Upstream/bitwarden-browser
1
0
Fork 0
mirror of https://github.com/bitwarden/browser.git synced 2024-12-01 13:13:36 +01:00
Code Issues Projects Releases Wiki Activity

Update retrieve secrets steps in workflows (#3705)

Browse Source
This commit is contained in:
Vince Grassia 2022-10-13 15:38:47 -04:00 committed by GitHub
parent f489d1b277
commit 3742732ae8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
9 changed files with 89 additions and 204 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
.github/workflows/brew-bump-cli.yml vendored
View File

@ -23,17 +23,10 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
brew-bump-workflow-pat secrets: "brew-bump-workflow-pat"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Update Homebrew formula - name: Update Homebrew formula
uses: dawidd6/action-homebrew-bump-formula@dd221ff435f42fa8102b5871bb1929af9d76476c uses: dawidd6/action-homebrew-bump-formula@dd221ff435f42fa8102b5871bb1929af9d76476c

15
.github/workflows/brew-bump-desktop.yml vendored
View File

@ -23,17 +23,10 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
brew-bump-workflow-pat secrets: "brew-bump-workflow-pat"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Update Homebrew cask - name: Update Homebrew cask
uses: macauley/action-homebrew-bump-cask@445c42390d790569d938f9068d01af39ca030feb uses: macauley/action-homebrew-bump-cask@445c42390d790569d938f9068d01af39ca030feb

45
.github/workflows/build-browser.yml vendored
View File

@ -338,17 +338,10 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
crowdin-api-token secrets: "crowdin-api-token"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Upload Sources - name: Upload Sources
uses: crowdin/github-action@ecd7eb0ef6f3cfa16293c79e9cbc4bc5b5fd9c49 # v1.4.9 uses: crowdin/github-action@ecd7eb0ef6f3cfa16293c79e9cbc4bc5b5fd9c49 # v1.4.9
@ -378,17 +371,10 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
github-pat-bitwarden-devops-bot-repo-scope secrets: "github-pat-bitwarden-devops-bot-repo-scope"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Extract branch name - name: Extract branch name
id: extract_branch id: extract_branch
@ -459,17 +445,10 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
if: failure() if: failure()
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
devops-alerts-slack-webhook-url secrets: "devops-alerts-slack-webhook-url"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Notify Slack on failure - name: Notify Slack on failure
uses: act10ns/slack@da3191ebe2e67f49b46880b4633f5591a96d1d33 # v1.5.0 uses: act10ns/slack@da3191ebe2e67f49b46880b4633f5591a96d1d33 # v1.5.0

15
.github/workflows/build-cli.yml vendored
View File

@ -361,17 +361,10 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
if: failure() if: failure()
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
devops-alerts-slack-webhook-url secrets: "devops-alerts-slack-webhook-url"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Notify Slack on failure - name: Notify Slack on failure
uses: act10ns/slack@da3191ebe2e67f49b46880b4633f5591a96d1d33 uses: act10ns/slack@da3191ebe2e67f49b46880b4633f5591a96d1d33

90
.github/workflows/build-desktop.yml vendored
View File

@ -142,7 +142,7 @@ jobs:
uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
- name: Set up Node - name: Set up Node
uses: actions/setup-node@9ced9a43a244f3ac94f13bfd896db8c8f30da67a # v3.0.0 uses: actions/setup-node@9ced9a43a244f3ac94f13bfd896db8c8f30da67a
with: with:
cache: 'npm' cache: 'npm'
cache-dependency-path: '**/package-lock.json' cache-dependency-path: '**/package-lock.json'
@ -176,7 +176,7 @@ jobs:
working-directory: ./ working-directory: ./
- name: Cache Native Module - name: Cache Native Module
uses: actions/cache@48af2dc4a9e8278b89d7fa154b955c30c6aaab09 # v3.0.2 uses: actions/cache@48af2dc4a9e8278b89d7fa154b955c30c6aaab09
id: cache id: cache
with: with:
path: | path: |
@ -257,7 +257,7 @@ jobs:
uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
- name: Set up Node - name: Set up Node
uses: actions/setup-node@9ced9a43a244f3ac94f13bfd896db8c8f30da67a # v3.0.0 uses: actions/setup-node@9ced9a43a244f3ac94f13bfd896db8c8f30da67a
with: with:
cache: 'npm' cache: 'npm'
cache-dependency-path: '**/package-lock.json' cache-dependency-path: '**/package-lock.json'
@ -297,29 +297,21 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
shell: bash uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
env: with:
KEYVAULT: bitwarden-prod-kv keyvault: "bitwarden-prod-kv"
SECRETS: | secrets: "code-signing-vault-url,
code-signing-vault-url,
code-signing-client-id, code-signing-client-id,
code-signing-tenant-id, code-signing-tenant-id,
code-signing-client-secret, code-signing-client-secret,
code-signing-cert-name code-signing-cert-name"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Install Node dependencies - name: Install Node dependencies
run: npm ci run: npm ci
working-directory: ./ working-directory: ./
- name: Cache Native Module - name: Cache Native Module
uses: actions/cache@48af2dc4a9e8278b89d7fa154b955c30c6aaab09 # v3.0.2 uses: actions/cache@48af2dc4a9e8278b89d7fa154b955c30c6aaab09
id: cache id: cache
with: with:
path: apps/desktop/desktop_native/*.node path: apps/desktop/desktop_native/*.node
@ -478,7 +470,7 @@ jobs:
uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
- name: Set up Node - name: Set up Node
uses: actions/setup-node@9ced9a43a244f3ac94f13bfd896db8c8f30da67a # v3.0.0 uses: actions/setup-node@9ced9a43a244f3ac94f13bfd896db8c8f30da67a
with: with:
cache: 'npm' cache: 'npm'
cache-dependency-path: '**/package-lock.json' cache-dependency-path: '**/package-lock.json'
@ -591,7 +583,7 @@ jobs:
working-directory: ./ working-directory: ./
- name: Cache Native Module - name: Cache Native Module
uses: actions/cache@48af2dc4a9e8278b89d7fa154b955c30c6aaab09 # v3.0.2 uses: actions/cache@48af2dc4a9e8278b89d7fa154b955c30c6aaab09
id: cache id: cache
with: with:
path: apps/desktop/desktop_native/*.node path: apps/desktop/desktop_native/*.node
@ -623,7 +615,7 @@ jobs:
uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
- name: Set up Node - name: Set up Node
uses: actions/setup-node@9ced9a43a244f3ac94f13bfd896db8c8f30da67a # v3.0.0 uses: actions/setup-node@9ced9a43a244f3ac94f13bfd896db8c8f30da67a
with: with:
cache: 'npm' cache: 'npm'
cache-dependency-path: '**/package-lock.json' cache-dependency-path: '**/package-lock.json'
@ -736,7 +728,7 @@ jobs:
working-directory: ./ working-directory: ./
- name: Cache Native Module - name: Cache Native Module
uses: actions/cache@48af2dc4a9e8278b89d7fa154b955c30c6aaab09 # v3.0.2 uses: actions/cache@48af2dc4a9e8278b89d7fa154b955c30c6aaab09
id: cache id: cache
with: with:
path: apps/desktop/desktop_native/*.node path: apps/desktop/desktop_native/*.node
@ -754,7 +746,7 @@ jobs:
- name: Download artifact from hotfix-rc-desktop - name: Download artifact from hotfix-rc-desktop
if: github.ref == 'refs/heads/hotfix-rc-desktop' if: github.ref == 'refs/heads/hotfix-rc-desktop'
uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39 # v2.19.0 uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39
with: with:
workflow: build-browser.yml workflow: build-browser.yml
workflow_conclusion: success workflow_conclusion: success
@ -763,7 +755,7 @@ jobs:
- name: Download artifact from rc - name: Download artifact from rc
if: github.ref == 'refs/heads/rc' if: github.ref == 'refs/heads/rc'
uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39 # v2.19.0 uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39
with: with:
workflow: build-browser.yml workflow: build-browser.yml
workflow_conclusion: success workflow_conclusion: success
@ -772,7 +764,7 @@ jobs:
- name: Download artifact from master - name: Download artifact from master
if: ${{ github.ref != 'refs/heads/rc' && github.ref != 'refs/heads/hotfix-rc-desktop' }} if: ${{ github.ref != 'refs/heads/rc' && github.ref != 'refs/heads/hotfix-rc-desktop' }}
uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39 # v2.19.0 uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39
with: with:
workflow: build-browser.yml workflow: build-browser.yml
workflow_conclusion: success workflow_conclusion: success
@ -841,7 +833,7 @@ jobs:
uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
- name: Set up Node - name: Set up Node
uses: actions/setup-node@9ced9a43a244f3ac94f13bfd896db8c8f30da67a # v3.0.0 uses: actions/setup-node@9ced9a43a244f3ac94f13bfd896db8c8f30da67a
with: with:
cache: 'npm' cache: 'npm'
cache-dependency-path: '**/package-lock.json' cache-dependency-path: '**/package-lock.json'
@ -954,7 +946,7 @@ jobs:
working-directory: ./ working-directory: ./
- name: Cache Native Module - name: Cache Native Module
uses: actions/cache@48af2dc4a9e8278b89d7fa154b955c30c6aaab09 # v3.0.2 uses: actions/cache@48af2dc4a9e8278b89d7fa154b955c30c6aaab09
id: cache id: cache
with: with:
path: apps/desktop/desktop_native/*.node path: apps/desktop/desktop_native/*.node
@ -972,7 +964,7 @@ jobs:
- name: Download artifact from hotfix-rc-desktop - name: Download artifact from hotfix-rc-desktop
if: github.ref == 'refs/heads/hotfix-rc-desktop' if: github.ref == 'refs/heads/hotfix-rc-desktop'
uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39 # v2.19.0 uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39
with: with:
workflow: build-browser.yml workflow: build-browser.yml
workflow_conclusion: success workflow_conclusion: success
@ -981,7 +973,7 @@ jobs:
- name: Download artifact from rc - name: Download artifact from rc
if: github.ref == 'refs/heads/rc' if: github.ref == 'refs/heads/rc'
uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39 # v2.19.0 uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39
with: with:
workflow: build-browser.yml workflow: build-browser.yml
workflow_conclusion: success workflow_conclusion: success
@ -990,7 +982,7 @@ jobs:
- name: Download artifact from master - name: Download artifact from master
if: ${{ github.ref != 'refs/heads/rc' && github.ref != 'refs/heads/hotfix-rc-desktop' }} if: ${{ github.ref != 'refs/heads/rc' && github.ref != 'refs/heads/hotfix-rc-desktop' }}
uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39 # v2.19.0 uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39
with: with:
workflow: build-browser.yml workflow: build-browser.yml
workflow_conclusion: success workflow_conclusion: success
@ -1051,7 +1043,7 @@ jobs:
uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
- name: Set up Node - name: Set up Node
uses: actions/setup-node@9ced9a43a244f3ac94f13bfd896db8c8f30da67a # v3.0.0 uses: actions/setup-node@9ced9a43a244f3ac94f13bfd896db8c8f30da67a
with: with:
cache: 'npm' cache: 'npm'
cache-dependency-path: '**/package-lock.json' cache-dependency-path: '**/package-lock.json'
@ -1159,7 +1151,7 @@ jobs:
working-directory: ./ working-directory: ./
- name: Cache Native Module - name: Cache Native Module
uses: actions/cache@48af2dc4a9e8278b89d7fa154b955c30c6aaab09 # v3.0.2 uses: actions/cache@48af2dc4a9e8278b89d7fa154b955c30c6aaab09
id: cache id: cache
with: with:
path: apps/desktop/desktop_native/*.node path: apps/desktop/desktop_native/*.node
@ -1177,7 +1169,7 @@ jobs:
- name: Download artifact from rc - name: Download artifact from rc
if: github.ref == 'refs/heads/rc' if: github.ref == 'refs/heads/rc'
uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39 # v2.19.0 uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39
with: with:
workflow: build-browser.yml workflow: build-browser.yml
workflow_conclusion: success workflow_conclusion: success
@ -1186,7 +1178,7 @@ jobs:
- name: Download artifact from master - name: Download artifact from master
if: github.ref != 'refs/heads/rc' if: github.ref != 'refs/heads/rc'
uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39 # v2.19.0 uses: dawidd6/action-download-artifact@b2abf1705491048a2d7074f7d90513044fd25d39
with: with:
workflow: build-browser.yml workflow: build-browser.yml
workflow_conclusion: success workflow_conclusion: success
@ -1242,20 +1234,13 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
crowdin-api-token secrets: "crowdin-api-token"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Upload Sources - name: Upload Sources
uses: crowdin/github-action@ecd7eb0ef6f3cfa16293c79e9cbc4bc5b5fd9c49 # v1.4.9 uses: crowdin/github-action@ecd7eb0ef6f3cfa16293c79e9cbc4bc5b5fd9c49
env: env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
CROWDIN_API_TOKEN: ${{ steps.retrieve-secrets.outputs.crowdin-api-token }} CROWDIN_API_TOKEN: ${{ steps.retrieve-secrets.outputs.crowdin-api-token }}
@ -1324,17 +1309,10 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
if: failure() if: failure()
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
devops-alerts-slack-webhook-url secrets: "devops-alerts-slack-webhook-url"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Notify Slack on failure - name: Notify Slack on failure
uses: act10ns/slack@da3191ebe2e67f49b46880b4633f5591a96d1d33 uses: act10ns/slack@da3191ebe2e67f49b46880b4633f5591a96d1d33

30
.github/workflows/build-web.yml vendored
View File

@ -349,17 +349,10 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
crowdin-api-token secrets: "crowdin-api-token"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Upload Sources - name: Upload Sources
uses: crowdin/github-action@ecd7eb0ef6f3cfa16293c79e9cbc4bc5b5fd9c49 # v1.4.9 uses: crowdin/github-action@ecd7eb0ef6f3cfa16293c79e9cbc4bc5b5fd9c49 # v1.4.9
@ -419,17 +412,10 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
if: failure() if: failure()
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
devops-alerts-slack-webhook-url secrets: "devops-alerts-slack-webhook-url"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Notify Slack on failure - name: Notify Slack on failure
uses: act10ns/slack@da3191ebe2e67f49b46880b4633f5591a96d1d33 # v1.5.1 uses: act10ns/slack@da3191ebe2e67f49b46880b4633f5591a96d1d33 # v1.5.1

15
.github/workflows/crowdin-pull.yml vendored
View File

@ -32,17 +32,10 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
crowdin-api-token secrets: "crowdin-api-token"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Download translations - name: Download translations
uses: bitwarden/gh-actions/crowdin@05052c5c575ceb09ceea397fe241879e199ed44b uses: bitwarden/gh-actions/crowdin@05052c5c575ceb09ceea397fe241879e199ed44b

31
.github/workflows/release-cli.yml vendored
View File

@ -148,17 +148,10 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
snapcraft-store-token secrets: "snapcraft-store-token"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Install Snap - name: Install Snap
uses: samuelmeuli/action-snapcraft@10d7d0a84d9d86098b19f872257df314b0bd8e2d # v1.2.0 uses: samuelmeuli/action-snapcraft@10d7d0a84d9d86098b19f872257df314b0bd8e2d # v1.2.0
@ -268,17 +261,10 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
cli-npm-api-key secrets: "cli-npm-api-key"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Download artifacts - name: Download artifacts
if: ${{ github.event.inputs.release_type != 'Dry Run' }} if: ${{ github.event.inputs.release_type != 'Dry Run' }}
@ -313,4 +299,3 @@ jobs:
- name: Publish NPM - name: Publish NPM
if: ${{ github.event.inputs.release_type != 'Dry Run' }} if: ${{ github.event.inputs.release_type != 'Dry Run' }}
run: npm publish --access public --regsitry=https://registry.npmjs.org/ --userconfig=./.npmrc run: npm publish --access public --regsitry=https://registry.npmjs.org/ --userconfig=./.npmrc

37
.github/workflows/release-desktop-beta.yml vendored
View File

@ -249,21 +249,14 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
code-signing-vault-url, secrets: "code-signing-vault-url,
code-signing-client-id, code-signing-client-id,
code-signing-tenant-id, code-signing-tenant-id,
code-signing-client-secret, code-signing-client-secret,
code-signing-cert-name code-signing-cert-name"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Install Node dependencies - name: Install Node dependencies
run: npm ci run: npm ci
@ -939,26 +932,19 @@ jobs:
- name: Retrieve secrets - name: Retrieve secrets
id: retrieve-secrets id: retrieve-secrets
env: uses: bitwarden/gh-actions/get-keyvault-secrets@c3b3285993151c5af47cefcb3b9134c28ab479af
KEYVAULT: bitwarden-prod-kv with:
SECRETS: | keyvault: "bitwarden-prod-kv"
aws-electron-access-id, secrets: "aws-electron-access-id,
aws-electron-access-key, aws-electron-access-key,
aws-electron-bucket-name, aws-electron-bucket-name,
r2-electron-access-id, r2-electron-access-id,
r2-electron-access-key, r2-electron-access-key,
r2-electron-bucket-name, r2-electron-bucket-name,
cf-prod-account cf-prod-account"
run: |
for i in ${SECRETS//,/ }
do
VALUE=$(az keyvault secret show --vault-name $KEYVAULT --name $i --query value --output tsv)
echo "::add-mask::$VALUE"
echo "::set-output name=$i::$VALUE"
done
- name: Download all artifacts - name: Download all artifacts
uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v3.0.0 uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
with: with:
path: apps/desktop/artifacts path: apps/desktop/artifacts
@ -1037,4 +1023,3 @@ jobs:
env: env:
BRANCH: ${{ needs.setup.outputs.branch-name }} BRANCH: ${{ needs.setup.outputs.branch-name }}
run: git push origin --delete $BRANCH run: git push origin --delete $BRANCH