Skip to content

Commit f02cafd

Browse files
tnevrlkatnevrlka
committed
Handle variables in CI workflow definitions
Previously, all environment variables were handled as secrets and handled as such in CI workflow definitions. Handle both variables and secrets in Jenkinsfile and GitHub Actions workflow generation templates. GitLab should not be affected due to a different way of handling variables. Signed-off-by: Tomáš Nevrlka <[email protected]>
1 parent 92b3d9b commit f02cafd

File tree

10 files changed

+241
-105
lines changed

10 files changed

+241
-105
lines changed

‎generated/gitops-template/githubactions/.github/workflows/gitops-promotion.yml

Lines changed: 61 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -15,28 +15,30 @@ env:
1515
IMAGE_REGISTRY: ${{ secrets.IMAGE_REGISTRY }}
1616

1717
# Used to verify the image signature and attestation
18-
COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
18+
COSIGN_PUBLIC_KEY: ${{ vars.COSIGN_PUBLIC_KEY }}
1919
# URL of the BOMbastic api host (e.g. https://sbom.trustification.dev)
20-
TRUSTIFICATION_BOMBASTIC_API_URL: ${{ secrets.TRUSTIFICATION_BOMBASTIC_API_URL }}
20+
TRUSTIFICATION_BOMBASTIC_API_URL: ${{ vars.TRUSTIFICATION_BOMBASTIC_API_URL }}
2121
# URL of the OIDC token issuer (e.g. https://sso.trustification.dev/realms/chicken)
22-
TRUSTIFICATION_OIDC_ISSUER_URL: ${{ secrets.TRUSTIFICATION_OIDC_ISSUER_URL }}
23-
TRUSTIFICATION_OIDC_CLIENT_ID: ${{ secrets.TRUSTIFICATION_OIDC_CLIENT_ID }}
24-
TRUSTIFICATION_OIDC_CLIENT_SECRET: ${{ secrets.TRUSTIFICATION_OIDC_CLIENT_SECRET }}
25-
TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION: ${{ secrets.TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION }}
22+
TRUSTIFICATION_OIDC_ISSUER_URL: ${{ vars.TRUSTIFICATION_OIDC_ISSUER_URL }}
23+
TRUSTIFICATION_OIDC_CLIENT_ID: ${{ vars.TRUSTIFICATION_OIDC_CLIENT_ID }}
24+
TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION: ${{ vars.TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION }}
2625
# Set this to the user for your specific registry
27-
IMAGE_REGISTRY_USER: ${{ secrets.IMAGE_REGISTRY_USER }}
28-
# Set this password for your specific registry
29-
IMAGE_REGISTRY_PASSWORD: ${{ secrets.IMAGE_REGISTRY_PASSWORD }}
26+
IMAGE_REGISTRY_USER: ${{ vars.IMAGE_REGISTRY_USER }}
3027
# Set this only when using an external Rekor instance
31-
# REKOR_HOST: ${{ secrets.REKOR_HOST }}
28+
REKOR_HOST: ${{ vars.REKOR_HOST }}
3229
# Set this only when using an external TUF instance
33-
# TUF_MIRROR: ${{ secrets.TUF_MIRROR }}
34-
# QUAY_IO_CREDS_USR: ${{ secrets.QUAY_IO_CREDS_USR }}
30+
TUF_MIRROR: ${{ vars.TUF_MIRROR }}
31+
# QUAY_IO_CREDS_USR: ${{ vars.QUAY_IO_CREDS_USR }}
32+
# ARTIFACTORY_IO_CREDS_USR: ${{ vars.ARTIFACTORY_IO_CREDS_USR }}
33+
# NEXUS_IO_CREDS_USR: ${{ vars.NEXUS_IO_CREDS_USR }}
34+
# Secrets
35+
TRUSTIFICATION_OIDC_CLIENT_SECRET: ${{ secrets.TRUSTIFICATION_OIDC_CLIENT_SECRET }}
36+
# Set this password for your specific registry
37+
IMAGE_REGISTRY_PASSWORD: ${{ secrets.IMAGE_REGISTRY_PASSWORD }}
3538
# QUAY_IO_CREDS_PSW: ${{ secrets.QUAY_IO_CREDS_PSW }}
36-
# ARTIFACTORY_IO_CREDS_USR: ${{ secrets.ARTIFACTORY_IO_CREDS_USR }}
3739
# ARTIFACTORY_IO_CREDS_PSW: ${{ secrets.ARTIFACTORY_IO_CREDS_PSW }}
38-
# NEXUS_IO_CREDS_USR: ${{ secrets.NEXUS_IO_CREDS_USR }}
3940
# NEXUS_IO_CREDS_PSW: ${{ secrets.NEXUS_IO_CREDS_PSW }}
41+
4042

4143
# 🖊️ EDIT to specify custom tags for the container image, or default tags will be generated below.
4244
IMAGE_TAGS: ""
@@ -60,33 +62,47 @@ jobs:
6062
uses: actions/github-script@v7
6163
with:
6264
script: |
63-
const secrets = {
64-
IMAGE_REGISTRY: `${{ secrets.IMAGE_REGISTRY }}`,
65+
const vars = {
66+
IMAGE_REGISTRY: `${{ vars.IMAGE_REGISTRY }}`,
6567
6668
/* Used to verify the image signature and attestation */
67-
COSIGN_PUBLIC_KEY: `${{ secrets.COSIGN_PUBLIC_KEY }}`,
69+
COSIGN_PUBLIC_KEY: `${{ vars.COSIGN_PUBLIC_KEY }}`,
6870
/* URL of the BOMbastic api host (e.g. https://sbom.trustification.dev) */
69-
TRUSTIFICATION_BOMBASTIC_API_URL: `${{ secrets.TRUSTIFICATION_BOMBASTIC_API_URL }}`,
71+
TRUSTIFICATION_BOMBASTIC_API_URL: `${{ vars.TRUSTIFICATION_BOMBASTIC_API_URL }}`,
7072
/* URL of the OIDC token issuer (e.g. https://sso.trustification.dev/realms/chicken) */
71-
TRUSTIFICATION_OIDC_ISSUER_URL: `${{ secrets.TRUSTIFICATION_OIDC_ISSUER_URL }}`,
72-
TRUSTIFICATION_OIDC_CLIENT_ID: `${{ secrets.TRUSTIFICATION_OIDC_CLIENT_ID }}`,
73-
TRUSTIFICATION_OIDC_CLIENT_SECRET: `${{ secrets.TRUSTIFICATION_OIDC_CLIENT_SECRET }}`,
74-
TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION: `${{ secrets.TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION }}`,
73+
TRUSTIFICATION_OIDC_ISSUER_URL: `${{ vars.TRUSTIFICATION_OIDC_ISSUER_URL }}`,
74+
TRUSTIFICATION_OIDC_CLIENT_ID: `${{ vars.TRUSTIFICATION_OIDC_CLIENT_ID }}`,
75+
TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION: `${{ vars.TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION }}`,
7576
/* Set this to the user for your specific registry */
76-
IMAGE_REGISTRY_USER: `${{ secrets.IMAGE_REGISTRY_USER }}`,
77-
/* Set this password for your specific registry */
78-
IMAGE_REGISTRY_PASSWORD: `${{ secrets.IMAGE_REGISTRY_PASSWORD }}`,
77+
IMAGE_REGISTRY_USER: `${{ vars.IMAGE_REGISTRY_USER }}`,
7978
/* Set this only when using an external Rekor instance */
80-
/*REKOR_HOST: `${{ secrets.REKOR_HOST }}`, */
79+
REKOR_HOST: `${{ vars.REKOR_HOST }}`,
8180
/* Set this only when using an external TUF instance */
82-
/*TUF_MIRROR: `${{ secrets.TUF_MIRROR }}`, */
83-
/*QUAY_IO_CREDS_USR: `${{ secrets.QUAY_IO_CREDS_USR }}`, */
81+
TUF_MIRROR: `${{ vars.TUF_MIRROR }}`,
82+
/*QUAY_IO_CREDS_USR: `${{ vars.QUAY_IO_CREDS_USR }}`, */
83+
/*ARTIFACTORY_IO_CREDS_USR: `${{ vars.ARTIFACTORY_IO_CREDS_USR }}`, */
84+
/*NEXUS_IO_CREDS_USR: `${{ vars.NEXUS_IO_CREDS_USR }}`, */
85+
};
86+
87+
const missingVars = Object.entries(vars).filter(([ name, value ]) => {
88+
if (value.length === 0) {
89+
core.error(`Variable "${name}" is not set`);
90+
return true;
91+
}
92+
core.info(`✔️ Variable "${name}" is set`);
93+
return false;
94+
});
95+
96+
const secrets = {
97+
98+
TRUSTIFICATION_OIDC_CLIENT_SECRET: `${{ secrets.TRUSTIFICATION_OIDC_CLIENT_SECRET }}`,
99+
/* Set this password for your specific registry */
100+
IMAGE_REGISTRY_PASSWORD: `${{ secrets.IMAGE_REGISTRY_PASSWORD }}`,
84101
/*QUAY_IO_CREDS_PSW: `${{ secrets.QUAY_IO_CREDS_PSW }}`, */
85-
/*ARTIFACTORY_IO_CREDS_USR: `${{ secrets.ARTIFACTORY_IO_CREDS_USR }}`, */
86102
/*ARTIFACTORY_IO_CREDS_PSW: `${{ secrets.ARTIFACTORY_IO_CREDS_PSW }}`, */
87-
/*NEXUS_IO_CREDS_USR: `${{ secrets.NEXUS_IO_CREDS_USR }}`, */
88103
/*NEXUS_IO_CREDS_PSW: `${{ secrets.NEXUS_IO_CREDS_PSW }}`, */
89104
};
105+
90106
const missingSecrets = Object.entries(secrets).filter(([ name, value ]) => {
91107
if (value.length === 0) {
92108
core.error(`Secret "${name}" is not set`);
@@ -95,15 +111,27 @@ jobs:
95111
core.info(`✔️ Secret "${name}" is set`);
96112
return false;
97113
});
114+
115+
if (missingVars.length > 0) {
116+
core.error(`❌ At least one required variable is not set in the repository. \n` +
117+
"You can add it using:\n" +
118+
"GitHub UI: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables#creating-configuration-variables-for-a-repository \n" +
119+
"GitHub CLI: https://cli.github.com/manual/gh_variable_set \n" +
120+
"Also, refer to https://github.com/redhat-actions/oc-login#getting-started-with-the-action-or-see-example");
121+
}
122+
98123
if (missingSecrets.length > 0) {
99-
core.setFailed(`❌ At least one required secret is not set in the repository. \n` +
124+
core.error(`❌ At least one required secret is not set in the repository. \n` +
100125
"You can add it using:\n" +
101126
"GitHub UI: https://docs.github.com/en/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository \n" +
102127
"GitHub CLI: https://cli.github.com/manual/gh_secret_set \n" +
103128
"Also, refer to https://github.com/redhat-actions/oc-login#getting-started-with-the-action-or-see-example");
104129
}
105-
else {
106-
core.info(`✅ All the required secrets are set`);
130+
131+
if (missingVars.length > 0 || missingSecrets.length > 0) {
132+
core.setFailed()
133+
} else {
134+
core.info(`✅ All the required variables and secrets are set`);
107135
}
108136
- name: Check out repository
109137
uses: actions/checkout@v4

‎generated/gitops-template/jenkins/Jenkinsfile

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,19 +17,19 @@ pipeline {
1717
/* URL of the OIDC token issuer (e.g. https://sso.trustification.dev/realms/chicken) */
1818
TRUSTIFICATION_OIDC_ISSUER_URL = credentials('TRUSTIFICATION_OIDC_ISSUER_URL')
1919
TRUSTIFICATION_OIDC_CLIENT_ID = credentials('TRUSTIFICATION_OIDC_CLIENT_ID')
20-
TRUSTIFICATION_OIDC_CLIENT_SECRET = credentials('TRUSTIFICATION_OIDC_CLIENT_SECRET')
2120
TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION = credentials('TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION')
21+
/* Set when using Jenkins on non-local cluster and using an external Rekor instance */
22+
/* REKOR_HOST = credentials('REKOR_HOST') */
23+
/* Set when using Jenkins on non-local cluster and using an external TUF instance */
24+
/* TUF_MIRROR = credentials('TUF_MIRROR') */
2225
/* Set this to the user for your specific registry */
2326
/* IMAGE_REGISTRY_USER = credentials('IMAGE_REGISTRY_USER') */
27+
TRUSTIFICATION_OIDC_CLIENT_SECRET = credentials('TRUSTIFICATION_OIDC_CLIENT_SECRET')
2428
/* Set this password for your specific registry */
2529
/* IMAGE_REGISTRY_PASSWORD = credentials('IMAGE_REGISTRY_PASSWORD') */
2630
QUAY_IO_CREDS = credentials('QUAY_IO_CREDS')
2731
/* ARTIFACTORY_IO_CREDS = credentials('ARTIFACTORY_IO_CREDS') */
2832
/* NEXUS_IO_CREDS = credentials('NEXUS_IO_CREDS') */
29-
/* Set when using Jenkins on non-local cluster and using an external Rekor instance */
30-
/* REKOR_HOST = credentials('REKOR_HOST') */
31-
/* Set when using Jenkins on non-local cluster and using an external TUF instance */
32-
/* TUF_MIRROR = credentials('TUF_MIRROR') */
3333
}
3434
stages {
3535
stage('Verify EC') {

‎generated/source-repo/githubactions/.github/workflows/build-and-update-gitops.yml

Lines changed: 62 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -11,31 +11,36 @@ env:
1111
CI_TYPE: github
1212

1313
# 🖊️ EDIT to change the image registry settings.
14-
# Registries such as GHCR, Quay.io, and Docker Hub are supported.
15-
IMAGE_REGISTRY: ${{ secrets.IMAGE_REGISTRY }}
1614

15+
# Vars
16+
17+
18+
ROX_CENTRAL_ENDPOINT: ${{ vars.ROX_CENTRAL_ENDPOINT }}
19+
# GITOPS_AUTH_USERNAME: ${{ vars.GITOPS_AUTH_USERNAME }}
20+
# Set this to the user for your specific registry
21+
IMAGE_REGISTRY_USER: ${{ vars.IMAGE_REGISTRY_USER }}
22+
# Set this only when using an external Rekor instance
23+
REKOR_HOST: ${{ vars.REKOR_HOST }}
24+
# Set this only when using an external TUF instance
25+
TUF_MIRROR: ${{ vars.TUF_MIRROR }}
26+
# QUAY_IO_CREDS_USR: ${{ vars.QUAY_IO_CREDS_USR }}
27+
# ARTIFACTORY_IO_CREDS_USR: ${{ vars.ARTIFACTORY_IO_CREDS_USR }}
28+
# NEXUS_IO_CREDS_USR: ${{ vars.NEXUS_IO_CREDS_USR }}
29+
COSIGN_PUBLIC_KEY: ${{ vars.COSIGN_PUBLIC_KEY }}
30+
# Secrets
1731
ROX_API_TOKEN: ${{ secrets.ROX_API_TOKEN }}
18-
ROX_CENTRAL_ENDPOINT: ${{ secrets.ROX_CENTRAL_ENDPOINT }}
1932
GITOPS_AUTH_PASSWORD: ${{ secrets.GITOPS_AUTH_PASSWORD }}
20-
# Uncomment this when using Gitlab
21-
# GITOPS_AUTH_USERNAME: ${{ secrets.GITOPS_AUTH_USERNAME }}
22-
# Set this to the user for your specific registry
23-
IMAGE_REGISTRY_USER: ${{ secrets.IMAGE_REGISTRY_USER }}
2433
# Set this password for your specific registry
2534
IMAGE_REGISTRY_PASSWORD: ${{ secrets.IMAGE_REGISTRY_PASSWORD }}
26-
# Set this only when using an external Rekor instance
27-
# REKOR_HOST: ${{ secrets.REKOR_HOST }}
28-
# Set this only when using an external TUF instance
29-
# TUF_MIRROR: ${{ secrets.TUF_MIRROR }}
30-
# QUAY_IO_CREDS_USR: ${{ secrets.QUAY_IO_CREDS_USR }}
3135
# QUAY_IO_CREDS_PSW: ${{ secrets.QUAY_IO_CREDS_PSW }}
32-
# ARTIFACTORY_IO_CREDS_USR: ${{ secrets.ARTIFACTORY_IO_CREDS_USR }}
3336
# ARTIFACTORY_IO_CREDS_PSW: ${{ secrets.ARTIFACTORY_IO_CREDS_PSW }}
34-
# NEXUS_IO_CREDS_USR: ${{ secrets.NEXUS_IO_CREDS_USR }}
3537
# NEXUS_IO_CREDS_PSW: ${{ secrets.NEXUS_IO_CREDS_PSW }}
3638
COSIGN_SECRET_PASSWORD: ${{ secrets.COSIGN_SECRET_PASSWORD }}
3739
COSIGN_SECRET_KEY: ${{ secrets.COSIGN_SECRET_KEY }}
38-
COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
40+
41+
42+
# Registries such as GHCR, Quay.io, and Docker Hub are supported.
43+
IMAGE_REGISTRY: ${{ secrets.IMAGE_REGISTRY }}
3944

4045
# 🖊️ EDIT to specify custom tags for the container image, or default tags will be generated below.
4146
IMAGE_TAGS: ""
@@ -65,33 +70,45 @@ jobs:
6570
uses: actions/github-script@v7
6671
with:
6772
script: |
73+
const vars = {
74+
IMAGE_REGISTRY: `${{ vars.IMAGE_REGISTRY }}`,
75+
76+
ROX_CENTRAL_ENDPOINT: `${{ vars.ROX_CENTRAL_ENDPOINT }}`,
77+
/*GITOPS_AUTH_USERNAME: `${{ vars.GITOPS_AUTH_USERNAME }}`, */
78+
/* Set this to the user for your specific registry */
79+
IMAGE_REGISTRY_USER: `${{ vars.IMAGE_REGISTRY_USER }}`,
80+
/* Set this only when using an external Rekor instance */
81+
REKOR_HOST: `${{ vars.REKOR_HOST }}`,
82+
/* Set this only when using an external TUF instance */
83+
TUF_MIRROR: `${{ vars.TUF_MIRROR }}`,
84+
/*QUAY_IO_CREDS_USR: `${{ vars.QUAY_IO_CREDS_USR }}`, */
85+
/*ARTIFACTORY_IO_CREDS_USR: `${{ vars.ARTIFACTORY_IO_CREDS_USR }}`, */
86+
/*NEXUS_IO_CREDS_USR: `${{ vars.NEXUS_IO_CREDS_USR }}`, */
87+
COSIGN_PUBLIC_KEY: `${{ vars.COSIGN_PUBLIC_KEY }}`,
88+
};
89+
90+
const missingVars = Object.entries(vars).filter(([ name, value ]) => {
91+
if (value.length === 0) {
92+
core.error(`Variable "${name}" is not set`);
93+
return true;
94+
}
95+
core.info(`✔️ Variable "${name}" is set`);
96+
return false;
97+
});
98+
6899
const secrets = {
69-
IMAGE_REGISTRY: `${{ secrets.IMAGE_REGISTRY }}`,
70100
71101
ROX_API_TOKEN: `${{ secrets.ROX_API_TOKEN }}`,
72-
ROX_CENTRAL_ENDPOINT: `${{ secrets.ROX_CENTRAL_ENDPOINT }}`,
73102
GITOPS_AUTH_PASSWORD: `${{ secrets.GITOPS_AUTH_PASSWORD }}`,
74-
/* Uncomment this when using Gitlab */
75-
/*GITOPS_AUTH_USERNAME: `${{ secrets.GITOPS_AUTH_USERNAME }}`, */
76-
/* Set this to the user for your specific registry */
77-
IMAGE_REGISTRY_USER: `${{ secrets.IMAGE_REGISTRY_USER }}`,
78103
/* Set this password for your specific registry */
79104
IMAGE_REGISTRY_PASSWORD: `${{ secrets.IMAGE_REGISTRY_PASSWORD }}`,
80-
/* Set this only when using an external Rekor instance */
81-
/*REKOR_HOST: `${{ secrets.REKOR_HOST }}`, */
82-
/* Set this only when using an external TUF instance */
83-
/*TUF_MIRROR: `${{ secrets.TUF_MIRROR }}`, */
84-
/*QUAY_IO_CREDS_USR: `${{ secrets.QUAY_IO_CREDS_USR }}`, */
85105
/*QUAY_IO_CREDS_PSW: `${{ secrets.QUAY_IO_CREDS_PSW }}`, */
86-
/*ARTIFACTORY_IO_CREDS_USR: `${{ secrets.ARTIFACTORY_IO_CREDS_USR }}`, */
87106
/*ARTIFACTORY_IO_CREDS_PSW: `${{ secrets.ARTIFACTORY_IO_CREDS_PSW }}`, */
88-
/*NEXUS_IO_CREDS_USR: `${{ secrets.NEXUS_IO_CREDS_USR }}`, */
89107
/*NEXUS_IO_CREDS_PSW: `${{ secrets.NEXUS_IO_CREDS_PSW }}`, */
90108
COSIGN_SECRET_PASSWORD: `${{ secrets.COSIGN_SECRET_PASSWORD }}`,
91109
COSIGN_SECRET_KEY: `${{ secrets.COSIGN_SECRET_KEY }}`,
92-
COSIGN_PUBLIC_KEY: `${{ secrets.COSIGN_PUBLIC_KEY }}`,
93-
94110
};
111+
95112
const missingSecrets = Object.entries(secrets).filter(([ name, value ]) => {
96113
if (value.length === 0) {
97114
core.error(`Secret "${name}" is not set`);
@@ -100,15 +117,27 @@ jobs:
100117
core.info(`✔️ Secret "${name}" is set`);
101118
return false;
102119
});
120+
121+
if (missingVars.length > 0) {
122+
core.error(`❌ At least one required variable is not set in the repository. \n` +
123+
"You can add it using:\n" +
124+
"GitHub UI: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables#creating-configuration-variables-for-a-repository \n" +
125+
"GitHub CLI: https://cli.github.com/manual/gh_variable_set \n" +
126+
"Also, refer to https://github.com/redhat-actions/oc-login#getting-started-with-the-action-or-see-example");
127+
}
128+
103129
if (missingSecrets.length > 0) {
104-
core.setFailed(`❌ At least one required secret is not set in the repository. \n` +
130+
core.error(`❌ At least one required secret is not set in the repository. \n` +
105131
"You can add it using:\n" +
106132
"GitHub UI: https://docs.github.com/en/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository \n" +
107133
"GitHub CLI: https://cli.github.com/manual/gh_secret_set \n" +
108134
"Also, refer to https://github.com/redhat-actions/oc-login#getting-started-with-the-action-or-see-example");
109135
}
110-
else {
111-
core.info(`✅ All the required secrets are set`);
136+
137+
if (missingVars.length > 0 || missingSecrets.length > 0) {
138+
core.setFailed()
139+
} else {
140+
core.info(`✅ All the required variables and secrets are set`);
112141
}
113142
- name: Check out repository
114143
uses: actions/checkout@v4

‎generated/source-repo/jenkins/Jenkinsfile

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,7 @@ pipeline {
88
agent any
99
environment {
1010
ROX_API_TOKEN = credentials('ROX_API_TOKEN')
11-
ROX_CENTRAL_ENDPOINT = credentials('ROX_CENTRAL_ENDPOINT')
1211
GITOPS_AUTH_PASSWORD = credentials('GITOPS_AUTH_PASSWORD')
13-
/* Uncomment this when using Gitlab */
14-
/* GITOPS_AUTH_USERNAME = credentials('GITOPS_AUTH_USERNAME') */
15-
/* Set this to the user for your specific registry */
16-
/* IMAGE_REGISTRY_USER = credentials('IMAGE_REGISTRY_USER') */
1712
/* Set this password for your specific registry */
1813
/* IMAGE_REGISTRY_PASSWORD = credentials('IMAGE_REGISTRY_PASSWORD') */
1914
/* Default registry is set to quay.io */
@@ -22,11 +17,6 @@ pipeline {
2217
/* NEXUS_IO_CREDS = credentials('NEXUS_IO_CREDS') */
2318
COSIGN_SECRET_PASSWORD = credentials('COSIGN_SECRET_PASSWORD')
2419
COSIGN_SECRET_KEY = credentials('COSIGN_SECRET_KEY')
25-
COSIGN_PUBLIC_KEY = credentials('COSIGN_PUBLIC_KEY')
26-
/* Set when using Jenkins on non-local cluster and using an external Rekor instance */
27-
/* REKOR_HOST = credentials('REKOR_HOST') */
28-
/* Set when using Jenkins on non-local cluster and using an external TUF instance */
29-
/* TUF_MIRROR = credentials('TUF_MIRROR') */
3020
}
3121
stages {
3222
stage('init') {

‎templates/gitops-template/Jenkinsfile.njk

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ pipeline {
88
/* Not used but init.sh will fail if they're missing */
99
COSIGN_SECRET_PASSWORD = 'dummy'
1010
COSIGN_SECRET_KEY = 'dummy'
11+
{%- for secret in gitops_variables -%}
12+
{%- include "jenkins-secret.njk" -%}
13+
{%- endfor %}
1114
{%- for secret in gitops_secrets -%}
1215
{%- include "jenkins-secret.njk" -%}
1316
{%- endfor %}

0 commit comments

Comments
 (0)