Skip to content

Commit f43e8f5

Browse files
pgavlinpgavlin
committed
Use ESC secrets
1 parent d335fa8 commit f43e8f5

File tree

3 files changed

+68
-20
lines changed

3 files changed

+68
-20
lines changed

‎.github/workflows/add-to-project.yaml

+11-1
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,18 @@ jobs:
88
add-to-project:
99
runs-on: ubuntu-latest
1010
steps:
11+
- name: Fetch secrets from ESC
12+
id: esc-secrets
13+
uses: pulumi/esc-action@v1
1114
- name: Add to DevRel
1215
uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
1316
with:
1417
project-url: https://github.com/orgs/pulumi/projects/47
15-
github-token: ${{ secrets.PULUMI_BOT_GHA_MARKETING }}
18+
github-token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_GHA_MARKETING }}
19+
env:
20+
ESC_ACTION_OIDC_AUTH: true
21+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
22+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
23+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
24+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false
25+
permissions: write-all # Equivalent to default permissions plus id-token: write

‎.github/workflows/command-dispatch.yml

+11-1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ jobs:
88
command-dispatch-for-testing:
99
runs-on: ubuntu-latest
1010
steps:
11+
- name: Fetch secrets from ESC
12+
id: esc-secrets
13+
uses: pulumi/esc-action@v1
1114
- name: Checkout Repo
1215
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
1316
- name: Run Build
@@ -18,4 +21,11 @@ jobs:
1821
permission: write
1922
reaction-token: ${{ secrets.GITHUB_TOKEN }}
2023
repository: pulumi/examples
21-
token: ${{ secrets.EVENT_PAT }}
24+
token: ${{ steps.esc-secrets.outputs.EVENT_PAT }}
25+
env:
26+
ESC_ACTION_OIDC_AUTH: true
27+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
28+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
29+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
30+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false
31+
permissions: write-all # Equivalent to default permissions plus id-token: write

‎.github/workflows/test-examples.yml

+46-18
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ jobs:
1818
id-token: write
1919
contents: read
2020
steps:
21+
- name: Fetch secrets from ESC
22+
id: esc-secrets
23+
uses: pulumi/esc-action@v1
2124
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
2225

2326
- name: Set up the environment
@@ -26,7 +29,7 @@ jobs:
2629
with:
2730
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
2831
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
29-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
32+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
3033
github-token: ${{ secrets.GITHUB_TOKEN }}
3134

3235
- name: Lint
@@ -40,6 +43,9 @@ jobs:
4043
id-token: write
4144
contents: read
4245
steps:
46+
- name: Fetch secrets from ESC
47+
id: esc-secrets
48+
uses: pulumi/esc-action@v1
4349
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
4450

4551
- name: Set up the environment
@@ -48,7 +54,7 @@ jobs:
4854
with:
4955
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
5056
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
51-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
57+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
5258
github-token: ${{ secrets.GITHUB_TOKEN }}
5359

5460
- name: unit tests
@@ -70,7 +76,7 @@ jobs:
7076
- name: Set up Python
7177
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
7278
with:
73-
python-version: 3.9 # Adjust the version as needed
79+
python-version: 3.9 # Adjust the version as needed
7480

7581
# Step 3: Install Make (already installed on Ubuntu, but explicit just in case)
7682
- name: Ensure Make is Installed
@@ -90,6 +96,9 @@ jobs:
9096
id-token: write
9197
contents: read
9298
steps:
99+
- name: Fetch secrets from ESC
100+
id: esc-secrets
101+
uses: pulumi/esc-action@v1
93102
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
94103

95104
- name: Set up the environment
@@ -98,7 +107,7 @@ jobs:
98107
with:
99108
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
100109
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
101-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
110+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
102111
github-token: ${{ secrets.GITHUB_TOKEN }}
103112

104113
- name: unit tests
@@ -114,6 +123,9 @@ jobs:
114123
id-token: write
115124
contents: read
116125
steps:
126+
- name: Fetch secrets from ESC
127+
id: esc-secrets
128+
uses: pulumi/esc-action@v1
117129
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
118130

119131
- name: Set up the environment
@@ -122,7 +134,7 @@ jobs:
122134
with:
123135
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
124136
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
125-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
137+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
126138
github-token: ${{ secrets.GITHUB_TOKEN }}
127139

128140
- name: unit tests
@@ -136,6 +148,9 @@ jobs:
136148
id-token: write
137149
contents: read
138150
steps:
151+
- name: Fetch secrets from ESC
152+
id: esc-secrets
153+
uses: pulumi/esc-action@v1
139154
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
140155

141156
- name: Set up the environment
@@ -144,7 +159,7 @@ jobs:
144159
with:
145160
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
146161
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
147-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
162+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
148163
github-token: ${{ secrets.GITHUB_TOKEN }}
149164

150165
- name: unit tests
@@ -169,13 +184,16 @@ jobs:
169184

170185
steps:
171186
# Run as first step so we don't delete things that have just been installed
187+
- name: Fetch secrets from ESC
188+
id: esc-secrets
189+
uses: pulumi/esc-action@v1
172190
- name: Free Disk Space (Ubuntu)
173191
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
174192
with:
175193
tool-cache: false
176194
swap-storage: false
177195
dotnet: false
178-
196+
179197
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
180198

181199
- name: Set up the environment
@@ -184,7 +202,7 @@ jobs:
184202
with:
185203
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
186204
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
187-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
205+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
188206
github-token: ${{ secrets.GITHUB_TOKEN }}
189207

190208
- name: Run tests
@@ -194,20 +212,20 @@ jobs:
194212
AWS_SECRET_ACCESS_KEY: ${{ steps.setup.outputs.aws-secret-access-key }}
195213
AWS_SESSION_TOKEN: ${{ steps.setup.outputs.aws-session-token }}
196214
AWS_REGION: ${{ steps.setup.outputs.aws-region }}
197-
ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
198-
ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
215+
ARM_CLIENT_ID: ${{ steps.esc-secrets.outputs.ARM_CLIENT_ID }}
216+
ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
199217
ARM_ENVIRONMENT: public
200218
ARM_LOCATION: westus
201-
ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
202-
ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
219+
ARM_SUBSCRIPTION_ID: ${{ steps.esc-secrets.outputs.ARM_SUBSCRIPTION_ID }}
220+
ARM_TENANT_ID: ${{ steps.esc-secrets.outputs.ARM_TENANT_ID }}
203221
GOOGLE_PROJECT: ${{ steps.setup.outputs.google-project-name }}
204222
GOOGLE_REGION: ${{ steps.setup.outputs.google-region }}
205223
GOOGLE_ZONE: ${{ steps.setup.outputs.google-zone }}
206-
DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
207-
PACKET_AUTH_TOKEN: ${{ secrets.PACKET_AUTH_TOKEN }}
208-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
224+
DIGITALOCEAN_TOKEN: ${{ steps.esc-secrets.outputs.DIGITALOCEAN_TOKEN }}
225+
PACKET_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.PACKET_AUTH_TOKEN }}
226+
PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
209227
PULUMI_API: https://api.pulumi-staging.io
210-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
228+
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
211229

212230
strategy:
213231
fail-fast: false
@@ -236,6 +254,9 @@ jobs:
236254
contents: read
237255

238256
steps:
257+
- name: Fetch secrets from ESC
258+
id: esc-secrets
259+
uses: pulumi/esc-action@v1
239260
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
240261

241262
- name: Set up the environment
@@ -244,7 +265,7 @@ jobs:
244265
with:
245266
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
246267
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
247-
aws-role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
268+
aws-role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
248269
github-token: ${{ secrets.GITHUB_TOKEN }}
249270

250271
- name: Set up Minikube
@@ -281,6 +302,13 @@ jobs:
281302
AWS_SECRET_ACCESS_KEY: ${{ steps.setup.outputs.aws-secret-access-key }}
282303
AWS_SESSION_TOKEN: ${{ steps.setup.outputs.aws-session-token }}
283304
AWS_REGION: ${{ steps.setup.outputs.aws-region }}
284-
PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
305+
PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
285306
PULUMI_API: https://api.pulumi-staging.io
286307
INFRA_STACK_NAME: ${{ github.sha }}-${{ github.run_number }}
308+
env:
309+
ESC_ACTION_OIDC_AUTH: true
310+
ESC_ACTION_OIDC_ORGANIZATION: pulumi
311+
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
312+
ESC_ACTION_ENVIRONMENT: imports/github-secrets
313+
ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false
314+
permissions: write-all # Equivalent to default permissions plus id-token: write

0 commit comments

Comments
 (0)