Skip to content

Commit 6be88b2

Browse files
devthejodevthejo
authored
fix(ci-cd): use token-bureau (#30)
2 parents 5e425f7 + 3617668 commit 6be88b2

19 files changed

+233
-43
lines changed

‎.github/workflows/release.yml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,23 @@ on:
55
push:
66
branches: [master]
77

8+
permissions:
9+
id-token: write # Required for OIDC token generation
10+
811
jobs:
912
release:
1013
name: Release
1114
runs-on: ubuntu-latest
1215
steps:
16+
- name: Get GitHub App Token
17+
id: token
18+
uses: SocialGouv/token-bureau@main
19+
with:
20+
token-bureau-url: https://token-bureau.fabrique.social.gouv.fr
21+
audience: socialgouv
22+
1323
- uses: socialgouv/workflows/actions/semantic-release@v1
1424
with:
15-
github-token: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
25+
github-token: ${{ steps.token.outputs.token }}
1626
author-name: ${{ secrets.SOCIALGROOVYBOT_NAME }}
1727
author-email: ${{ secrets.SOCIALGROOVYBOT_EMAIL }}

‎.github/workflows/use-ks-gh-deactivate.yaml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ on:
2525
KS_NOTIFY_MATTERMOST_WEBHOOK_URL:
2626
required: false
2727

28+
permissions:
29+
id-token: write # Required for OIDC token generation
30+
2831
jobs:
2932
deploy:
3033
name: Deactivate Pipeline ♻️
@@ -71,12 +74,19 @@ jobs:
7174
env: ${{ steps.deployment-vars.outputs.deployment-name }}
7275
desc: Deployment was pruned
7376

77+
- name: Get GitHub App Token
78+
id: token
79+
uses: SocialGouv/token-bureau@main
80+
with:
81+
token-bureau-url: https://token-bureau.fabrique.social.gouv.fr
82+
audience: socialgouv
83+
7484
- name: Clean review sub environment
7585
uses: socialgouv/deployments@v1
7686
continue-on-error: true
7787
with:
7888
step: delete-env
79-
token: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
89+
token: ${{ steps.token.outputs.token }}
8090
env: ${{ steps.deployment-vars.outputs.deployment-name }}
8191
desc: Environment was pruned
8292

‎.github/workflows/use-ks-gh-preproduction.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ on:
1515
required: false
1616
type: string
1717

18+
permissions:
19+
id-token: write # Required for OIDC token generation
20+
1821
jobs:
1922
deploy:
2023
name: 🐳 Deploy PreProd on Kubernetes
@@ -26,11 +29,18 @@ jobs:
2629
- name: Checkout repository
2730
uses: actions/checkout@v4
2831

32+
- name: Get GitHub App Token
33+
id: token
34+
uses: SocialGouv/token-bureau@main
35+
with:
36+
token-bureau-url: https://token-bureau.fabrique.social.gouv.fr
37+
audience: socialgouv
38+
2939
- uses: socialgouv/workflows/actions/deployment-starting@v1
3040
id: deployment-starting
3141
with:
3242
token: ${{ secrets.GITHUB_TOKEN }}
33-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
43+
pat: ${{ steps.token.outputs.token }}
3444
environment-scope: preproduction
3545

3646
- uses: socialgouv/kontinuous/.github/actions/deploy-via-github@v1
@@ -49,7 +59,7 @@ jobs:
4959
- uses: socialgouv/workflows/actions/deployment-ending@v1
5060
id: deployment-ending
5161
with:
52-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
62+
pat: ${{ steps.token.outputs.token }}
5363
token: ${{ secrets.GITHUB_TOKEN }}
5464
deployment-id: ${{ steps.deployment-starting.outputs.deployment-id }}
5565
deployment-name:

‎.github/workflows/use-ks-gh-production.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ on:
1515
required: false
1616
type: string
1717

18+
permissions:
19+
id-token: write # Required for OIDC token generation
20+
1821
jobs:
1922
deploy:
2023
name: 🐳 Deploy Production on Kubernetes
@@ -26,11 +29,18 @@ jobs:
2629
- name: Checkout repository
2730
uses: actions/checkout@v4
2831

32+
- name: Get GitHub App Token
33+
id: token
34+
uses: SocialGouv/token-bureau@main
35+
with:
36+
token-bureau-url: https://token-bureau.fabrique.social.gouv.fr
37+
audience: socialgouv
38+
2939
- uses: socialgouv/workflows/actions/deployment-starting@v1
3040
id: deployment-starting
3141
with:
3242
token: ${{ secrets.GITHUB_TOKEN }}
33-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
43+
pat: ${{ steps.token.outputs.token }}
3444
environment-scope: production
3545

3646
- uses: socialgouv/kontinuous/.github/actions/deploy-via-github@v1
@@ -49,7 +59,7 @@ jobs:
4959
- uses: socialgouv/workflows/actions/deployment-ending@v1
5060
id: deployment-ending
5161
with:
52-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
62+
pat: ${{ steps.token.outputs.token }}
5363
token: ${{ secrets.GITHUB_TOKEN }}
5464
deployment-id: ${{ steps.deployment-starting.outputs.deployment-id }}
5565
deployment-name:

‎.github/workflows/use-ks-gh-review-auto.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ on:
1515
required: false
1616
type: string
1717

18+
permissions:
19+
id-token: write # Required for OIDC token generation
20+
1821
jobs:
1922
deploy:
2023
name: 🐳 Deploy Review on Kubernetes
@@ -26,11 +29,18 @@ jobs:
2629
- name: Checkout repository
2730
uses: actions/checkout@v4
2831

32+
- name: Get GitHub App Token
33+
id: token
34+
uses: SocialGouv/token-bureau@main
35+
with:
36+
token-bureau-url: https://token-bureau.fabrique.social.gouv.fr
37+
audience: socialgouv
38+
2939
- uses: socialgouv/workflows/actions/deployment-starting@v1
3040
id: deployment-starting
3141
with:
3242
token: ${{ secrets.GITHUB_TOKEN }}
33-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
43+
pat: ${{ steps.token.outputs.token }}
3444
environment-scope: review
3545

3646
- uses: socialgouv/kontinuous/.github/actions/deploy-via-github@v1
@@ -49,7 +59,7 @@ jobs:
4959
- uses: socialgouv/workflows/actions/deployment-ending@v1
5060
id: deployment-ending
5161
with:
52-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
62+
pat: ${{ steps.token.outputs.token }}
5363
token: ${{ secrets.GITHUB_TOKEN }}
5464
deployment-id: ${{ steps.deployment-starting.outputs.deployment-id }}
5565
deployment-name:

‎.github/workflows/use-ks-gh-review.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ on:
1515
required: false
1616
type: string
1717

18+
permissions:
19+
id-token: write # Required for OIDC token generation
20+
1821
jobs:
1922
deploy:
2023
name: 🐳 Deploy Review on Kubernetes
@@ -26,11 +29,18 @@ jobs:
2629
- name: Checkout repository
2730
uses: actions/checkout@v4
2831

32+
- name: Get GitHub App Token
33+
id: token
34+
uses: SocialGouv/token-bureau@main
35+
with:
36+
token-bureau-url: https://token-bureau.fabrique.social.gouv.fr
37+
audience: socialgouv
38+
2939
- uses: socialgouv/workflows/actions/deployment-starting@v1
3040
id: deployment-starting
3141
with:
3242
token: ${{ secrets.GITHUB_TOKEN }}
33-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
43+
pat: ${{ steps.token.outputs.token }}
3444
environment-scope: review
3545

3646
- uses: socialgouv/kontinuous/.github/actions/deploy-via-github@v1
@@ -49,7 +59,7 @@ jobs:
4959
- uses: socialgouv/workflows/actions/deployment-ending@v1
5060
id: deployment-ending
5161
with:
52-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
62+
pat: ${{ steps.token.outputs.token }}
5363
token: ${{ secrets.GITHUB_TOKEN }}
5464
deployment-id: ${{ steps.deployment-starting.outputs.deployment-id }}
5565
deployment-name:

‎.github/workflows/use-ks-gh-with-env-deactivate.yaml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ on:
2525
KS_NOTIFY_MATTERMOST_WEBHOOK_URL:
2626
required: false
2727

28+
permissions:
29+
id-token: write # Required for OIDC token generation
30+
2831
jobs:
2932
deploy:
3033
name: Deactivate Pipeline ♻️
@@ -71,12 +74,19 @@ jobs:
7174
env: ${{ steps.deployment-vars.outputs.deployment-name }}
7275
desc: Deployment was pruned
7376

77+
- name: Get GitHub App Token
78+
id: token
79+
uses: SocialGouv/token-bureau@main
80+
with:
81+
token-bureau-url: https://token-bureau.fabrique.social.gouv.fr
82+
audience: socialgouv
83+
7484
- name: Clean review sub environment
7585
uses: socialgouv/deployments@v1
7686
continue-on-error: true
7787
with:
7888
step: delete-env
79-
token: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
89+
token: ${{ steps.token.outputs.token }}
8090
env: ${{ steps.deployment-vars.outputs.deployment-name }}
8191
desc: Environment was pruned
8292

‎.github/workflows/use-ks-gh-with-env-preproduction.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ on:
1515
required: false
1616
type: string
1717

18+
permissions:
19+
id-token: write # Required for OIDC token generation
20+
1821
jobs:
1922
deploy:
2023
name: 🐳 Deploy PreProd on Kubernetes
@@ -26,11 +29,18 @@ jobs:
2629
- name: Checkout repository
2730
uses: actions/checkout@v4
2831

32+
- name: Get GitHub App Token
33+
id: token
34+
uses: SocialGouv/token-bureau@main
35+
with:
36+
token-bureau-url: https://token-bureau.fabrique.social.gouv.fr
37+
audience: socialgouv
38+
2939
- uses: socialgouv/workflows/actions/deployment-starting@v1
3040
id: deployment-starting
3141
with:
3242
token: ${{ secrets.GITHUB_TOKEN }}
33-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
43+
pat: ${{ steps.token.outputs.token }}
3444
environment-scope: preproduction
3545
github-env-enabled: true
3646

@@ -50,7 +60,7 @@ jobs:
5060
- uses: socialgouv/workflows/actions/deployment-ending@v1
5161
id: deployment-ending
5262
with:
53-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
63+
pat: ${{ steps.token.outputs.token }}
5464
token: ${{ secrets.GITHUB_TOKEN }}
5565
deployment-id: ${{ steps.deployment-starting.outputs.deployment-id }}
5666
deployment-name:

‎.github/workflows/use-ks-gh-with-env-production.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ on:
1515
required: false
1616
type: string
1717

18+
permissions:
19+
id-token: write # Required for OIDC token generation
20+
1821
jobs:
1922
deploy:
2023
name: 🐳 Deploy Production on Kubernetes
@@ -26,11 +29,18 @@ jobs:
2629
- name: Checkout repository
2730
uses: actions/checkout@v4
2831

32+
- name: Get GitHub App Token
33+
id: token
34+
uses: SocialGouv/token-bureau@main
35+
with:
36+
token-bureau-url: https://token-bureau.fabrique.social.gouv.fr
37+
audience: socialgouv
38+
2939
- uses: socialgouv/workflows/actions/deployment-starting@v1
3040
id: deployment-starting
3141
with:
3242
token: ${{ secrets.GITHUB_TOKEN }}
33-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
43+
pat: ${{ steps.token.outputs.token }}
3444
environment-scope: production
3545
github-env-enabled: true
3646

@@ -50,7 +60,7 @@ jobs:
5060
- uses: socialgouv/workflows/actions/deployment-ending@v1
5161
id: deployment-ending
5262
with:
53-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
63+
pat: ${{ steps.token.outputs.token }}
5464
token: ${{ secrets.GITHUB_TOKEN }}
5565
deployment-id: ${{ steps.deployment-starting.outputs.deployment-id }}
5666
deployment-name:

‎.github/workflows/use-ks-gh-with-env-review-auto.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ on:
1515
required: false
1616
type: string
1717

18+
permissions:
19+
id-token: write # Required for OIDC token generation
20+
1821
jobs:
1922
deploy:
2023
name: 🐳 Deploy Review on Kubernetes
@@ -26,11 +29,18 @@ jobs:
2629
- name: Checkout repository
2730
uses: actions/checkout@v4
2831

32+
- name: Get GitHub App Token
33+
id: token
34+
uses: SocialGouv/token-bureau@main
35+
with:
36+
token-bureau-url: https://token-bureau.fabrique.social.gouv.fr
37+
audience: socialgouv
38+
2939
- uses: socialgouv/workflows/actions/deployment-starting@v1
3040
id: deployment-starting
3141
with:
3242
token: ${{ secrets.GITHUB_TOKEN }}
33-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
43+
pat: ${{ steps.token.outputs.token }}
3444
environment-scope: review
3545
github-env-enabled: true
3646

@@ -50,7 +60,7 @@ jobs:
5060
- uses: socialgouv/workflows/actions/deployment-ending@v1
5161
id: deployment-ending
5262
with:
53-
pat: ${{ secrets.SOCIALGROOVYBOT_BOTO_PAT }}
63+
pat: ${{ steps.token.outputs.token }}
5464
token: ${{ secrets.GITHUB_TOKEN }}
5565
deployment-id: ${{ steps.deployment-starting.outputs.deployment-id }}
5666
deployment-name:

0 commit comments

Comments
 (0)