2f0b4dbd9b
* Add support for specifying authentication via JSON service account keys * Update README.md Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com> * Update README.md Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com> * Update README.md Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com> * Review feedback * Undo interface * Use TokenCreator instead Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>
159 lines
4.2 KiB
YAML
159 lines
4.2 KiB
YAML
name: 'test'
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- 'main'
|
|
pull_request:
|
|
branches:
|
|
- 'main'
|
|
|
|
jobs:
|
|
unit:
|
|
name: 'unit'
|
|
runs-on: 'ubuntu-latest'
|
|
|
|
steps:
|
|
- uses: 'actions/checkout@v2'
|
|
|
|
- uses: 'actions/setup-node@v2'
|
|
with:
|
|
node-version: '12.x'
|
|
|
|
- name: 'npm install'
|
|
run: 'npm install'
|
|
|
|
- name: 'npm lint'
|
|
run: 'npm run lint'
|
|
|
|
- name: 'npm test'
|
|
run: 'npm run test'
|
|
|
|
|
|
credentials_json:
|
|
name: 'credentials_json'
|
|
runs-on: '${{ matrix.os }}'
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os:
|
|
- 'ubuntu-latest'
|
|
- 'windows-latest'
|
|
- 'macos-latest'
|
|
|
|
steps:
|
|
- uses: 'actions/checkout@v2'
|
|
|
|
- uses: 'actions/setup-node@v2'
|
|
with:
|
|
node-version: '12.x'
|
|
|
|
- id: 'auth-default'
|
|
name: 'auth-default'
|
|
uses: './'
|
|
with:
|
|
credentials_json: '${{ secrets.GOOGLE_CREDENTIALS }}'
|
|
|
|
- id: 'setup-gcloud'
|
|
name: 'setup-gcloud'
|
|
uses: 'google-github-actions/setup-gcloud@master'
|
|
|
|
- id: 'gcloud'
|
|
name: 'gcloud'
|
|
shell: 'bash'
|
|
run: |-
|
|
gcloud secrets versions access "latest" --secret "my-secret"
|
|
|
|
- id: 'auth-access-token'
|
|
name: 'auth-access-token'
|
|
uses: './'
|
|
with:
|
|
credentials_json: '${{ secrets.GOOGLE_CREDENTIALS }}'
|
|
token_format: 'access_token'
|
|
|
|
- id: 'access-token'
|
|
name: 'access-token'
|
|
shell: 'bash'
|
|
run: |-
|
|
curl https://secretmanager.googleapis.com/v1/projects/${{ steps.auth-access-token.outputs.project_id }}/secrets/my-secret/versions/latest:access \
|
|
--silent \
|
|
--show-error \
|
|
--fail \
|
|
--header "Authorization: Bearer ${{ steps.auth-access-token.outputs.access_token }}"
|
|
|
|
- id: 'auth-id-token'
|
|
name: 'auth-id-token'
|
|
uses: './'
|
|
with:
|
|
credentials_json: '${{ secrets.GOOGLE_CREDENTIALS }}'
|
|
token_format: 'id_token'
|
|
id_token_audience: 'https://secretmanager.googleapis.com/'
|
|
id_token_include_email: true
|
|
|
|
|
|
workload_identity_federation:
|
|
name: 'workload_identity_federation'
|
|
runs-on: '${{ matrix.os }}'
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os:
|
|
- 'ubuntu-latest'
|
|
- 'windows-latest'
|
|
- 'macos-latest'
|
|
|
|
permissions:
|
|
id-token: 'write'
|
|
|
|
steps:
|
|
- uses: 'actions/checkout@v2'
|
|
|
|
- uses: 'actions/setup-node@v2'
|
|
with:
|
|
node-version: '12.x'
|
|
|
|
- id: 'auth-default'
|
|
name: 'auth-default'
|
|
uses: './'
|
|
with:
|
|
workload_identity_provider: 'projects/469401941463/locations/global/workloadIdentityPools/github-actions/providers/google-github-actions'
|
|
service_account: 'github-secret-accessor@actions-oidc-test.iam.gserviceaccount.com'
|
|
|
|
- id: 'setup-gcloud'
|
|
name: 'setup-gcloud'
|
|
uses: 'google-github-actions/setup-gcloud@master'
|
|
|
|
- id: 'gcloud'
|
|
name: 'gcloud'
|
|
shell: 'bash'
|
|
run: |-
|
|
gcloud secrets versions access "latest" --secret "my-secret"
|
|
|
|
- id: 'auth-access-token'
|
|
name: 'auth-access-token'
|
|
uses: './'
|
|
with:
|
|
workload_identity_provider: 'projects/469401941463/locations/global/workloadIdentityPools/github-actions/providers/google-github-actions'
|
|
service_account: 'github-secret-accessor@actions-oidc-test.iam.gserviceaccount.com'
|
|
token_format: 'access_token'
|
|
|
|
- id: 'access-token'
|
|
name: 'access-token'
|
|
shell: 'bash'
|
|
run: |-
|
|
curl https://secretmanager.googleapis.com/v1/projects/${{ steps.auth-access-token.outputs.project_id }}/secrets/my-secret/versions/latest:access \
|
|
--silent \
|
|
--show-error \
|
|
--fail \
|
|
--header "Authorization: Bearer ${{ steps.auth-access-token.outputs.access_token }}"
|
|
|
|
- id: 'auth-id-token'
|
|
name: 'auth-id-token'
|
|
uses: './'
|
|
with:
|
|
workload_identity_provider: 'projects/469401941463/locations/global/workloadIdentityPools/github-actions/providers/google-github-actions'
|
|
service_account: 'github-secret-accessor@actions-oidc-test.iam.gserviceaccount.com'
|
|
token_format: 'id_token'
|
|
id_token_audience: 'https://secretmanager.googleapis.com/'
|
|
id_token_include_email: true
|