Skip to content

Commit e501aec

Browse files
BUILD-2143: vault migration
1 parent 2251cd9 commit e501aec

File tree

3 files changed

+29
-107
lines changed

3 files changed

+29
-107
lines changed

.cirrus.star

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
load("github.com/SonarSource/cirrus-modules@v2", "load_features")
2+
3+
def main(ctx):
4+
return load_features(ctx, features=["vault"])

.cirrus.yml

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -6,24 +6,19 @@ gcp_credentials: ENCRYPTED[8b32c15733323dbb62734f04c9090473e2272ed5820f6deb0b226
66
#
77
env:
88
### Shared variables
9-
ARTIFACTORY_URL: ENCRYPTED[!2f8fa307d3289faa0aa6791f18b961627ae44f1ef46b136e1a1e63b0b4c86454dbb25520d49b339e2d50a1e1e5f95c88!]
10-
ARTIFACTORY_PRIVATE_USERNAME: repox-private-reader-sq-ef42e7
11-
ARTIFACTORY_PRIVATE_PASSWORD: ENCRYPTED[!bdffdd216a1b768605552475d16e8a5cedd97acbf8ca0aeb7256eaf98a2bc54f752c6c1be5391531742ebfee0cbd2ccf!]
12-
ARTIFACTORY_API_KEY: ENCRYPTED[!bdffdd216a1b768605552475d16e8a5cedd97acbf8ca0aeb7256eaf98a2bc54f752c6c1be5391531742ebfee0cbd2ccf!]
13-
ARTIFACTORY_DEPLOY_USERNAME: repox-qa-deployer-sq-ef42e7
14-
ARTIFACTORY_DEPLOY_PASSWORD: ENCRYPTED[!d8838c939fe77f3b0a0510774c3b270832646e06cab8e477b35ff776933042105d211e7a0fb8ddcf826ce9f53258c519!]
9+
ARTIFACTORY_URL: VAULT[development/kv/data/repox data.url]
10+
ARTIFACTORY_PRIVATE_USERNAME: vault-${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader
11+
ARTIFACTORY_PRIVATE_PASSWORD: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader access_token]
12+
ARTIFACTORY_ACCESS_TOKEN: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader access_token]
13+
ARTIFACTORY_DEPLOY_USERNAME: vault-${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-qa-deployer
14+
ARTIFACTORY_DEPLOY_PASSWORD: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-qa-deployer access_token]
1515
ARTIFACTORY_DEPLOY_REPO: sonarsource-public-qa
1616

1717
CIRRUS_CLONE_DEPTH: 50
1818

19-
GCF_ACCESS_TOKEN: ENCRYPTED[!1fb91961a5c01e06e38834e55755231d649dc62eca354593105af9f9d643d701ae4539ab6a8021278b8d9348ae2ce8be!]
20-
PROMOTE_URL: ENCRYPTED[!e22ed2e34a8f7a1aea5cff653585429bbd3d5151e7201022140218f9c5d620069ec2388f14f83971e3fd726215bc0f5e!]
21-
22-
GITHUB_TOKEN: ENCRYPTED[!f458126aa9ed2ac526f220c5acb51dd9cc255726b34761a56fc78d4294c11089502a882888cef0ca7dd4085e72e611a5!]
23-
24-
BURGR_URL: ENCRYPTED[!c7e294da94762d7bac144abef6310c5db300c95979daed4454ca977776bfd5edeb557e1237e3aa8ed722336243af2d78!]
25-
BURGR_USERNAME: ENCRYPTED[!b29ddc7610116de511e74bec9a93ad9b8a20ac217a0852e94a96d0066e6e822b95e7bc1fe152afb707f16b70605fddd3!]
26-
BURGR_PASSWORD: ENCRYPTED[!83e130718e92b8c9de7c5226355f730e55fb46e45869149a9223e724bb99656878ef9684c5f8cfef434aa716e87f4cf2!]
19+
BURGR_URL: VAULT[development/kv/data/burgr data.url]
20+
BURGR_USERNAME: VAULT[development/kv/data/burgr data.cirrus_username]
21+
BURGR_PASSWORD: VAULT[development/kv/data/burgr data.cirrus_password]
2722

2823
### Project variables
2924
DEPLOY_PULL_REQUEST: true
@@ -54,10 +49,10 @@ build_task:
5449
cpu: 2
5550
memory: 1G
5651
env:
57-
SONAR_TOKEN: ENCRYPTED[!b6fd814826c51e64ee61b0b6f3ae621551f6413383f7170f73580e2e141ac78c4b134b506f6288c74faa0dd564c05a29!]
52+
SONAR_TOKEN: VAULT[development/kv/data/next data.token]
5853
SONAR_HOST_URL: https://next.sonarqube.com/sonarqube
59-
SIGN_KEY: ENCRYPTED[!cc216dfe592f79db8006f2a591f8f98b40aa2b078e92025623594976fd32f6864c1e6b6ba74b50647f608e2418e6c336!]
60-
PGP_PASSPHRASE: ENCRYPTED[!314a8fc344f45e462dd5e8dccd741d7562283a825e78ebca27d4ae9db8e65ce618e7f6aece386b2782a5abe5171467bd!]
54+
SIGN_KEY: VAULT[development/kv/data/sign data.key]
55+
PGP_PASSPHRASE: VAULT[development/kv/data/sign data.passphrase]
6156
maven_cache:
6257
folder: ${CIRRUS_WORKING_DIR}/.m2/repository
6358
script:
@@ -81,6 +76,7 @@ qa_task:
8176
- QA_CATEGORY: DEV
8277
JAVA_VERSION:
8378
- LATEST_RELEASE
79+
GITHUB_TOKEN: VAULT[development/github/token/licenses-ro token]
8480
maven_cache:
8581
folder: ${CIRRUS_WORKING_DIR}/.m2/repository
8682
qa_script:
@@ -103,6 +99,10 @@ promote_task:
10399
<<: *CONTAINER_DEFINITION
104100
cpu: 0.5
105101
memory: 500M
102+
env:
103+
GITHUB_TOKEN: VAULT[development/github/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-promotion token]
104+
GCF_ACCESS_TOKEN: VAULT[development/kv/data/promote data.token]
105+
PROMOTE_URL: VAULT[development/kv/data/promote data.url]
106106
maven_cache:
107107
folder: $CIRRUS_WORKING_DIR/.m2/repository
108108
script:

.github/workflows/release.yml

Lines changed: 8 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -5,98 +5,16 @@ on:
55
types:
66
- published
77

8-
env:
9-
PYTHONUNBUFFERED: 1
10-
118
jobs:
129
run_release:
1310
runs-on: ubuntu-latest
1411
name: Start release process
1512
timeout-minutes: 60
16-
steps:
17-
- name: Configure AWS Credentials
18-
uses: aws-actions/configure-aws-credentials@v1
19-
with:
20-
aws-access-key-id: ${{ secrets.BINARIES_AWS_ACCESS_KEY_ID }}
21-
aws-secret-access-key: ${{ secrets.BINARIES_AWS_SECRET_ACCESS_KEY }}
22-
aws-region: ${{ secrets.BINARIES_AWS_REGION }}
23-
- name: Run release action
24-
id: run_release
25-
uses: SonarSource/gh-action_release/main@v4
26-
with:
27-
publish_to_binaries: true
28-
attach_artifacts_to_github_release: false
29-
run_rules_cov: false
30-
slack_channel: sonarqube-build
31-
env:
32-
ARTIFACTORY_API_KEY: ${{ secrets.ARTIFACTORY_API_KEY }}
33-
BINARIES_AWS_DEPLOY: ${{ secrets.BINARIES_AWS_DEPLOY }}
34-
BURGRX_USER: ${{ secrets.BURGRX_USER }}
35-
BURGRX_PASSWORD: ${{ secrets.BURGRX_PASSWORD }}
36-
CIRRUS_TOKEN: ${{ secrets.CIRRUS_TOKEN }}
37-
PATH_PREFIX: ${{ secrets.BINARIES_PATH_PREFIX }}
38-
GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
39-
RELEASE_SSH_USER: ${{ secrets.RELEASE_SSH_USER }}
40-
RELEASE_SSH_KEY: ${{ secrets.RELEASE_SSH_KEY }}
41-
SLACK_API_TOKEN: ${{secrets.SLACK_API_TOKEN }}
42-
- name: Log outputs
43-
if: always()
44-
run: |
45-
echo "${{ steps.run_release.outputs.releasability }}"
46-
echo "${{ steps.run_release.outputs.release }}"
47-
echo "${{ steps.run_release.outputs.distribute_release }}"
48-
- name: Notify success on Slack
49-
uses: Ilshidur/action-slack@2.0.0
50-
env:
51-
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
52-
with:
53-
args: "Release successful for {{ GITHUB_REPOSITORY }} by {{ GITHUB_ACTOR }}"
54-
- name: Notify failures on Slack
55-
uses: Ilshidur/action-slack@2.0.0
56-
if: failure()
57-
env:
58-
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
59-
with:
60-
args: "Release failed, see the logs at https://github.com/{{ GITHUB_REPOSITORY }}/actions by {{ GITHUB_ACTOR }}"
61-
maven-central-sync:
62-
runs-on: ubuntu-latest
63-
needs:
64-
- run_release
65-
steps:
66-
- name: Setup JFrog CLI
67-
uses: jfrog/setup-jfrog-cli@v1
68-
- name: JFrog config
69-
run: jfrog rt config repox --url https://repox.jfrog.io/artifactory/ --apikey $ARTIFACTORY_API_KEY --basic-auth-only
70-
env:
71-
ARTIFACTORY_API_KEY: ${{ secrets.ARTIFACTORY_API_KEY }}
72-
- name: Get the version
73-
id: get_version
74-
run: |
75-
IFS=. read major minor patch build <<< "${{ github.event.release.tag_name }}"
76-
echo ::set-output name=build::"${build}"
77-
- name: Create local repository directory
78-
id: local_repo
79-
run: echo ::set-output name=dir::"$(mktemp -d repo.XXXXXXXX)"
80-
- name: Download Artifacts
81-
uses: SonarSource/gh-action_release/download-build@v4
82-
with:
83-
build-number: ${{ steps.get_version.outputs.build }}
84-
local-repo-dir: ${{ steps.local_repo.outputs.dir }}
85-
- name: Maven Central Sync
86-
id: maven-central-sync
87-
continue-on-error: true
88-
uses: SonarSource/gh-action_release/maven-central-sync@v4
89-
with:
90-
local-repo-dir: ${{ steps.local_repo.outputs.dir }}
91-
env:
92-
OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
93-
OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
94-
- name: Notify on failure
95-
if: ${{ failure() || steps.maven-central-sync.outcome == 'failure' }}
96-
uses: 8398a7/action-slack@v3
97-
with:
98-
status: failure
99-
fields: repo,author,eventName
100-
env:
101-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_BUILD_WEBHOOK }}
102-
13+
permissions:
14+
contents: read
15+
id-token: write
16+
uses: SonarSource/gh-action_release/.github/workflows/main.yaml@d42e8be3a9772d0447a7d2f3d2be31312b218383 # tag=5.0.1
17+
with:
18+
publishToBinaries: true
19+
mavenCentralSync: true
20+
slackChannel: sonarqube-build

0 commit comments

Comments
 (0)