-
Notifications
You must be signed in to change notification settings - Fork 53
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #113 from opencrvs/release-v1.5.0
Release v1.5.0
- Loading branch information
Showing
95 changed files
with
2,211 additions
and
1,465 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| name: Reusable Fetch Secret Workflow | ||
|
|
||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| secret_name: | ||
| required: true | ||
| type: string | ||
| env_name: | ||
| required: true | ||
| type: string | ||
| outputs: | ||
| secret_value: | ||
| description: 'Secret value, encrypted with the encryption key' | ||
| value: ${{ jobs.fetch-credentials.outputs.secret_value }} | ||
| environment_exists: | ||
| description: 'Whether the environment exists or not' | ||
| value: ${{ jobs.check-environment.outputs.environment_exists }} | ||
| secrets: | ||
| gh_token: | ||
| required: true | ||
| encryption_key: | ||
| required: true | ||
| # All secrets that are we want to allow access to need | ||
| # to be defined in this list | ||
| BACKUP_ENCRYPTION_PASSPHRASE: | ||
| required: false | ||
| SSH_KEY: | ||
| required: false | ||
|
|
||
| jobs: | ||
| check-environment: | ||
| name: Check if Environment Exists | ||
| runs-on: ubuntu-22.04 | ||
| outputs: | ||
| environment_exists: ${{ steps.check-env.outputs.exists }} | ||
| steps: | ||
| - name: Check if GITHUB_TOKEN is set | ||
| id: check-token | ||
| run: | | ||
| if [ -z "${{ secrets.gh_token }}" ]; then | ||
| echo "Environment secret GITHUB_TOKEN is not set. Make sure you add a correct Github API token before running this pipeline." | ||
| exit 1 | ||
| fi | ||
| - name: Check if environment exists | ||
| id: check-env | ||
| run: | | ||
| ENV_NAME="${{ inputs.env_name }}" | ||
| RESPONSE=$(curl -s -H "Authorization: Bearer ${{ secrets.gh_token }}" \ | ||
| "https://api.github.com/repos/${{ github.repository }}/environments/$ENV_NAME") | ||
| if echo "$RESPONSE" | grep -q '"name": "'$ENV_NAME'"'; then | ||
| echo "Environment $ENV_NAME exists." | ||
| echo "::set-output name=exists::true" | ||
| else | ||
| echo "Environment $ENV_NAME does not exist." | ||
| echo "::set-output name=exists::false" | ||
| fi | ||
| fetch-credentials: | ||
| name: Fetch Secret | ||
| runs-on: ubuntu-22.04 | ||
| environment: ${{ inputs.env_name }} | ||
| needs: check-environment | ||
| # Without this Github actions will create the environment when it doesnt exist | ||
| if: needs.check-environment.outputs.environment_exists == 'true' | ||
| outputs: | ||
| secret_value: ${{ steps.fetch-credentials.outputs.secret_value }} | ||
| steps: | ||
| - name: Fetch the secret | ||
| id: fetch-credentials | ||
| env: | ||
| SECRET_NAME: ${{ inputs.secret_name }} | ||
| run: | | ||
| SECRET_VALUE="${{ secrets[env.SECRET_NAME] }}" | ||
| if [ -z "$SECRET_VALUE" ]; then | ||
| echo "Secret ${{ inputs.secret_name }} is empty. Usually this means you have not explicitly stated the secrets" | ||
| echo "in both the workflow file get-secrets-from-environment and in the file you are using the reusable workflow from." | ||
| echo "Please make sure you have added the secret to the workflow files and retry." | ||
| exit 1 | ||
| fi | ||
| echo -n "$SECRET_VALUE" | openssl enc -aes-256-cbc -pbkdf2 -salt -k "${{ secrets.encryption_key }}" -out encrypted_key.bin | ||
| ENCODED_ENCRYPTED_SECRET=$(base64 < encrypted_key.bin) | ||
| EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64) | ||
| echo "secret_value<<$EOF" >> $GITHUB_OUTPUT | ||
| echo "$ENCODED_ENCRYPTED_SECRET" >> $GITHUB_OUTPUT | ||
| echo "$EOF" >> $GITHUB_OUTPUT |
Oops, something went wrong.