9 @@ jobs: contents: read steps: + - name: Fetch secrets from ESC + id: esc-secrets + uses: pulumi/esc-action@v1 - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Set up the environment @@ -244,7 +272,7 @@ jobs: with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }} + aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }} github-token: ${{ secrets.GITHUB_TOKEN }} - name: Set up Minikube @@ -281,6 +309,6 @@ jobs: AWS_SECRET_ACCESS_KEY: ${{ steps.setup.outputs.aws-secret-access-key }} AWS_SESSION_TOKEN: ${{ steps.setup.outputs.aws-session-token }} AWS_REGION: ${{ steps.setup.outputs.aws-region }} - PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }} + PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }} PULUMI_API: https://api.pulumi-staging.io INFRA_STACK_NAME: ${{ github.sha }}-${{ github.run_number }}