From f42b68251f839905ed16ea0a8d91107cf846c876 Mon Sep 17 00:00:00 2001 From: Duje Begonja RDX <108268552+duje-begonja-rdx@users.noreply.github.com> Date: Tue, 7 Jan 2025 10:37:14 +0100 Subject: [PATCH] ci: move build workflow secrets to AWS (#274) --- .github/workflows/build.yml | 31 ++++++++++++++++++++++--------- .github/workflows/release.yml | 12 ++++++------ 2 files changed, 28 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 413b2249..00ee9643 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -29,11 +29,11 @@ jobs: - uses: RDXWorks-actions/checkout@main - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main with: - role_name: ${{ secrets.AWS_ROLE_NAME_SNYK_SECRET }} + role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access' app_name: 'connector-extension' step_name: 'snyk-scan-deps-licenses' secret_prefix: 'SNYK' - secret_name: ${{ secrets.AWS_SECRET_NAME_SNYK }} + secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/snyk-credentials-rXRpuX' parse_json: true - name: Run Snyk to check for deps vulnerabilities uses: RDXWorks-actions/snyk-actions/node@master @@ -51,11 +51,11 @@ jobs: - uses: RDXWorks-actions/checkout@main - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main with: - role_name: ${{ secrets.AWS_ROLE_NAME_SNYK_SECRET }} + role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access' app_name: 'connector-extension' step_name: 'snyk-scan-code' secret_prefix: 'SNYK' - secret_name: ${{ secrets.AWS_SECRET_NAME_SNYK }} + secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/snyk-credentials-rXRpuX' parse_json: true - name: Run Snyk to check for code vulnerabilities uses: RDXWorks-actions/snyk-actions/node@master @@ -78,11 +78,11 @@ jobs: - uses: RDXWorks-actions/checkout@main - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main with: - role_name: ${{ secrets.AWS_ROLE_NAME_SNYK_SECRET }} + role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access' app_name: 'connector-extension' step_name: 'snyk-sbom' secret_prefix: 'SNYK' - secret_name: ${{ secrets.AWS_SECRET_NAME_SNYK }} + secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/snyk-credentials-rXRpuX' parse_json: true - name: Generate SBOM # check SBOM can be generated but nothing is done with it uses: RDXWorks-actions/snyk-actions/node@master @@ -92,6 +92,10 @@ jobs: build: runs-on: ubuntu-latest + permissions: + id-token: write + pull-requests: read + contents: read steps: - uses: RDXWorks-actions/checkout@main - name: Use Node.js @@ -129,11 +133,20 @@ jobs: - name: Running unit tests run: npm run test:ci + - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main + with: + role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access' + app_name: 'conn-extension' + step_name: 'sonar' + secret_prefix: 'GH' + secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/sonar-token-CgrUGD' + parse_json: true + - name: SonarCloud Scan uses: RDXWorks-actions/sonarcloud-github-action@master env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + SONAR_TOKEN: ${{ env.GH_SONAR_TOKEN }} snyk_monitor: runs-on: ubuntu-latest @@ -149,11 +162,11 @@ jobs: - uses: RDXWorks-actions/checkout@main - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main with: - role_name: ${{ secrets.AWS_ROLE_NAME_SNYK_SECRET }} + role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access' app_name: 'connector-extension' step_name: 'snyk-monitor' secret_prefix: 'SNYK' - secret_name: ${{ secrets.AWS_SECRET_NAME_SNYK }} + secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/snyk-credentials-rXRpuX' parse_json: true - name: Enable Snyk online monitoring to check for vulnerabilities uses: RDXWorks-actions/snyk-actions/node@master diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b2e94d43..29626466 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -27,18 +27,18 @@ jobs: - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main with: - role_name: ${{ secrets.AWS_ROLE_NAME_CONNECTOR_EXTENSION_SECRETS }} + role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-connector-extension-secrets-read-access' app_name: 'connector-extension' step_name: 'connector-extension-webchrome-store-secrets' secret_prefix: 'GH' - secret_name: ${{ secrets.AWS_CONNECTOR_EXTENSION_WEBCHROME_STORE_SECRET_ARN }} + secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/radixdlt/connector_extension/webchrome_store_secrets' parse_json: true - name: Github PreRelease if: github.ref == 'refs/heads/develop' env: VITE_GITHUB_REF_NAME: ${{ github.ref_name }} - GITHUB_TOKEN: ${{ secrets.SEMANTIC_RELEASE_TOKEN }} + GITHUB_TOKEN: ${{ env.GH_SEMANTIC_RELEASE_TOKEN }} GOOGLE_CLIENT_ID: ${{ env.GH_CLIENT_ID }} GOOGLE_CLIENT_SECRET: ${{ env.GH_CLIENT_SECRET }} GOOGLE_REFRESH_TOKEN: ${{ env.GH_REFRESH_TOKEN }} @@ -56,7 +56,7 @@ jobs: if: github.ref == 'refs/heads/main' env: VITE_GITHUB_REF_NAME: ${{ github.ref_name }} - GITHUB_TOKEN: ${{ secrets.SEMANTIC_RELEASE_TOKEN }} + GITHUB_TOKEN: ${{ env.GH_SEMANTIC_RELEASE_TOKEN }} GOOGLE_CLIENT_ID: ${{ env.GH_CLIENT_ID }} GOOGLE_CLIENT_SECRET: ${{ env.GH_CLIENT_SECRET }} GOOGLE_REFRESH_TOKEN: ${{ env.GH_REFRESH_TOKEN }} @@ -71,11 +71,11 @@ jobs: # Snyk SBOM - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main with: - role_name: ${{ secrets.AWS_ROLE_NAME_SNYK_SECRET }} + role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access' app_name: 'connector-extension' step_name: 'snyk-sbom' secret_prefix: 'SNYK' - secret_name: ${{ secrets.AWS_SECRET_NAME_SNYK }} + secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/snyk-credentials-rXRpuX' parse_json: true - name: Generate SBOM uses: RDXWorks-actions/snyk-actions/node@master