chore: read secrets from Akeyeless

telerik · May 18, 2023 · 6d2f1a8 · 6d2f1a8
1 parent b3f2ddd
commit 6d2f1a8
Show file tree

Hide file tree

Showing 7 changed files with 110 additions and 16 deletions.
diff --git a/.github/disabled-workflows/publish_npm_next.yml b/.github/disabled-workflows/publish_npm_next.yml
@@ -15,16 +15,32 @@ on:
 jobs:
 
   release-next:
-
     runs-on: ubuntu-latest
+    environment: upload
+
+    permissions:
+        id-token: write # Required by Akeyless
+        contents: read
+        packages: read
 
     steps:
+      - name: Import Secrets
+        id: import-secrets
+        uses: LanceMcCarthy/akeyless-action@v3
+        with:
+          access-id: ${{ secrets.GH_AKEYLESS_ACCESS_ID }}
+          static-secrets: |
+            {
+              "/WebComponents/prod/tokens/GH_TOKEN": "GH_TOKEN",
+              "/WebComponents/prod/tokens/PROGRESS_NPM_REGISTRY_TOKEN": "NPM_TOKEN"
+            }
+          export-secrets-to-environment: false
 
       - name: Checkout branch
         uses: actions/checkout@v3
         with:
           ref: v5-dev
-          token: ${{ secrets.GH_TOKEN }}
+          token: ${{ steps.import-secrets.outputs.GH_TOKEN }}
 
       - name: Setup git
         run: |
@@ -38,7 +54,7 @@ jobs:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ steps.import-secrets.outputs.NPM_TOKEN }}
 
       - name: Use cache for root node_modules
         id: cache-root-node_modules

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -38,7 +38,6 @@ jobs:
     needs: [ render-test-pages, create-screenshots ]
 
     steps:
-
       - name: Checkout branch
         uses: actions/checkout@v3
 
@@ -67,7 +66,7 @@ jobs:
       - name: Push changes to GitHub
         if: ${{ (env.HAS_CHANGES == 1 || env.HAS_NEW == 1) }}
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           echo "Visual tests have detected changes. Updating markup and screenshots."
 

diff --git a/.github/workflows/publish_npm.yml b/.github/workflows/publish_npm.yml
@@ -7,15 +7,32 @@ jobs:
 
   release-stable:
     runs-on: ubuntu-latest
+    environment: upload
+
+    permissions:
+        id-token: write # Required by Akeyless
+        contents: read
+        packages: read
 
     steps:
+      - name: Import Secrets
+        id: import-secrets
+        uses: LanceMcCarthy/akeyless-action@v3
+        with:
+          access-id: ${{ secrets.GH_AKEYLESS_ACCESS_ID }}
+          static-secrets: |
+            {
+              "/WebComponents/prod/tokens/GH_TOKEN": "GH_TOKEN",
+              "/WebComponents/prod/tokens/PROGRESS_NPM_REGISTRY_TOKEN": "NPM_TOKEN"
+            }
+          export-secrets-to-environment: false
 
       - name: Checkout branch
         uses: actions/checkout@v3
         with:
           ref: master
           fetch-depth: '0'
-          token: ${{ secrets.GH_TOKEN }}
+          token: ${{ steps.import-secrets.outputs.GH_TOKEN }}
 
       - name: Setup git
         run: |
@@ -35,7 +52,7 @@ jobs:
           node-version: 18.x
           registry-url: 'https://registry.npmjs.org'
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ steps.import-secrets.outputs.NPM_TOKEN }}
 
       - name: Use cache for root node_modules
         id: cache-root-node_modules
@@ -62,14 +79,14 @@ jobs:
         run: |
           npx lerna publish --conventional-commits --conventional-graduate --create-release github --force-publish --exact
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ steps.import-secrets.outputs.GH_TOKEN }}
 
       - name: Mark checks as successful
         run: |
           commit=$(git rev-parse HEAD)
           ./build/mark-checks.sh $commit
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ steps.import-secrets.outputs.GH_TOKEN }}
 
       - name: Push to GitHub
         run: |

diff --git a/.github/workflows/publish_npm_dev.yml b/.github/workflows/publish_npm_dev.yml
@@ -14,15 +14,32 @@ jobs:
 
   release-dev:
     runs-on: ubuntu-latest
+    environment: upload
+
+    permissions:
+        id-token: write # Required by Akeyless
+        contents: read
+        packages: read
 
     steps:
+      - name: Import Secrets
+        id: import-secrets
+        uses: LanceMcCarthy/akeyless-action@v3
+        with:
+          access-id: ${{ secrets.GH_AKEYLESS_ACCESS_ID }}
+          static-secrets: |
+            {
+              "/WebComponents/prod/tokens/GH_TOKEN": "GH_TOKEN",
+              "/WebComponents/prod/tokens/PROGRESS_NPM_REGISTRY_TOKEN": "NPM_TOKEN"
+            }
+          export-secrets-to-environment: false
 
       - name: Checkout branch
         uses: actions/checkout@v3
         with:
           ref: develop
           fetch-depth: '0'
-          token: ${{ secrets.GH_TOKEN }}
+          token: ${{ steps.import-secrets.outputs.GH_TOKEN }}
 
       - name: Setup git
         run: |
@@ -36,7 +53,7 @@ jobs:
           node-version: 18.x
           registry-url: 'https://registry.npmjs.org'
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ steps.import-secrets.outputs.NPM_TOKEN }}
 
       - name: Use cache for root node_modules
         id: cache-root-node_modules
@@ -62,11 +79,11 @@ jobs:
       - name: Lerna publish
         run: npx lerna publish --conventional-commits --conventional-prerelease --create-release github --preid dev --dist-tag dev --allow-branch develop --force-publish --exact --yes
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ steps.import-secrets.outputs.GH_TOKEN }}
 
       - name: Mark checks as successful
         run: |
           commit=$(git rev-parse HEAD)
           ./build/mark-checks.sh $commit
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ steps.import-secrets.outputs.GH_TOKEN }}
diff --git a/.github/workflows/publish_nuget.yml b/.github/workflows/publish_nuget.yml
@@ -20,8 +20,24 @@ jobs:
 
   nuget-publish:
     runs-on: ubuntu-latest
+    environment: upload
+
+    permissions:
+        id-token: write # Required by Akeyless
+        contents: read
+        packages: read
 
     steps:
+      - name: Import Secrets
+        id: import-secrets
+        uses: LanceMcCarthy/akeyless-action@v3
+        with:
+          access-id: ${{ secrets.GH_AKEYLESS_ACCESS_ID }}
+          static-secrets: |
+            {
+              "/WebComponents/prod/tokens/GH_TOKEN_PUBLISH": "GH_TOKEN_PUBLISH",
+            }
+          export-secrets-to-environment: false
 
       - name: Checkout branch
         uses: actions/checkout@v3
@@ -66,4 +82,4 @@ jobs:
           nuget sources add -username ${{ env.NUGET_USER }} -password %NUGET_API_KEY% -StorePasswordInClearText -Name github -Source ${{ env.NUGET_FEED }}
           npx lerna run nuget-push
         env:
-          NUGET_API_KEY: ${{ secrets.GH_TOKEN_PUBLISH }}
+          NUGET_API_KEY: ${{ steps.import-secrets.outputs.GH_TOKEN_PUBLISH }}
diff --git a/.github/workflows/publish_swatches.yml b/.github/workflows/publish_swatches.yml
@@ -23,7 +23,20 @@ jobs:
     runs-on: 'ubuntu-latest'
     if: ${{ github.event.inputs.ref || github.event.workflow_run.conclusion == 'success' }}
 
+    permissions:
+        id-token: write # Required by Akeyless
+        contents: read
+        packages: read
+
     steps:
+      - name: Import Secrets
+        id: import-secrets
+        uses: LanceMcCarthy/akeyless-action@v3
+        with:
+          access-id: ${{ secrets.GH_AKEYLESS_ACCESS_ID }}
+          static-secrets: '{ "/WebComponents/prod/tokens/GH_TOKEN": "GH_TOKEN" }'
+          export-secrets-to-environment: false
+
       - name: Checkout branch
         uses: actions/checkout@v3
         with:
@@ -56,7 +69,7 @@ jobs:
         uses: actions/checkout@v3
         with:
           repository: telerik/themes-cdn
-          token: ${{ secrets.GH_TOKEN }}
+          token: ${{ steps.import-secrets.outputs.GH_TOKEN }}
           path: themes-cdn
           lfs: true
 

diff --git a/.github/workflows/tag_stable.yml b/.github/workflows/tag_stable.yml
@@ -7,8 +7,24 @@ jobs:
 
   tag:
     runs-on: ubuntu-latest
+    environment: upload
+
+    permissions:
+        id-token: write # Required by Akeyless
+        contents: read
+        packages: read
 
     steps:
+      - name: Import Secrets
+        id: import-secrets
+        uses: LanceMcCarthy/akeyless-action@v3
+        with:
+          access-id: ${{ secrets.GH_AKEYLESS_ACCESS_ID }}
+          static-secrets: |
+            {
+              "/WebComponents/prod/tokens/PROGRESS_NPM_REGISTRY_TOKEN": "NPM_TOKEN"
+            }
+          export-secrets-to-environment: false
 
       - name: Checkout
         uses: actions/checkout@v3
@@ -22,7 +38,7 @@ jobs:
           node-version: 18.x
           registry-url: 'https://registry.npmjs.org'
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ steps.import-secrets.outputs.NPM_TOKEN }}
 
       - name: Tag stable version
         run: ./build/tag-stable.sh