Skip to content

Commit

Permalink
Add new test workflows for other action
Browse files Browse the repository at this point in the history
  • Loading branch information
LanceMcCarthy committed Nov 28, 2023
1 parent 50e3bde commit dcaa0b0
Show file tree
Hide file tree
Showing 2 changed files with 124 additions and 0 deletions.
56 changes: 56 additions & 0 deletions .github/workflows/dynamic-azure-ad-new.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
name: 'Azure AD Dynamic Secrets NEW'
# Docs => https://docs.akeyless.io/docs/azure-ad-dynamic-secrets

on:
workflow_dispatch:
push:
branches:
- main
paths:
- 'src/**/*'
- 'package.json'
- 'package-lock.json'
- '.github/workflows/dynamic-azure-ad-new.yml'

jobs:
##############################
########## Option 1 ##########
##############################
# - Uses default behavior
# The response from Akeyless is kept in it's original JSON string. It is then your responsibility to correctly parse it.

fetch_dynamic_secrets:
runs-on: ubuntu-latest
name: AAD dynamic secrets (default)
permissions:
id-token: write
contents: read
steps:
- name: Checkout
uses: actions/checkout@v3
with:
fetch-depth: 0

- name: Fetch dynamic secret from Akleyless
id: fetch-secrets
uses: akeyless-community/[email protected]
with:
access-id: ${{ secrets.AKEYLESS_ACCESS_ID }}
dynamic-secrets: |
- name: "/DevTools/live-azure-ad"
output-name: "azure_ad_dynamic_secret"
access-type: jwt

- name: Verify Job Outputs
run: |
echo "ID: ${{ steps.fetch-secrets.outputs.id }}"
echo "MSG: ${{ steps.fetch-secrets.outputs.msg }}"
echo "SECRET: ${{ steps.fetch-secrets.outputs.secret }}"
echo "TTL_IN_MINUTES: ${{ steps.fetch-secrets.outputs.ttl_in_minutes }}"
- name: Verify Environment Variables
run: |
echo "ID: ${{ env.id }}"
echo "MSG: ${{ env.msg }}"
echo "SECRET: ${{ env.secret }}"
echo "TTL_IN_MINUTES: ${{ env.ttl_in_minutes }}"
68 changes: 68 additions & 0 deletions .github/workflows/dynamic-azure-codesign-new.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
name: 'Azure Code Sign NEW'
# Docs => https://docs.akeyless.io/docs/azure-ad-dynamic-secrets
# Using AzureSignTool https://learn.microsoft.com/en-us/windows/msix/desktop/cicd-keyvault

on:
workflow_dispatch:

jobs:
code_sign:
runs-on: windows-latest
name: Code Signing
permissions:
id-token: write
contents: read
steps:
- name: Checkout
uses: actions/checkout@v3
with:
fetch-depth: 0

- name: Fetch dynamic secret from Akleyless
id: fetch-secrets
uses: akeyless-community/[email protected]
with:
access-id: ${{ secrets.AKEYLESS_ACCESS_ID }}
dynamic-secrets: |
- name: "/DevTools/live-azure-ad"
output-name: "akelyess_payload"
access-type: jwt

- name: Verify Values (Temporary - only for debugging)
run: |
echo 'ID'
echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.id'
echo 'MSG'
echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.msg'
echo 'SECRET'
echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.secret'
echo 'TTL_IN_MINUTES'
echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.ttl_in_minutes'
### ARRRRG - Still trying pull apart the '[object, object]' in
- name: Learn keys
run: |
echo "secret: ${{ env.akelyess_payload_secret }}"
echo '${{ env.akelyess_payload_secret }}' | jq -r '.value'
echo '${{ steps.fetch-secrets.outputs.akelyess_payload }}' | jq -r '.secret as $n | try to_entries[] | [ $n, .value]'
cat '${{ steps.fetch-secrets.outputs.akelyess_payload }}' -o '${{ github.workspace }}\hello.txt'
Get-Content '${{ github.workspace }}\hello.txt'
#### Option 1 ####
# The easiest, just use AzureSignTool

- name: Install AzureSignTool
id: install-signtool
run: dotnet tool install --global AzureSignTool

# Nice walkthrough https://melatonin.dev/blog/how-to-code-sign-windows-installers-with-an-ev-cert-on-github-actions/
- name: Use AzureSignTool
id: use-signtool
run: |
azuresigntool sign -kvu "${{ secrets.AZURE_KEY_VAULT_URI }}" -kvi "${{ secrets.AZURE_CLIENT_ID }}" -kvt "${{ secrets.AZURE_TENANT_ID }}"-kvs "${{ secrets.AZURE_CLIENT_SECRET }}" -kvc ${{ secrets.AZURE_CERT_NAME }} -tr http://timestamp.digicert.com -v '${{ github.workspace }}\.github\test_files\ConsoleApp1.exe'

0 comments on commit dcaa0b0

Please sign in to comment.