Use ESC secrets #8208
Use ESC secrets #8208
Conversation
|
Your site preview for commit af75d94 is ready! 🎉 http://registry--origin-pr-8208-af75d940.s3-website.us-west-2.amazonaws.com/registry. |
… secrets instead of GitHub Secrets. The changes are largely mechanical: - Common configuration for all ESC actions within a workflow is added to the workflow's environment variables - Permissions are expanded as necessary for workflows that do not grant `id-token: write` permissions - `read-all` permissions are replaced with the union of all explicit read permissions and `id-token: write` - Default permissions are replaced with `write-all`, which is the equivalent of all explicit write permissions and `id-token: write` - Explicit permissions are modified to grant `id-token: write` - A step that fetches ESC secrets and populates environment variables is added to each step that reads secrets - Direct references to secrets within the job are replaced with references to the step's outputs All ESC actions are configured to fetch secrets from a shared ESC environment that contains secrets migrated from GitHub Actions. The ESC action performs its own OIDC exchange to obtain a Pulumi Access Token.
pgavlin
force-pushed
the
pgavlin/esc-secrets
branch
from
af75d94 to
c5b4e0f
Compare
|
Your site preview for commit c5b4e0f is ready! 🎉 http://registry--origin-pr-8208-c5b4e0ff.s3-website.us-west-2.amazonaws.com/registry. |
There was a problem hiding this comment.
If we're switching which environment we're pulling from, then we should remove the duplicate lines from above.
Also, personally, I'd switch to passing the argument directly to the ESC action in the with: block so it's clear what options are being used when reading the code for the step.
| ESC_ACTION_OIDC_AUTH: true | ||
| ESC_ACTION_OIDC_ORGANIZATION: pulumi | ||
| ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization | ||
| ESC_ACTION_ENVIRONMENT: imports/github-secrets |
There was a problem hiding this comment.
These lines added seem to duplicate lines 2-5, but switching to the more generic environment rather than the registry environment.
These changes migrate this repo's GitHub Actions Workflows to use ESC secrets instead of GitHub Secrets.
The changes are largely mechanical:
id-token: writepermissionsread-allpermissions are replaced with the union of all explicit read permissions andid-token: writewrite-all, which is the equivalent of all explicit write permissions andid-token: writeid-token: writeAll ESC actions are configured to fetch secrets from a shared ESC environment that contains secrets migrated from GitHub Actions. The ESC action performs its own OIDC exchange to obtain a Pulumi Access Token.