Skip to content

Commit 2fa966d

Browse files
ZachGoldbergZachGoldberg
committed
feat: sanitize input tokens
1 parent 08d96dc commit 2fa966d

File tree

1 file changed

+58
-15
lines changed

1 file changed

+58
-15
lines changed

‎.github/workflows/pipelines-root.yml

Lines changed: 58 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ on:
2121
runner:
2222
type: string
2323
default: '"ubuntu-latest"'
24-
api_base_url:
24+
api_base_url:
2525
type: string
2626
default: "https://api.prod.app.gruntwork.io/api/v1"
2727

@@ -53,36 +53,47 @@ jobs:
5353
name: Detect Infrastructure Changes
5454
runs-on: ${{ fromJSON(inputs.runner) }}
5555
steps:
56+
- name: Sanitize Tokens
57+
id: secrets
58+
shell: bash
59+
run: |
60+
PR_TRIM=$(echo $PIPELINES_READ_TOKEN | xargs)
61+
IR_TRIM=$(echo $INFRA_ROOT_WRITE_TOKEN | xargs)
62+
OR_TRIM=$(echo $ORG_REPO_ADMIN_TOKEN | xargs)
63+
echo "PIPELINES_READ_TOKEN=$PR_TRIM" | xargs>> $GITHUB_OUTPUT
64+
echo "INFRA_ROOT_WRITE_TOKEN=$IR_TRIM" >> $GITHUB_OUTPUT
65+
echo "ORG_REPO_ADMIN_TOKEN=$OR_TRIM" >> $GITHUB_OUTPUT
66+
5667
- name: Fetch Gruntwork Read Token
5768
id: pipelines-gruntwork-read-token
5869
uses: gruntwork-io/pipelines-credentials@v1
5970
with:
6071
PIPELINES_TOKEN_PATH: "pipelines-read/gruntwork-io"
61-
FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
72+
FALLBACK_TOKEN: ${{ steps.secrets.outputs.PIPELINES_READ_TOKEN }}
6273
api_base_url: ${{ inputs.api_base_url }}
6374

6475
- name: Fetch Org Read Token
6576
id: pipelines-customer-org-read-token
6677
uses: gruntwork-io/pipelines-credentials@v1
6778
with:
6879
PIPELINES_TOKEN_PATH: pipelines-read/${{ github.repository_owner }}
69-
FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
80+
FALLBACK_TOKEN: ${{ steps.secrets.outputs.PIPELINES_READ_TOKEN }}
7081
api_base_url: ${{ inputs.api_base_url }}
7182

7283
- name: Fetch Infra Root Write Token
7384
id: pipelines-infra-root-write-token
7485
uses: gruntwork-io/pipelines-credentials@v1
7586
with:
7687
PIPELINES_TOKEN_PATH: infra-root-write/${{ github.repository_owner }}
77-
FALLBACK_TOKEN: ${{ secrets.INFRA_ROOT_WRITE_TOKEN }}
88+
FALLBACK_TOKEN: ${{ steps.secrets.outputs.INFRA_ROOT_WRITE_TOKEN }}
7889
api_base_url: ${{ inputs.api_base_url }}
7990

8091
- name: Fetch Org Repo Admin Token
8192
id: pipelines-org-repo-admin-token
8293
uses: gruntwork-io/pipelines-credentials@v1
8394
with:
8495
PIPELINES_TOKEN_PATH: org-repo-admin/${{ github.repository_owner }}
85-
FALLBACK_TOKEN: ${{ secrets.ORG_REPO_ADMIN_TOKEN }}
96+
FALLBACK_TOKEN: ${{ steps.secrets.outputs.ORG_REPO_ADMIN_TOKEN }}
8697
api_base_url: ${{ inputs.api_base_url }}
8798

8899
- name: Checkout Pipelines Actions
@@ -120,7 +131,7 @@ jobs:
120131
uses: ./pipelines-actions/.github/actions/pipelines-preflight-action
121132
with:
122133
IS_ROOT: "true"
123-
PIPELINES_READ_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
134+
PIPELINES_READ_TOKEN: ${{ steps.secrets.outputs.PIPELINES_READ_TOKEN }}
124135
INFRA_ROOT_WRITE_TOKEN: ${{ steps.pipelines-infra-root-write-token.outputs.PIPELINES_TOKEN }}
125136
ORG_REPO_ADMIN_TOKEN: ${{ steps.pipelines-org-repo-admin-token.outputs.PIPELINES_TOKEN }}
126137
PIPELINES_GRUNTWORK_READ_TOKEN: ${{ steps.pipelines-gruntwork-read-token.outputs.PIPELINES_TOKEN }}
@@ -151,28 +162,38 @@ jobs:
151162
matrix:
152163
jobs: ${{ fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs) }}
153164
steps:
165+
- name: Sanitize Tokens
166+
id: secrets
167+
shell: bash
168+
run: |
169+
PR_TRIM=$(echo $PIPELINES_READ_TOKEN | xargs)
170+
IR_TRIM=$(echo $INFRA_ROOT_WRITE_TOKEN | xargs)
171+
OR_TRIM=$(echo $ORG_REPO_ADMIN_TOKEN | xargs)
172+
echo "PIPELINES_READ_TOKEN=$PR_TRIM" | xargs>> $GITHUB_OUTPUT
173+
echo "INFRA_ROOT_WRITE_TOKEN=$IR_TRIM" >> $GITHUB_OUTPUT
174+
echo "ORG_REPO_ADMIN_TOKEN=$OR_TRIM" >> $GITHUB_OUTPUT
154175
- name: Fetch Gruntwork Read Token
155176
id: pipelines-gruntwork-read-token
156177
uses: gruntwork-io/pipelines-credentials@v1
157178
with:
158179
PIPELINES_TOKEN_PATH: "pipelines-read/gruntwork-io"
159-
FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
180+
FALLBACK_TOKEN: ${{ steps.secrets.outputs.PIPELINES_READ_TOKEN }}
160181
api_base_url: ${{ inputs.api_base_url }}
161182

162183
- name: Fetch Org Read Token
163184
id: pipelines-customer-org-read-token
164185
uses: gruntwork-io/pipelines-credentials@v1
165186
with:
166187
PIPELINES_TOKEN_PATH: pipelines-read/${{ github.repository_owner }}
167-
FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
188+
FALLBACK_TOKEN: ${{ steps.secrets.outputs.PIPELINES_READ_TOKEN }}
168189
api_base_url: ${{ inputs.api_base_url }}
169190

170191
- name: Fetch Infra Root Write Token
171192
id: pipelines-infra-root-write-token
172193
uses: gruntwork-io/pipelines-credentials@v1
173194
with:
174195
PIPELINES_TOKEN_PATH: infra-root-write/${{ github.repository_owner }}
175-
FALLBACK_TOKEN: ${{ secrets.INFRA_ROOT_WRITE_TOKEN }}
196+
FALLBACK_TOKEN: ${{ steps.secrets.outputs.INFRA_ROOT_WRITE_TOKEN }}
176197
api_base_url: ${{ inputs.api_base_url }}
177198

178199
- name: Checkout Pipelines Actions
@@ -342,28 +363,39 @@ jobs:
342363
matrix:
343364
jobs: ${{ fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0].NewAccounts }}
344365
steps:
366+
- name: Sanitize Tokens
367+
shell: bash
368+
id: secrets
369+
run: |
370+
PR_TRIM=$(echo $PIPELINES_READ_TOKEN | xargs)
371+
IR_TRIM=$(echo $INFRA_ROOT_WRITE_TOKEN | xargs)
372+
OR_TRIM=$(echo $ORG_REPO_ADMIN_TOKEN | xargs)
373+
echo "PIPELINES_READ_TOKEN=$PR_TRIM" | xargs>> $GITHUB_OUTPUT
374+
echo "INFRA_ROOT_WRITE_TOKEN=$IR_TRIM" >> $GITHUB_OUTPUT
375+
echo "ORG_REPO_ADMIN_TOKEN=$OR_TRIM" >> $GITHUB_OUTPUT
376+
345377
- name: Fetch Gruntwork Read Token
346378
id: pipelines-gruntwork-read-token
347379
uses: gruntwork-io/pipelines-credentials@v1
348380
with:
349381
PIPELINES_TOKEN_PATH: "pipelines-read/gruntwork-io"
350-
FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
382+
FALLBACK_TOKEN: ${{ steps.secrets.outputs.PIPELINES_READ_TOKEN }}
351383
api_base_url: ${{ inputs.api_base_url }}
352384

353385
- name: Fetch Org Read Token
354386
id: pipelines-customer-org-read-token
355387
uses: gruntwork-io/pipelines-credentials@v1
356388
with:
357389
PIPELINES_TOKEN_PATH: pipelines-read/${{ github.repository_owner }}
358-
FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
390+
FALLBACK_TOKEN: ${{ steps.secrets.outputs.PIPELINES_READ_TOKEN }}
359391
api_base_url: ${{ inputs.api_base_url }}
360392

361393
- name: Fetch Create PR Token
362394
id: pipelines-propose-infra-change-token
363395
uses: gruntwork-io/pipelines-credentials@v1
364396
with:
365397
PIPELINES_TOKEN_PATH: propose-infra-change/${{ github.repository_owner }}
366-
FALLBACK_TOKEN: ${{ secrets.INFRA_ROOT_WRITE_TOKEN }}
398+
FALLBACK_TOKEN: ${{ steps.secrets.outputs.INFRA_ROOT_WRITE_TOKEN }}
367399
api_base_url: ${{ inputs.api_base_url }}
368400

369401
- name: Checkout Pipelines Actions
@@ -465,28 +497,39 @@ jobs:
465497
# GHA can't check for length, so we just check if there is an item in the 0 index
466498
if: ${{ fromJson(needs.pipelines_orchestrate.outputs.pipelines_jobs)[0].NewAccounts[0] != null && needs.pipelines_execute.outputs.delegate_management == 'true' && needs.pipelines_execute.outputs.terragrunt_command == 'run-all apply' }}
467499
steps:
500+
- name: Sanitize Tokens
501+
shell: bash
502+
id: secrets
503+
run: |
504+
PR_TRIM=$(echo $PIPELINES_READ_TOKEN | xargs)
505+
IR_TRIM=$(echo $INFRA_ROOT_WRITE_TOKEN | xargs)
506+
OR_TRIM=$(echo $ORG_REPO_ADMIN_TOKEN | xargs)
507+
echo "PIPELINES_READ_TOKEN=$PR_TRIM" | xargs>> $GITHUB_OUTPUT
508+
echo "INFRA_ROOT_WRITE_TOKEN=$IR_TRIM" >> $GITHUB_OUTPUT
509+
echo "ORG_REPO_ADMIN_TOKEN=$OR_TRIM" >> $GITHUB_OUTPUT
510+
468511
- name: Fetch Gruntwork Read Token
469512
id: pipelines-gruntwork-read-token
470513
uses: gruntwork-io/pipelines-credentials@v1
471514
with:
472515
PIPELINES_TOKEN_PATH: "pipelines-read/gruntwork-io"
473-
FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
516+
FALLBACK_TOKEN: ${{ steps.secrets.outputs.PIPELINES_READ_TOKEN }}
474517
api_base_url: ${{ inputs.api_base_url }}
475518

476519
- name: Fetch Org Read Token
477520
id: pipelines-customer-org-read-token
478521
uses: gruntwork-io/pipelines-credentials@v1
479522
with:
480523
PIPELINES_TOKEN_PATH: pipelines-read/${{ github.repository_owner }}
481-
FALLBACK_TOKEN: ${{ secrets.PIPELINES_READ_TOKEN }}
524+
FALLBACK_TOKEN: ${{ steps.secrets.outputs.PIPELINES_READ_TOKEN }}
482525
api_base_url: ${{ inputs.api_base_url }}
483526

484527
- name: Fetch Org Repo Admin Token
485528
id: pipelines-org-repo-admin-token
486529
uses: gruntwork-io/pipelines-credentials@v1
487530
with:
488531
PIPELINES_TOKEN_PATH: org-repo-admin/${{ github.repository_owner }}
489-
FALLBACK_TOKEN: ${{ secrets.ORG_REPO_ADMIN_TOKEN }}
532+
FALLBACK_TOKEN: ${{ steps.secrets.outputs.ORG_REPO_ADMIN_TOKEN }}
490533
api_base_url: ${{ inputs.api_base_url }}
491534

492535
- name: Checkout Pipelines Actions

0 commit comments

Comments
 (0)