Skip to content

Commit 4298a09

Browse files
pgavlinpgavlin
committed
Use ESC secrets
1 parent d335fa8 commit 4298a09

File tree

3 files changed

+71
-20
lines changed

3 files changed

+71
-20
lines changed

‎.github/workflows/add-to-project.yaml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
permissions:
2+
id-token: write
13
name: Add issues to project
24
on:
35
issues:
@@ -8,8 +10,17 @@ jobs:
810
add-to-project:
911
runs-on: ubuntu-latest
1012
steps:
13+
- name: Fetch secrets from ESC
14+
id: esc-secrets
15+
uses: pulumi/esc-action@v1
1116
- name: Add to DevRel
1217
uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
1318
with:
1419
project-url: https://github.com/orgs/pulumi/projects/47
15-
github-token: ${{ secrets.PULUMI_BOT_GHA_MARKETING }}
20+
github-token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_GHA_MARKETING }}
21+
env:
22+
ESC_ACTION_OIDC_AUTH: true
23+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
24+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
25+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
26+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false

‎.github/workflows/command-dispatch.yml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
permissions:
2+
id-token: write
13
name: Command dispatch for testing
24
on:
35
issue_comment:
@@ -8,6 +10,9 @@ jobs:
810
command-dispatch-for-testing:
911
runs-on: ubuntu-latest
1012
steps:
13+
- name: Fetch secrets from ESC
14+
id: esc-secrets
15+
uses: pulumi/esc-action@v1
1116
- name: Checkout Repo
1217
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
1318
- name: Run Build
@@ -18,4 +23,10 @@ jobs:
1823
permission: write
1924
reaction-token: ${{ secrets.GITHUB_TOKEN }}
2025
repository: pulumi/examples
21-
token: ${{ secrets.EVENT_PAT }}
26+
token: ${{ steps.esc-secrets.outputs.EVENT_PAT }}
27+
env:
28+
ESC_ACTION_OIDC_AUTH: true
29+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
30+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
31+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
32+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false

‎.github/workflows/test-examples.yml‎

Lines changed: 47 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
permissions:
2+
id-token: write
13
name: Test examples
24
on:
35
pull_request:
@@ -18,6 +20,9 @@ jobs:
1820
id-token: write
1921
contents: read
2022
steps:
23+
- name: Fetch secrets from ESC
24+
id: esc-secrets
25+
uses: pulumi/esc-action@v1
2126
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
2227

2328
- name: Set up the environment
@@ -26,7 +31,7 @@ jobs:
2631
with:
2732
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
2833
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
29-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
34+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
3035
github-token: ${{ secrets.GITHUB_TOKEN }}
3136

3237
- name: Lint
@@ -40,6 +45,9 @@ jobs:
4045
id-token: write
4146
contents: read
4247
steps:
48+
- name: Fetch secrets from ESC
49+
id: esc-secrets
50+
uses: pulumi/esc-action@v1
4351
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
4452

4553
- name: Set up the environment
@@ -48,7 +56,7 @@ jobs:
4856
with:
4957
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
5058
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
51-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
59+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
5260
github-token: ${{ secrets.GITHUB_TOKEN }}
5361

5462
- name: unit tests
@@ -70,7 +78,7 @@ jobs:
7078
- name: Set up Python
7179
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
7280
with:
73-
python-version: 3.9 # Adjust the version as needed
81+
python-version: 3.9 # Adjust the version as needed
7482

7583
# Step 3: Install Make (already installed on Ubuntu, but explicit just in case)
7684
- name: Ensure Make is Installed
@@ -90,6 +98,9 @@ jobs:
9098
id-token: write
9199
contents: read
92100
steps:
101+
- name: Fetch secrets from ESC
102+
id: esc-secrets
103+
uses: pulumi/esc-action@v1
93104
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
94105

95106
- name: Set up the environment
@@ -98,7 +109,7 @@ jobs:
98109
with:
99110
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
100111
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
101-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
112+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
102113
github-token: ${{ secrets.GITHUB_TOKEN }}
103114

104115
- name: unit tests
@@ -114,6 +125,9 @@ jobs:
114125
id-token: write
115126
contents: read
116127
steps:
128+
- name: Fetch secrets from ESC
129+
id: esc-secrets
130+
uses: pulumi/esc-action@v1
117131
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
118132

119133
- name: Set up the environment
@@ -122,7 +136,7 @@ jobs:
122136
with:
123137
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
124138
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
125-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
139+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
126140
github-token: ${{ secrets.GITHUB_TOKEN }}
127141

128142
- name: unit tests
@@ -136,6 +150,9 @@ jobs:
136150
id-token: write
137151
contents: read
138152
steps:
153+
- name: Fetch secrets from ESC
154+
id: esc-secrets
155+
uses: pulumi/esc-action@v1
139156
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
140157

141158
- name: Set up the environment
@@ -144,7 +161,7 @@ jobs:
144161
with:
145162
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
146163
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
147-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
164+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
148165
github-token: ${{ secrets.GITHUB_TOKEN }}
149166

150167
- name: unit tests
@@ -169,13 +186,16 @@ jobs:
169186

170187
steps:
171188
# Run as first step so we don't delete things that have just been installed
189+
- name: Fetch secrets from ESC
190+
id: esc-secrets
191+
uses: pulumi/esc-action@v1
172192
- name: Free Disk Space (Ubuntu)
173193
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
174194
with:
175195
tool-cache: false
176196
swap-storage: false
177197
dotnet: false
178-
198+
179199
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
180200

181201
- name: Set up the environment
@@ -184,7 +204,7 @@ jobs:
184204
with:
185205
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
186206
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
187-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
207+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
188208
github-token: ${{ secrets.GITHUB_TOKEN }}
189209

190210
- name: Run tests
@@ -194,20 +214,20 @@ jobs:
194214
AWS_SECRET_ACCESS_KEY: ${{ steps.setup.outputs.aws-secret-access-key }}
195215
AWS_SESSION_TOKEN: ${{ steps.setup.outputs.aws-session-token }}
196216
AWS_REGION: ${{ steps.setup.outputs.aws-region }}
197-
ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
198-
ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
217+
ARM_CLIENT_ID: ${{ steps.esc-secrets.outputs.ARM_CLIENT_ID }}
218+
ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
199219
ARM_ENVIRONMENT: public
200220
ARM_LOCATION: westus
201-
ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
202-
ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
221+
ARM_SUBSCRIPTION_ID: ${{ steps.esc-secrets.outputs.ARM_SUBSCRIPTION_ID }}
222+
ARM_TENANT_ID: ${{ steps.esc-secrets.outputs.ARM_TENANT_ID }}
203223
GOOGLE_PROJECT: ${{ steps.setup.outputs.google-project-name }}
204224
GOOGLE_REGION: ${{ steps.setup.outputs.google-region }}
205225
GOOGLE_ZONE: ${{ steps.setup.outputs.google-zone }}
206-
DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
207-
PACKET_AUTH_TOKEN: ${{ secrets.PACKET_AUTH_TOKEN }}
208-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
226+
DIGITALOCEAN_TOKEN: ${{ steps.esc-secrets.outputs.DIGITALOCEAN_TOKEN }}
227+
PACKET_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.PACKET_AUTH_TOKEN }}
228+
PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
209229
PULUMI_API: https://api.pulumi-staging.io
210-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
230+
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
211231

212232
strategy:
213233
fail-fast: false
@@ -236,6 +256,9 @@ jobs:
236256
contents: read
237257

238258
steps:
259+
- name: Fetch secrets from ESC
260+
id: esc-secrets
261+
uses: pulumi/esc-action@v1
239262
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
240263

241264
- name: Set up the environment
@@ -244,7 +267,7 @@ jobs:
244267
with:
245268
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
246269
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
247-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
270+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
248271
github-token: ${{ secrets.GITHUB_TOKEN }}
249272

250273
- name: Set up Minikube
@@ -281,6 +304,12 @@ jobs:
281304
AWS_SECRET_ACCESS_KEY: ${{ steps.setup.outputs.aws-secret-access-key }}
282305
AWS_SESSION_TOKEN: ${{ steps.setup.outputs.aws-session-token }}
283306
AWS_REGION: ${{ steps.setup.outputs.aws-region }}
284-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
307+
PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
285308
PULUMI_API: https://api.pulumi-staging.io
286309
INFRA_STACK_NAME: ${{ github.sha }}-${{ github.run_number }}
310+
env:
311+
ESC_ACTION_OIDC_AUTH: true
312+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
313+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
314+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
315+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false

0 commit comments

Comments
 (0)