ci: use vault to read secret (#106)

Signed-off-by: Jack Yu <jack.yu@suse.com>
rancher · Apr 12, 2024 · b0c02cb · b0c02cb
1 parent 9565f65
commit b0c02cb
Showing 1 changed file with 27 additions and 4 deletions.
diff --git a/.github/workflows/template-build.yml b/.github/workflows/template-build.yml
@@ -11,6 +11,9 @@ on:
 jobs:
   dapper-build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     container:
       image: rancher/dapper:v0.5.8
     strategy:
@@ -33,6 +36,8 @@ jobs:
           arch=$(echo ${{ matrix.platform }} | cut -c 7-)
           echo "ARCH=$arch" >> "$GITHUB_OUTPUT"
 
+      
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
@@ -42,12 +47,20 @@ jobs:
       - name: Run dapper
         run: dapper ci
 
+      - name: Read some Secrets
+        uses: rancher-eio/read-vault-secrets@main
+        if: ${{ inputs.push == true }}
+        with:
+          secrets: |
+            secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
+            secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD
+
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         if: ${{ inputs.push == true }}
         with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+          username: ${{ env.DOCKER_USERNAME }}
+          password: ${{ env.DOCKER_PASSWORD }}
 
       - name: Docker Build
         uses: docker/build-push-action@v5
@@ -65,17 +78,27 @@ jobs:
   manifest:
     if: ${{ inputs.push == true }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     needs:
       - dapper-build
     steps:
       - name: Checkout code
         uses: actions/checkout@v2
 
+      - name: Read some Secrets
+        uses: rancher-eio/read-vault-secrets@main
+        with:
+          secrets: |
+            secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
+            secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD
+
       - name: Login to Docker Hub
         uses: docker/login-action@v2
         with:
-          username: ${{ secrets.docker_username }}
-          password: ${{ secrets.docker_password }}
+          username: ${{ env.DOCKER_USERNAME }}
+          password: ${{ env.DOCKER_PASSWORD }}
 
       - name: Create Manifest arm64 and amd64
         run: >