google-github-actions / get-secretmanager-secrets Goto Github PK

inputs:
  secrets_to_fetch:
    type: string
    description: "Comma-separated secret names. e.g. 'my_secret,your_secret' " 

 - name: Get Secrets from Secret Manager
        id: get-secrets
        uses: google-github-actions/get-secretmanager-secrets@v1
        with:
          project_id: your-project-id
          secrets: ${{ inputs.secrets_to_fetch }}

secret_one:<project-id>/secret_one\nsecret_two:<project-id>/secret_two

- name: Setup deploy variables
id: secrets
run: |
  ACCESS_KEY_ID=$(gcloud secrets versions access 1 --secret=access_key_id)
  SECRET_ACCESS_KEY=$(gcloud secrets versions access 1 --secret=secret_access_key)
  echo "::add-mask::$ACCESS_KEY_ID"
  echo "::add-mask::$SECRET_ACCESS_KEY"
  echo "SECRET_ACCESS_KEY=$SECRET_ACCESS_KEY" >> $GITHUB_OUTPUT
  echo "ACCESS_KEY_ID=$ACCESS_KEY_ID" >> $GITHUB_OUTPUT
- name: Deploy 
  run: |
    # requires SECRET_ACCESS_KEY and ACCESS_KEY_ID
    pnpm run deploy
  env:
    SECRET_ACCESS_KEY: ${{ steps.secrets.outputs.SECRET_ACCESS_KEY }}
    ACCESS_KEY_ID: ${{ steps.secrets.outputs.ACCESS_KEY_ID }}

- name: Retrieve required env variables
  id: secrets
  uses: google-github-actions/get-secretmanager-secrets@v1
  with:
    secrets: |-
      access_key_id:projects/000000000/secrets/access_key_id/versions/1
      secret_access_key:projects/000000000/secrets/secret_access_key/versions/1
- name: Deploy 
  run: |
    # requires SECRET_ACCESS_KEY and ACCESS_KEY_ID
    pnpm run deploy
  env:
    SECRET_ACCESS_KEY: ${{ steps.secrets.outputs.secret_access_key }}
    ACCESS_KEY_ID: ${{ steps.secrets.outputs.access_key_id }}

name: Docker build check
on: [workflow_dispatch, pull_request]
concurrency:
  group: docker-build-${{ github.ref }}
  cancel-in-progress: true
jobs:
  docker-build:
    runs-on: [self-hosted, preemptible]
    env:
      NODE_ENV: test
    steps:
      - name: setup node
        uses: actions/setup-node@v2
        with:
          node-version: 'lts/*'
      - uses: actions/checkout@v2
      - uses: google-github-actions/setup-gcloud@master
        with:
          project_id: ${{ secrets.xxx }}
          service_account_key: ${{ secrets.xxx }}
          export_default_credentials: true
          credentials_file_path: .xxx.json
      - id: secrets
        uses: google-github-actions/get-secretmanager-secrets@main
        with:
          secrets: |-
            CMS_API_TOKEN:xxx/INTEGRATION_XXX
            SHEETS_CMS_API_KEY:xxx/SHEETS_XXX
      - name: write .env
        run: |
          cat << EOF > .env
          BUTTERCMS_API_TOKEN=${{ steps.secrets.outputs.BUTTERCMS_API_TOKEN }}
          GCP_PROJECT_ID=${{ secrets.GCP_PROJECT_ID }}
          SHEETS_TO_CMS_API_KEY=${{ steps.secrets.outputs.SHEETS_TO_CMS_API_KEY }}
          EOF
      - name: docker login
        run: |-
          gcloud --quiet auth configure-docker
      - name: write git-commit.txt
        run: echo "${GITHUB_SHA}" > git-commit.txt
      - name: docker build
        run: |-
          docker build \
            --build-arg GCP_PROJECT_ID=${{ secrets.GCP_PROJECT_ID }} \

name: my-test-workflow

on:
  workflow_dispatch:

env:
  gcloud_project: secrets-project

jobs:
  test-workflow:
    runs-on: [self-hosted, gke-cluster]

      - name: Checkout
        uses: actions/[email protected]

      - name: Create environment variables
        run: |
          echo gcloud_version=$(/google-cloud-sdk/bin/gcloud --format=json version|jq -r '."Google Cloud SDK"') >> $GITHUB_ENV

      - name: Set up Cloud SDK
        uses: google-github-actions/[email protected]
        with:
          project_id: ${{ env.gcloud_project }}
          version: ${{ env.gcloud_version }}

      - name: Get Google Secretsmanager secret by CLI
        id: "cli-secrets"
        run: |
          echo "::set-output name=my-secret::$(gcloud secrets versions access latest --secret='this-is-my-secret')"

      - name: Get Google Secretsmanager secret by APP
        id: "app-secrets"
        uses: "google-github-actions/[email protected]"
        with:
          secrets: |-
            my-secret:123456789012/this-is-my-secret

      - name: Write the secrets content
        if: always()
        run: |
          echo "${{ steps.cli-secrets.outputs.my-secret }}"
          echo "${{ steps.app-secrets.outputs.my-secret }}"

    - name: Setup Cloud SDK
      uses: google-github-actions/setup-gcloud@master
      with:
        service_account_key: ${{ secrets.GCLOUD_AUTH }}
        export_default_credentials: true

    - name: Get Secrets from GSM
      uses: google-github-actions/get-secretmanager-secrets@main
      with:
        secrets: |-
          ALLOWED_USERS:pokegambler/ALLOWED_USERS/${{ env.SECRET_VERSION }}
          ANNOUNCEMENT_CHANNEL:pokegambler/ANNOUNCEMENT_CHANNEL/${{ env.SECRET_VERSION }}
          DEFAULT_GUILDMODE:pokegambler/DEFAULT_GUILDMODE/${{ env.SECRET_VERSION }}
          DISCORD_WEBHOOK_CHANNEL:pokegambler/DISCORD_WEBHOOK_CHANNEL/${{ env.SECRET_VERSION }}
          DISCORD_WEBHOOK_TOKEN:pokegambler/DISCORD_WEBHOOK_TOKEN/${{ env.SECRET_VERSION }}
          IMG_UPLOAD_CHANNEL:pokegambler/IMG_UPLOAD_CHANNEL/${{ env.SECRET_VERSION }}
          MONGO_CLUSTER_STRING:pokegambler/MONGO_CLUSTER_STRING/${{ env.SECRET_VERSION }}
          OFFICIAL_SERVER:pokegambler/OFFICIAL_SERVER/${{ env.SECRET_VERSION }}
          TOKEN:pokegambler/TOKEN/${{ env.SECRET_VERSION }}
          WHITELIST_GUILDS:pokegambler/WHITELIST_GUILDS/${{ env.SECRET_VERSION }}

    - name: Deploy to GKE
      run: |-
         kubectl delete secret pokegambler-$(echo ${{ env.TAG }}) --ignore-not-found
         kubectl create secret generic pokegambler-$(echo ${{ env.TAG }}) \
           --from-literal=TOKEN=${{ steps.secrets.outputs.TOKEN }} \
           --from-literal=DISCORD_WEBHOOK_CHANNEL=${{ steps.secrets.outputs.DISCORD_WEBHOOK_CHANNEL }} \
           --from-literal=DISCORD_WEBHOOK_TOKEN=${{ steps.secrets.outputs.DISCORD_WEBHOOK_TOKEN }} \
           --from-literal=ANNOUNCEMENT_CHANNEL=${{ steps.secrets.outputs.ANNOUNCEMENT_CHANNEL }} \
           --from-literal=OWNER_ID=${{ steps.secrets.outputs.OWNER_ID }} \
           --from-literal=WHITELIST_GUILDS=${{ steps.secrets.outputs.WHITELIST_GUILDS }} \
           --from-literal=DEFAULT_GUILDMODE=${{ steps.secrets.outputs.DEFAULT_GUILDMODE }} \
           --from-literal=IMG_UPLOAD_CHANNEL=${{ steps.secrets.outputs.IMG_UPLOAD_CHANNEL }} \
           --from-literal=ADMIN_CMD_LOG_CHANNEL=${{ steps.secrets.outputs.ADMIN_CMD_LOG_CHANNEL }} \
           --from-literal=OFFICIAL_SERVER=${{ steps.secrets.outputs.OFFICIAL_SERVER }} \
           --from-literal=MONGO_CLUSTER_STRING=${{ steps.secrets.outputs.MONGO_CLUSTER_STRING }}
         ./kustomize build deployments/${{ env.TAG }} | kubectl apply -f -
         kubectl rollout status deployment/pokegambler-$(echo ${{ env.TAG }})
         kubectl get services -o wide

deploy:
    name: Deploy
    runs-on: ubuntu-20.04
    permissions:
      actions: write
      checks: read
      contents: read
      deployments: read
      id-token: write
      pull-requests: read
      statuses: read
    needs: [build-web, build-api]
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set VPN secrets
        uses: dominicwatson/github-action-envsubst@v1
        with:
          files: .github/github.ovpn
        env:
          VPN_CA: ${{ secrets.VPN_CA}}
          VPN_CERT: ${{ secrets.VPN_CERT }}
          VPN_KEY: ${{ secrets.VPN_KEY }}
          VPN_TLS: ${{ secrets.VPN_TLS }}

      - name: Connect to VPN
        run: |-
          sudo apt-get -qq update && sudo apt-get -qq install openvpn -y
          sudo openvpn --config .github/github.ovpn --daemon

      - uses: chrnorm/deployment-action@releases/v1
        name: Create GitHub deployment
        id: deployment
        with:
          token: ${{ secrets.PAT }}
          target_url: https://xxxxxxxxxxx
          environment: xxxxxxxxxxx
          ref: master

      - id: "auth"
        name: "Authenticate to Google Cloud"
        uses: "google-github-actions/auth@v0"
        with:
          token_format: "access_token"
          workload_identity_provider: "xxxxxxxxxx"
          audience: "xxxxxxxx"
          service_account: "[email protected]"

      - uses: "google-github-actions/get-gke-credentials@v0"
        name: Get GKE credentials
        with:
          cluster_name: ${{ env.GKE_CLUSTER }}
          location: ${{ env.GKE_ZONE }}

      - name: Get secrets from GCP Secret Manager
        id: secrets
        uses: google-github-actions/[email protected]
        with:
          secrets: |-
            REDIS_URL:projects/xxxxxxxxx/secrets/REDIS_URL
            JWT_SECRET:projects/xxxxxxxxx/secrets/JWT_SECRET
          
      - name: Set URL, secrets and config variables
        uses: dominicwatson/github-action-envsubst@v1
        with:
          files: helm/values.yaml
        env:
          REDIS_URL: ${{ steps.secrets.outputs.REDIS_URL_INTEGRATION }}
          JWT_SECRET: ${{ steps.secrets.outputs.JWT_SECRET }}