Create release workable-0.20.4 #65
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| * @Workable/systems |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,19 +1,18 @@ | ||
| name: External Secrets Workable CI | ||
|
|
||
| on: | ||
| push: | ||
| tags: | ||
| - workable-* | ||
| pull_request: | ||
| branches: | ||
| - workable-* | ||
|
|
||
| env: | ||
| # Common versions | ||
| GOLANGCI_VERSION: 'v2.4.0' | ||
| KUBERNETES_VERSION: '1.33.x' | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
|
|
@@ -70,23 +69,6 @@ jobs: | |
| skip-pkg-cache: true | ||
| skip-build-cache: true | ||
|
|
||
| check-diff: | ||
| runs-on: ubuntu-latest | ||
| needs: detect-noop | ||
|
|
@@ -153,48 +135,76 @@ jobs: | |
| run: | | ||
| make test | ||
|
|
||
| publish-artifacts: | ||
| needs: [lint, check-diff, unit-tests] | ||
| if: ${{ needs.detect-noop.outputs.noop != 'true' && startsWith(github.ref, 'refs/tags/workable-') }} | ||
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| runs-on: ubuntu-latest | ||
| environment: Workable | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
|
There was a problem hiding this comment. GitHub Action actions/checkout persist Git credentials in workflow - low severity Show fixRemediation: Set Reply There was a problem hiding this comment. GitHub Action actions/checkout persist Git credentials in workflow - low severity Show fixRemediation: Set Reply |
||
|
|
||
| - name: Get image tag | ||
| id: container-info | ||
| run: | | ||
| echo "image-tag=${GITHUB_REF#refs/tags/workable-}" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Build image | ||
| uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.1 | ||
| with: | ||
| context: . | ||
| file: Dockerfile.standalone | ||
| push: false | ||
| tags: Workable/external-secrets:${{ steps.container-info.outputs.image-tag }} | ||
| provenance: false | ||
|
|
||
| # DISTRIBUTION OF SRE IMAGE | ||
| - name: Login to sre registry | ||
| uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 | ||
| with: | ||
| registry: us-docker.pkg.dev | ||
| username: _json_key | ||
| password: ${{ secrets.SRE_GCR_SA }} | ||
|
|
||
| - name: Push image to sre registry | ||
| env: | ||
| REGISTRY: us-docker.pkg.dev/sre-artifacts-20e4/gcr.io | ||
| run: | | ||
| docker tag Workable/external-secrets:${{ steps.container-info.outputs.image-tag }} \ | ||
| ${{ env.REGISTRY }}/external-secrets:${{ steps.container-info.outputs.image-tag }} | ||
| docker push ${{ env.REGISTRY }}/external-secrets:${{ steps.container-info.outputs.image-tag }} | ||
|
|
||
| # DISTRIBUTION OF STAGING IMAGE | ||
| - name: Login to staging registry | ||
| uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 | ||
| with: | ||
| registry: us-docker.pkg.dev | ||
| username: _json_key | ||
| password: ${{ secrets.STAGING_GCR_SA }} | ||
|
|
||
| - name: Push image to staging registry | ||
| env: | ||
| REGISTRY: us-docker.pkg.dev/staging-artifacts-786a/gcr.io | ||
| run: | | ||
| docker tag Workable/external-secrets:${{ steps.container-info.outputs.image-tag }} \ | ||
| ${{ env.REGISTRY }}/external-secrets:${{ steps.container-info.outputs.image-tag }} | ||
| docker push ${{ env.REGISTRY }}/external-secrets:${{ steps.container-info.outputs.image-tag }} | ||
|
|
||
| # DISTRIBUTION OF PRODUCTION IMAGE | ||
| - name: Login to production registry | ||
| uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 | ||
| with: | ||
| registry: us-docker.pkg.dev | ||
| username: _json_key | ||
| password: ${{ secrets.PRODUCTION_GCR_SA }} | ||
|
|
||
| - name: Push image to production registry | ||
| env: | ||
| REGISTRY: us-docker.pkg.dev/production-artifacts-0b0d/gcr.io | ||
| run: | | ||
| docker tag Workable/external-secrets:${{ steps.container-info.outputs.image-tag }} \ | ||
| ${{ env.REGISTRY }}/external-secrets:${{ steps.container-info.outputs.image-tag }} | ||
| docker push ${{ env.REGISTRY }}/external-secrets:${{ steps.container-info.outputs.image-tag }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| /* | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
|
|
||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
|
|
||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package vault | ||
|
|
||
| import ( | ||
| "context" | ||
| "regexp" | ||
| "strings" | ||
| ) | ||
|
|
||
| const ( | ||
| // Symlink must start with the prefix vault:// to be valid. | ||
| vaultSymlink = `vault://` | ||
| // Path can be anything and matches the last # as a separator of key. | ||
| vaultSymlinkPath = `(?P<Path>.*)#` | ||
| // Key can be any alphanumeric character and stops with the first @. | ||
| vaultSymlinkSecret = `(?P<Secret>\w+)` | ||
| // Version is optional and will match any number after @. | ||
| vaultSymlinkVersion = `(@(?P<Version>\d+)?)?` | ||
| vaultSymlinkPattern = vaultSymlink + vaultSymlinkPath + vaultSymlinkSecret + vaultSymlinkVersion | ||
| ) | ||
|
|
||
| // isSymlink tests if secret can be converted to string and if it matches the symlink pattern. | ||
| func isSymlink(secret any) bool { | ||
| if s, ok := secret.(string); ok { | ||
| return strings.HasPrefix(s, vaultSymlink) | ||
| } | ||
|
|
||
| return false | ||
| } | ||
|
|
||
| // extractSymlinkParts extract capture group items of regex to a map. | ||
| func extractSymlinkParts(secret any) (paramsMap map[string]string) { | ||
| r := regexp.MustCompile(vaultSymlinkPattern) | ||
| match := r.FindStringSubmatch(secret.(string)) | ||
| paramsMap = make(map[string]string) | ||
|
|
||
| for i, name := range r.SubexpNames() { | ||
| if i > 0 && i <= len(match) { | ||
| paramsMap[name] = match[i] | ||
| } | ||
| } | ||
|
|
||
| return paramsMap | ||
| } | ||
|
|
||
| // resolveSymlink test if the data passed has symlinks and resolve them. | ||
| func (c *client) resolveSymlink(ctx context.Context, data map[string]any) (map[string]any, error) { | ||
| for key, secret := range data { | ||
| for isSymlink(secret) { | ||
| symlink := extractSymlinkParts(secret) | ||
|
|
||
| s, err := c.readSecret(ctx, symlink["Path"], symlink["Version"]) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| secret = s[symlink["Secret"]] | ||
| data[key] = secret | ||
| } | ||
| } | ||
|
|
||
| return data, nil | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| /* | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
|
|
||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
|
|
||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package vault | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/google/go-cmp/cmp" | ||
| ) | ||
|
|
||
| func TestIsSymlink(t *testing.T) { | ||
| cases := map[string]struct { | ||
| got string | ||
| want bool | ||
| }{ | ||
| "ShouldResolveSymlink": { | ||
| got: "vault://test", | ||
| want: true, | ||
| }, | ||
| "ShouldNotResolveSymlink": { | ||
| got: "test", | ||
| want: false, | ||
| }, | ||
| } | ||
|
|
||
| for name, tc := range cases { | ||
| t.Run(name, func(t *testing.T) { | ||
| if diff := cmp.Diff(tc.want, isSymlink(tc.got), EquateErrors()); diff != "" { | ||
| t.Errorf("\nvault.isSymlink(...): -want error, +got error:\n%s", diff) | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func TestExtractSymlinkParts(t *testing.T) { | ||
| cases := map[string]struct { | ||
| pattern string | ||
| expectedPath string | ||
| expectedSecret string | ||
| expectedVersion string | ||
| }{ | ||
| "ShouldExtractPathAndSecret": { | ||
| pattern: "vault://test#KEY", | ||
| expectedPath: "test", | ||
| expectedSecret: "KEY", | ||
| expectedVersion: "", | ||
| }, | ||
| "ShouldExtractPathAndSecretAndVersion": { | ||
| pattern: "vault://test#KEY@21", | ||
| expectedPath: "test", | ||
| expectedSecret: "KEY", | ||
| expectedVersion: "21", | ||
| }, | ||
| } | ||
|
|
||
| for name, tc := range cases { | ||
| t.Run(name, func(t *testing.T) { | ||
| if diff := cmp.Diff(tc.expectedPath, extractSymlinkParts(tc.pattern)["Path"], EquateErrors()); diff != "" { | ||
| t.Errorf("\nvault.extractSymlinkParts(...): -want error, +got error:\n%s", diff) | ||
| } | ||
| if diff := cmp.Diff(tc.expectedSecret, extractSymlinkParts(tc.pattern)["Secret"], EquateErrors()); diff != "" { | ||
| t.Errorf("\nvault.extractSymlinkParts(...): -want error, +got error:\n%s", diff) | ||
| } | ||
| if diff := cmp.Diff(tc.expectedVersion, extractSymlinkParts(tc.pattern)["Version"], EquateErrors()); diff != "" { | ||
| t.Errorf("\nvault.extractSymlinkParts(...): -want error, +got error:\n%s", diff) | ||
| } | ||
| }) | ||
| } | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
GitHub Action actions/checkout persist Git credentials in workflow - low severity
actions/checkout v2 and above persist the default GITHUB_TOKEN in the repository's local git config when persist-credentials is not set to false, during the workflow run. Subsequent workflow steps or third-party actions can read this token from git configuration, increasing the risk of credential theft or misuse within the pipeline. In order to limit the attack surface when external actions are compromised, ensure
persist-credentialsis set tofalse.Show fix
Remediation: Set
persist-credentials: falseon actions/checkout steps that do not need to push commits back to the repository. Only keeppersist-credentials: truewhen the workflow explicitly performs authenticated git push operations.Reply
@AikidoSec ignore: [REASON]to ignore this issue.More info