Fetch Docker secrets from AWS Secrets Manager (#565)

Author: mchatlas-hellosign

.github/workflows/github-actions.yml

@@ -1,16 +1,40 @@
-on: [push]
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   openapi-spec-build:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - &configure-aws
+        name: Configure AWS credentials for Docker Hub secrets (OIDC)
+        if: github.event_name != 'pull_request'
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::301904545275:role/oidc-github-hellosign-hellosign-openapi-branch-main
+          aws-region: us-west-2
+
+      - &get-docker-secrets
+        name: Get Docker Hub secrets from AWS Secrets Manager
+        if: github.event_name != 'pull_request'
+        uses: aws-actions/aws-secretsmanager-get-secrets@v3
+        with:
+          secret-ids: |
+            DOCKER_USERNAME,github-actions/hellosign/shared/docker-username
+            DOCKER_TOKEN,github-actions/hellosign/shared/docker-token
+          parse-json-secrets: false
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status oas
@@ -21,17 +45,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build PHP SDK
         run: ./generate-sdks -t php
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status php
@@ -42,17 +63,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build Python SDK
         run: ./generate-sdks -t python
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status python
@@ -63,17 +81,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build Ruby SDK
         run: ./generate-sdks -t ruby
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status ruby
@@ -84,17 +99,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build NodeJs SDK
         run: ./generate-sdks -t node
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status node
@@ -105,17 +117,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build Java SDK
         run: ./generate-sdks -t java-v1
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status java-v1
@@ -126,17 +135,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build Java SDK
         run: ./generate-sdks -t java-v2
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status java-v2
@@ -147,17 +153,14 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
+      - *configure-aws
+      - *get-docker-secrets
+
       - name: Build OpenAPI Spec
         run: ./build
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Build DotNet SDK
         run: ./generate-sdks -t dotnet
-        env:
-          DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
-          DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
 
       - name: Ensure no changes in Generated Code
         run: ./bin/check-clean-git-status dotnet

bin/php

@@ -8,7 +8,7 @@ DIR=$(cd `dirname $0` && pwd)
 ROOT_DIR="${DIR}/.."
 WORKING_DIR="/app/openapi"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi

sdks/dotnet/run-build

@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/dotnet"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi

sdks/java-v1/run-build

@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/java"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi

sdks/java-v2/run-build

@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/java"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi

sdks/node/run-build

@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/javascript"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi

sdks/php/run-build

@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/php"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi

sdks/python/run-build

@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/python"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi

sdks/ruby/run-build

@@ -7,7 +7,7 @@ set -e
 DIR=$(cd `dirname $0` && pwd)
 WORKING_DIR="/app/ruby"
 
-if [[ -n "$GITHUB_ACTIONS" ]]; then
+if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi