Skip to content

Commit fcb7110

Browse files
denis256denis256
committed
Secrets cleanup
1 parent 757ac50 commit fcb7110

1 file changed

Lines changed: 65 additions & 23 deletions

File tree

‎.github/scripts/setup/generate-secrets.sh‎

Lines changed: 65 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -8,37 +8,79 @@ set -euo pipefail
88
: "${GITHUB_WORKSPACE:?GITHUB_WORKSPACE is not set}"
99
: "${GHA_DEPLOY_KEY:?GHA_DEPLOY_KEY is not set}"
1010

11+
: "${AWS_ACCESS_KEY_ID:?AWS_ACCESS_KEY_ID is not set}"
12+
: "${AWS_SECRET_ACCESS_KEY:?AWS_SECRET_ACCESS_KEY is not set}"
13+
: "${AWS_TEST_S3_ASSUME_ROLE:?AWS_TEST_S3_ASSUME_ROLE is not set}"
14+
: "${AWS_TEST_OIDC_ROLE_ARN:?AWS_TEST_OIDC_ROLE_ARN is not set}"
15+
: "${AWS_TEST_OIDC_CHAIN_SOURCE_ROLE_ARN:?AWS_TEST_OIDC_CHAIN_SOURCE_ROLE_ARN is not set}"
16+
: "${AWS_TEST_OIDC_CHAIN_TARGET_ROLE_ARN:?AWS_TEST_OIDC_CHAIN_TARGET_ROLE_ARN is not set}"
17+
18+
: "${GCLOUD_SERVICE_KEY:?GCLOUD_SERVICE_KEY is not set}"
19+
: "${GOOGLE_CLOUD_PROJECT:?GOOGLE_CLOUD_PROJECT is not set}"
20+
: "${GOOGLE_COMPUTE_ZONE:?GOOGLE_COMPUTE_ZONE is not set}"
21+
: "${GOOGLE_IDENTITY_EMAIL:?GOOGLE_IDENTITY_EMAIL is not set}"
22+
: "${GOOGLE_PROJECT_ID:?GOOGLE_PROJECT_ID is not set}"
23+
: "${GCLOUD_SERVICE_KEY_IMPERSONATOR:?GCLOUD_SERVICE_KEY_IMPERSONATOR is not set}"
24+
1125
# Optional environment variables
1226
SECRETS="${SECRETS:-}"
1327

1428
touch "$ENV_FILE"
1529

16-
# Values are %q-quoted so shell metacharacters cannot terminate the assignment.
1730
# Manually export each secret listed in matrix.integration.secrets
1831
for SECRET in $SECRETS; do
19-
if [[ -z "${!SECRET:-}" ]]; then
20-
echo "$SECRET is not set" >&2
21-
exit 1
32+
if [[ "$SECRET" == "GHA_DEPLOY_KEY" && -n "${GHA_DEPLOY_KEY}" ]]; then
33+
printf "export GHA_DEPLOY_KEY='%s'\n" "${GHA_DEPLOY_KEY}" >>"$ENV_FILE"
34+
elif [[ "$SECRET" == "AWS_ACCESS_KEY_ID" && -n "${AWS_ACCESS_KEY_ID}" ]]; then
35+
printf "export AWS_ACCESS_KEY_ID='%s'\n" "${AWS_ACCESS_KEY_ID}" >>"$ENV_FILE"
36+
elif [[ "$SECRET" == "AWS_SECRET_ACCESS_KEY" && -n "${AWS_SECRET_ACCESS_KEY}" ]]; then
37+
printf "export AWS_SECRET_ACCESS_KEY='%s'\n" "${AWS_SECRET_ACCESS_KEY}" >>"$ENV_FILE"
38+
elif [[ "$SECRET" == "GCLOUD_SERVICE_KEY" && -n "${GCLOUD_SERVICE_KEY}" ]]; then
39+
printf "export GCLOUD_SERVICE_KEY='%s'\n" "${GCLOUD_SERVICE_KEY}" >>"$ENV_FILE"
40+
printf "export GOOGLE_SERVICE_ACCOUNT_JSON='%s'\n" "${GCLOUD_SERVICE_KEY}" >>"$ENV_FILE"
41+
elif [[ "$SECRET" == "GOOGLE_CLOUD_PROJECT" && -n "${GOOGLE_CLOUD_PROJECT}" ]]; then
42+
printf "export GOOGLE_CLOUD_PROJECT='%s'\n" "${GOOGLE_CLOUD_PROJECT}" >>"$ENV_FILE"
43+
elif [[ "$SECRET" == "GOOGLE_COMPUTE_ZONE" && -n "${GOOGLE_COMPUTE_ZONE}" ]]; then
44+
printf "export GOOGLE_COMPUTE_ZONE='%s'\n" "${GOOGLE_COMPUTE_ZONE}" >>"$ENV_FILE"
45+
elif [[ "$SECRET" == "GOOGLE_IDENTITY_EMAIL" && -n "${GOOGLE_IDENTITY_EMAIL}" ]]; then
46+
printf "export GOOGLE_IDENTITY_EMAIL='%s'\n" "${GOOGLE_IDENTITY_EMAIL}" >>"$ENV_FILE"
47+
elif [[ "$SECRET" == "GOOGLE_PROJECT_ID" && -n "${GOOGLE_PROJECT_ID}" ]]; then
48+
printf "export GOOGLE_PROJECT_ID='%s'\n" "${GOOGLE_PROJECT_ID}" >>"$ENV_FILE"
49+
elif [[ "$SECRET" == "GCLOUD_SERVICE_KEY_IMPERSONATOR" && -n "${GCLOUD_SERVICE_KEY_IMPERSONATOR}" ]]; then
50+
printf "export GCLOUD_SERVICE_KEY_IMPERSONATOR='%s'\n" "${GCLOUD_SERVICE_KEY_IMPERSONATOR}" >>"$ENV_FILE"
51+
elif [[ "$SECRET" == "AWS_ACCESS_KEY_ID" && -n "${AWS_ACCESS_KEY_ID}" ]]; then
52+
printf "export AWS_ACCESS_KEY_ID='%s'\n" "${AWS_ACCESS_KEY_ID}" >>"$ENV_FILE"
53+
elif [[ "$SECRET" == "AWS_SECRET_ACCESS_KEY" && -n "${AWS_SECRET_ACCESS_KEY}" ]]; then
54+
printf "export AWS_SECRET_ACCESS_KEY='%s'\n" "${AWS_SECRET_ACCESS_KEY}" >>"$ENV_FILE"
55+
elif [[ "$SECRET" == "AWS_TEST_S3_ASSUME_ROLE" && -n "${AWS_TEST_S3_ASSUME_ROLE}" ]]; then
56+
printf "export AWS_TEST_S3_ASSUME_ROLE='%s'\n" "${AWS_TEST_S3_ASSUME_ROLE}" >>"$ENV_FILE"
57+
elif [[ "$SECRET" == "AWS_TEST_OIDC_ROLE_ARN" && -n "${AWS_TEST_OIDC_ROLE_ARN}" ]]; then
58+
printf "export AWS_TEST_OIDC_ROLE_ARN='%s'\n" "${AWS_TEST_OIDC_ROLE_ARN}" >>"$ENV_FILE"
59+
elif [[ "$SECRET" == "AWS_TEST_OIDC_CHAIN_SOURCE_ROLE_ARN" && -n "${AWS_TEST_OIDC_CHAIN_SOURCE_ROLE_ARN}" ]]; then
60+
printf "export AWS_TEST_OIDC_CHAIN_SOURCE_ROLE_ARN='%s'\n" "${AWS_TEST_OIDC_CHAIN_SOURCE_ROLE_ARN}" >>"$ENV_FILE"
61+
elif [[ "$SECRET" == "AWS_TEST_OIDC_CHAIN_TARGET_ROLE_ARN" && -n "${AWS_TEST_OIDC_CHAIN_TARGET_ROLE_ARN}" ]]; then
62+
printf "export AWS_TEST_OIDC_CHAIN_TARGET_ROLE_ARN='%s'\n" "${AWS_TEST_OIDC_CHAIN_TARGET_ROLE_ARN}" >>"$ENV_FILE"
63+
elif [[ "$SECRET" == "AZURE_CLIENT_ID" && -n "${AZURE_CLIENT_ID:-}" ]]; then
64+
printf "export AZURE_CLIENT_ID='%s'\n" "${AZURE_CLIENT_ID}" >>"$ENV_FILE"
65+
elif [[ "$SECRET" == "AZURE_CLIENT_SECRET" && -n "${AZURE_CLIENT_SECRET:-}" ]]; then
66+
printf "export AZURE_CLIENT_SECRET='%s'\n" "${AZURE_CLIENT_SECRET}" >>"$ENV_FILE"
67+
elif [[ "$SECRET" == "AZURE_TENANT_ID" && -n "${AZURE_TENANT_ID:-}" ]]; then
68+
printf "export AZURE_TENANT_ID='%s'\n" "${AZURE_TENANT_ID}" >>"$ENV_FILE"
69+
elif [[ "$SECRET" == "TG_AZURE_TEST_STORAGE_ACCOUNT" && -n "${TG_AZURE_TEST_STORAGE_ACCOUNT:-}" ]]; then
70+
printf "export TG_AZURE_TEST_STORAGE_ACCOUNT='%s'\n" "${TG_AZURE_TEST_STORAGE_ACCOUNT}" >>"$ENV_FILE"
71+
elif [[ "$SECRET" == "TG_AZURE_TEST_SUBSCRIPTION_ID" && -n "${TG_AZURE_TEST_SUBSCRIPTION_ID:-}" ]]; then
72+
printf "export TG_AZURE_TEST_SUBSCRIPTION_ID='%s'\n" "${TG_AZURE_TEST_SUBSCRIPTION_ID}" >>"$ENV_FILE"
73+
elif [[ "$SECRET" == "TG_AZURE_TEST_RESOURCE_GROUP" && -n "${TG_AZURE_TEST_RESOURCE_GROUP:-}" ]]; then
74+
printf "export TG_AZURE_TEST_RESOURCE_GROUP='%s'\n" "${TG_AZURE_TEST_RESOURCE_GROUP}" >>"$ENV_FILE"
75+
elif [[ "$SECRET" == "ARM_CLIENT_ID" && -n "${ARM_CLIENT_ID:-}" ]]; then
76+
printf "export ARM_CLIENT_ID='%s'\n" "${ARM_CLIENT_ID}" >>"$ENV_FILE"
77+
elif [[ "$SECRET" == "ARM_CLIENT_SECRET" && -n "${ARM_CLIENT_SECRET:-}" ]]; then
78+
printf "export ARM_CLIENT_SECRET='%s'\n" "${ARM_CLIENT_SECRET}" >>"$ENV_FILE"
79+
elif [[ "$SECRET" == "ARM_TENANT_ID" && -n "${ARM_TENANT_ID:-}" ]]; then
80+
printf "export ARM_TENANT_ID='%s'\n" "${ARM_TENANT_ID}" >>"$ENV_FILE"
81+
elif [[ "$SECRET" == "ARM_SUBSCRIPTION_ID" && -n "${ARM_SUBSCRIPTION_ID:-}" ]]; then
82+
printf "export ARM_SUBSCRIPTION_ID='%s'\n" "${ARM_SUBSCRIPTION_ID}" >>"$ENV_FILE"
2283
fi
23-
24-
case "$SECRET" in
25-
"GCLOUD_SERVICE_KEY")
26-
printf "export GCLOUD_SERVICE_KEY=%q\n" "${GCLOUD_SERVICE_KEY}" >>"$ENV_FILE"
27-
printf "export GOOGLE_SERVICE_ACCOUNT_JSON=%q\n" "${GCLOUD_SERVICE_KEY}" >>"$ENV_FILE"
28-
;;
29-
"GHA_DEPLOY_KEY" | "AWS_ACCESS_KEY_ID" | "AWS_SECRET_ACCESS_KEY" | "AWS_TEST_S3_ASSUME_ROLE" | \
30-
"AWS_TEST_OIDC_ROLE_ARN" | "AWS_TEST_OIDC_CHAIN_SOURCE_ROLE_ARN" | "AWS_TEST_OIDC_CHAIN_TARGET_ROLE_ARN" | \
31-
"GOOGLE_CLOUD_PROJECT" | "GOOGLE_COMPUTE_ZONE" | "GOOGLE_IDENTITY_EMAIL" | "GOOGLE_PROJECT_ID" | \
32-
"GCLOUD_SERVICE_KEY_IMPERSONATOR" | "AZURE_CLIENT_ID" | "AZURE_CLIENT_SECRET" | "AZURE_TENANT_ID" | \
33-
"TG_AZURE_TEST_STORAGE_ACCOUNT" | "TG_AZURE_TEST_SUBSCRIPTION_ID" | "TG_AZURE_TEST_RESOURCE_GROUP" | \
34-
"ARM_CLIENT_ID" | "ARM_CLIENT_SECRET" | "ARM_TENANT_ID" | "ARM_SUBSCRIPTION_ID")
35-
printf "export %s=%q\n" "$SECRET" "${!SECRET}" >>"$ENV_FILE"
36-
;;
37-
*)
38-
echo "$SECRET is not supported" >&2
39-
exit 1
40-
;;
41-
esac
4284
done
4385

4486
echo "Created environment file with secrets for $NAME"

0 commit comments

Comments
 (0)