Skip to content

Commit 3f8a6cd

Browse files
DerTiedemannDerTiedemann
committed
feat: add GSM secret manager to workflows
1 parent 67a7272 commit 3f8a6cd

38 files changed

Lines changed: 2363 additions & 2150 deletions

File tree

‎.github/workflows/_add-issue-ci.yaml‎

Lines changed: 27 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,30 @@
11
name: Add opened issues to specific project board
2-
32
on:
4-
issues:
5-
types:
6-
- opened
7-
3+
issues:
4+
types:
5+
- opened
86
jobs:
9-
add-issue-to-project:
10-
name: Add issue to project board
11-
runs-on: ubuntu-22.04
12-
steps:
13-
- name: Add the issue to the project
14-
uses: actions/add-to-project@v0.5.0
15-
with:
16-
project-url: https://github.com/orgs/bakdata/projects/7
17-
github-token: ${{ secrets.GH_TOKEN }}
7+
add-issue-to-project:
8+
name: Add issue to project board
9+
runs-on: ubuntu-22.04
10+
steps:
11+
- name: Authenticate with GCloud
12+
uses: google-github-actions/auth@v2
13+
id: auth
14+
with:
15+
workload_identity_provider: ${{ secrets.GOOGLE_WORKLOAD_IDENTITY_PROVIDER }}
16+
service_account: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
17+
- name: Fetch secrets from GSM
18+
id: fetch-secrets
19+
uses: google-github-actions/get-secretmanager-secrets@v2
20+
with:
21+
secrets: GH_TOKEN:${{ secrets.GOOGLE_PROJECT_ID }}/GH_TOKEN
22+
export_to_environment: 'true'
23+
- name: Add the issue to the project
24+
uses: actions/add-to-project@v0.5.0
25+
with:
26+
project-url: https://github.com/orgs/bakdata/projects/7
27+
github-token: ${{ env.GH_TOKEN }}
28+
permissions:
29+
contents: read
30+
id-token: write

‎.github/workflows/_release.yaml‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,25 @@
11
name: Release
2-
32
on:
4-
workflow_dispatch:
5-
inputs:
6-
release-type:
7-
description: "Scope of the release."
8-
type: choice
9-
required: true
10-
default: patch
11-
options:
12-
- patch
13-
- minor
14-
- major
15-
3+
workflow_dispatch:
4+
inputs:
5+
release-type:
6+
description: Scope of the release.
7+
type: choice
8+
required: true
9+
default: patch
10+
options:
11+
- patch
12+
- minor
13+
- major
1614
jobs:
17-
release:
18-
name: Release
19-
uses: bakdata/ci-templates/.github/workflows/bump-version-release.yaml@1.35.1
20-
with:
21-
release-type: "${{ github.event.inputs.release-type }}"
22-
secrets:
23-
github-username: "${{ secrets.GH_USERNAME }}"
24-
github-email: "${{ secrets.GH_EMAIL }}"
25-
github-token: "${{ secrets.GH_TOKEN }}"
15+
release:
16+
name: Release
17+
uses: bakdata/ci-templates/.github/workflows/bump-version-release.yaml@tiedemann/use-gsm-secerts-in-workflow-calls
18+
with:
19+
release-type: ${{ github.event.inputs.release-type }}
20+
secrets:
21+
GOOGLE_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GOOGLE_WORKLOAD_IDENTITY_PROVIDER }}
22+
GOOGLE_SERVICE_ACCOUNT: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
23+
permissions:
24+
contents: read
25+
id-token: write

‎.github/workflows/bump-version-release.yaml‎

Lines changed: 101 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -1,101 +1,104 @@
11
name: Bump Version Release
2-
# Reusable workflow for creating release tags using bumpversion
3-
42
on:
5-
workflow_call:
6-
inputs:
7-
release-type:
8-
description: "Scope of the release (major, minor or patch)."
9-
required: true
10-
type: string
11-
changelog:
12-
description: "Create changelog for release."
13-
required: false
14-
default: true
15-
type: boolean
16-
changelog-file:
17-
description: Path to the changelog file in the GitHub repository
18-
required: false
19-
default: "CHANGELOG.md"
20-
type: string
21-
changelog-config:
22-
description: "Changelog config path."
23-
required: false
24-
default: ""
25-
type: string
26-
working-directory:
27-
description: "Working directory containing `.bumpversion.cfg`. (Default is .)"
28-
required: false
29-
default: "."
30-
type: string
31-
32-
secrets:
33-
github-username:
34-
description: "The GitHub username for committing the changes."
35-
required: true
36-
github-email:
37-
description: "The GitHub email for committing the changes."
38-
required: true
39-
github-token:
40-
description: "The GitHub token for committing the changes."
41-
required: true
42-
43-
# Map the workflow outputs to job outputs
44-
outputs:
45-
release-version:
46-
description: "The bumped version."
47-
value: ${{ jobs.release.outputs.release-version }}
48-
old-version:
49-
description: "The old version in your `.bumpversion.cfg` file."
50-
value: ${{ jobs.release.outputs.old-version }}
51-
3+
workflow_call:
4+
inputs:
5+
release-type:
6+
description: Scope of the release (major, minor or patch).
7+
required: true
8+
type: string
9+
changelog:
10+
description: Create changelog for release.
11+
required: false
12+
default: true
13+
type: boolean
14+
changelog-file:
15+
description: Path to the changelog file in the GitHub repository
16+
required: false
17+
default: CHANGELOG.md
18+
type: string
19+
changelog-config:
20+
description: Changelog config path.
21+
required: false
22+
default: ''
23+
type: string
24+
working-directory:
25+
description: Working directory containing `.bumpversion.cfg`. (Default is .)
26+
required: false
27+
default: .
28+
type: string
29+
secrets:
30+
GOOGLE_WORKLOAD_IDENTITY_PROVIDER:
31+
description: The workload identity provider to use for fetching secrets
32+
required: true
33+
GOOGLE_SERVICE_ACCOUNT:
34+
description: The service account to use to fetch the secrets
35+
required: true
36+
outputs:
37+
release-version:
38+
description: The bumped version.
39+
value: ${{ jobs.release.outputs.release-version }}
40+
old-version:
41+
description: The old version in your `.bumpversion.cfg` file.
42+
value: ${{ jobs.release.outputs.old-version }}
5243
jobs:
53-
release:
54-
runs-on: ubuntu-22.04
55-
# Map the job outputs to step outputs
56-
outputs:
57-
release-version: ${{ steps.bump-version.outputs.release-version }}
58-
old-version: ${{ steps.bump-version.outputs.old-version }}
59-
60-
steps:
61-
- name: Check out repository
62-
uses: bakdata/ci-templates/actions/checkout@1.49.0
63-
with:
64-
ref: ${{ github.event.repository.default_branch }}
65-
persist-credentials: false # required for pushing to protected branch later
66-
fetch-depth: 0 # required for changelog generation
67-
68-
- name: Bump version
69-
id: bump-version
70-
uses: bakdata/ci-templates/actions/bump-version@v1.21.2
71-
with:
72-
release-type: ${{ inputs.release-type }}
73-
working-directory: ${{ inputs.working-directory }}
74-
75-
- name: Create changelog
76-
id: build-changelog
77-
uses: bakdata/ci-templates/actions/changelog-generate@1.52.1
78-
if: ${{ inputs.changelog }}
79-
with:
80-
github-token: ${{ secrets.github-token }}
81-
tag: ${{ steps.bump-version.outputs.release-version }}
82-
changelog-file: ${{ inputs.changelog-file }}
83-
84-
- name: Commit and push changes including .bumpversion.cfg file
85-
uses: bakdata/ci-templates/actions/commit-and-push@v1.6.0
86-
with:
87-
ref: ${{ github.event.repository.default_branch }}
88-
commit-message: "Bump version ${{ steps.bump-version.outputs.old-version }} → ${{ steps.bump-version.outputs.release-version }}"
89-
github-username: ${{ secrets.github-username }}
90-
github-email: ${{ secrets.github-email }}
91-
github-token: ${{ secrets.github-token }}
92-
93-
- name: Tag and release
94-
uses: bakdata/ci-templates/actions/tag-and-release@v1.22.0
95-
with:
96-
tag: "${{ steps.bump-version.outputs.release-version }}"
97-
github-username: ${{ secrets.github-username }}
98-
github-email: ${{ secrets.github-email }}
99-
github-token: ${{ secrets.github-token }}
100-
release-title: "${{ steps.bump-version.outputs.release-version }}"
101-
release-body: "${{ steps.build-changelog.outputs.single-changelog }}"
44+
release:
45+
runs-on: ubuntu-22.04
46+
outputs:
47+
release-version: ${{ steps.bump-version.outputs.release-version }}
48+
old-version: ${{ steps.bump-version.outputs.old-version }}
49+
steps:
50+
- name: Authenticate with GCloud
51+
uses: google-github-actions/auth@v2
52+
id: auth
53+
with:
54+
workload_identity_provider: ${{ secrets.GOOGLE_WORKLOAD_IDENTITY_PROVIDER }}
55+
service_account: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
56+
- name: Fetch secrets from GSM
57+
id: fetch-secrets
58+
uses: google-github-actions/get-secretmanager-secrets@v2
59+
with:
60+
secrets: |-
61+
github-email:${{ secrets.GOOGLE_PROJECT_ID }}/GH_EMAIL
62+
github-token:${{ secrets.GOOGLE_PROJECT_ID }}/GH_TOKEN
63+
github-username:${{ secrets.GOOGLE_PROJECT_ID }}/GH_USERNAME
64+
export_to_environment: 'true'
65+
- name: Check out repository
66+
uses: bakdata/ci-templates/actions/checkout@1.49.0
67+
with:
68+
ref: ${{ github.event.repository.default_branch }}
69+
persist-credentials: false
70+
fetch-depth: 0
71+
- name: Bump version
72+
id: bump-version
73+
uses: bakdata/ci-templates/actions/bump-version@v1.21.2
74+
with:
75+
release-type: ${{ inputs.release-type }}
76+
working-directory: ${{ inputs.working-directory }}
77+
- name: Create changelog
78+
id: build-changelog
79+
uses: bakdata/ci-templates/actions/changelog-generate@1.52.1
80+
if: ${{ inputs.changelog }}
81+
with:
82+
github-token: ${{ env.github-token }}
83+
tag: ${{ steps.bump-version.outputs.release-version }}
84+
changelog-file: ${{ inputs.changelog-file }}
85+
- name: Commit and push changes including .bumpversion.cfg file
86+
uses: bakdata/ci-templates/actions/commit-and-push@v1.6.0
87+
with:
88+
ref: ${{ github.event.repository.default_branch }}
89+
commit-message: "Bump version ${{ steps.bump-version.outputs.old-version }} \u2192 ${{ steps.bump-version.outputs.release-version }}"
90+
github-username: ${{ env.github-username }}
91+
github-email: ${{ env.github-email }}
92+
github-token: ${{ env.github-token }}
93+
- name: Tag and release
94+
uses: bakdata/ci-templates/actions/tag-and-release@v1.22.0
95+
with:
96+
tag: ${{ steps.bump-version.outputs.release-version }}
97+
github-username: ${{ env.github-username }}
98+
github-email: ${{ env.github-email }}
99+
github-token: ${{ env.github-token }}
100+
release-title: ${{ steps.bump-version.outputs.release-version }}
101+
release-body: ${{ steps.build-changelog.outputs.single-changelog }}
102+
permissions:
103+
contents: read
104+
id-token: write

0 commit comments

Comments
 (0)