[BRE-831] migrate secrets AKV (#796)

2025-12-05 23:53:21 +00:00 · 2025-07-09 18:09:22 -04:00
parent c51e37e77d
commit 0c1d20aaa6
4 changed files with 123 additions and 19 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,6 +16,8 @@ jobs:
  cloc:
    name: CLOC
    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
    steps:
      - name: Checkout repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -32,6 +34,8 @@ jobs:
  setup:
    name: Setup
    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
    outputs:
      package_version: ${{ steps.retrieve-version.outputs.package_version }}
    steps:
@@ -53,6 +57,8 @@ jobs:
      _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
      _PKG_FETCH_NODE_VERSION: 18.5.0
      _PKG_FETCH_VERSION: 3.4
+    permissions:
+      contents: read
    steps:
      - name: Checkout repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -132,6 +138,8 @@ jobs:
    name: Build Mac CLI
    runs-on: macos-13
    needs: setup
+    permissions:
+      contents: read
    env:
      _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
      _PKG_FETCH_NODE_VERSION: 18.5.0
@@ -208,6 +216,8 @@ jobs:
    name: Build Windows CLI
    runs-on: windows-2022
    needs: setup
+    permissions:
+      contents: read
    env:
      _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
      _WIN_PKG_FETCH_VERSION: 18.5.0
@@ -341,6 +351,9 @@ jobs:
    name: Build Windows GUI
    runs-on: windows-2022
    needs: setup
+    permissions:
+      contents: read
+      id-token: write
    env:
      NODE_OPTIONS: --max_old_space_size=4096
      _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
@@ -372,10 +385,12 @@ jobs:
      - name: Install Node dependencies
        run: npm install

-      - name: Login to Azure
-        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
+      - name: Log in to Azure
+        uses: bitwarden/gh-actions/azure-login@main
        with:
-          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
+          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          client_id: ${{ secrets.AZURE_CLIENT_ID }}

      - name: Retrieve secrets
        id: retrieve-secrets
@@ -388,6 +403,9 @@ jobs:
            code-signing-client-secret,
            code-signing-cert-name"

+      - name: Log out from Azure
+        uses: bitwarden/gh-actions/azure-logout@main
+
      - name: Build & Sign
        run: npm run dist:win
        env:
@@ -431,6 +449,8 @@ jobs:
    name: Build Linux GUI
    runs-on: ubuntu-24.04
    needs: setup
+    permissions:
+      contents: read
    env:
      NODE_OPTIONS: --max_old_space_size=4096
      _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
@@ -485,6 +505,9 @@ jobs:
    name: Build MacOS GUI
    runs-on: macos-13
    needs: setup
+    permissions:
+      contents: read
+      id-token: write
    env:
      NODE_OPTIONS: --max_old_space_size=4096
      _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
@@ -512,10 +535,19 @@ jobs:
          echo "GitHub ref: $GITHUB_REF"
          echo "GitHub event: $GITHUB_EVENT"

-      - name: Login to Azure
-        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
+      - name: Log in to Azure
+        uses: bitwarden/gh-actions/azure-login@main
        with:
-          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
+          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          client_id: ${{ secrets.AZURE_CLIENT_ID }}
+
+      - name: Get Azure Key Vault secrets
+        id: get-kv-secrets
+        uses: bitwarden/gh-actions/get-keyvault-secrets@main
+        with:
+          keyvault: gh-directory-connector
+          secrets: "KEYCHAIN-PASSWORD,APP-STORE-CONNECT-AUTH-KEY,APP-STORE-CONNECT-TEAM-ISSUER"

      - name: Get certificates
        run: |
@@ -530,9 +562,12 @@ jobs:
          az keyvault secret show --id https://bitwarden-ci.vault.azure.net/certificates/macdev-cert |
            jq -r .value | base64 -d > $HOME/certificates/macdev-cert.p12

+      - name: Log out from Azure
+        uses: bitwarden/gh-actions/azure-logout@main
+
      - name: Set up keychain
        env:
-          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ steps.get-kv-secrets.outputs.KEYCHAIN-PASSWORD }}
        run: |
          security create-keychain -p $KEYCHAIN_PASSWORD build.keychain
          security default-keychain -s build.keychain
@@ -566,13 +601,13 @@ jobs:
        run: |
          mkdir ~/private_keys
          cat << EOF > ~/private_keys/AuthKey_UFD296548T.p8
-          ${{ secrets.APP_STORE_CONNECT_AUTH_KEY }}
+          ${{ steps.get-kv-secrets.outputs.APP-STORE-CONNECT-AUTH-KEY }}
          EOF

      - name: Build application
        run: npm run dist:mac
        env:
-          APP_STORE_CONNECT_TEAM_ISSUER: ${{ secrets.APP_STORE_CONNECT_TEAM_ISSUER }}
+          APP_STORE_CONNECT_TEAM_ISSUER: ${{ steps.get-kv-secrets.outputs.APP-STORE-CONNECT-TEAM-ISSUER }}
          APP_STORE_CONNECT_AUTH_KEY: UFD296548T
          APP_STORE_CONNECT_AUTH_KEY_PATH: ~/private_keys/AuthKey_UFD296548T.p8
          CSC_FOR_PULL_REQUEST: true
@@ -618,6 +653,8 @@ jobs:
      - windows-gui
      - linux-gui
      - macos-gui
+    permissions:
+      id-token: write
    steps:
      - name: Check if any job failed
        if: |
@@ -627,11 +664,13 @@ jobs:
          && contains(needs.*.result, 'failure')
        run: exit 1

-      - name: Login to Azure - CI subscription
-        uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
+      - name: Log in to Azure
        if: failure()
+        uses: bitwarden/gh-actions/azure-login@main
        with:
-          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
+          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          client_id: ${{ secrets.AZURE_CLIENT_ID }}

      - name: Retrieve secrets
        id: retrieve-secrets
@@ -641,6 +680,9 @@ jobs:
          keyvault: "bitwarden-ci"
          secrets: "devops-alerts-slack-webhook-url"

+      - name: Log out from Azure
+        uses: bitwarden/gh-actions/azure-logout@main
+
      - name: Notify Slack on failure
        uses: act10ns/slack@44541246747a30eb3102d87f7a4cc5471b0ffb7d # v2.1.0
        if: failure()
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,6 +20,8 @@ jobs:
  setup:
    name: Setup
    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
    outputs:
      release_version: ${{ steps.version.outputs.version }}
    steps:
@@ -48,6 +50,10 @@ jobs:
    name: Release
    runs-on: ubuntu-24.04
    needs: setup
+    permissions:
+      actions: read
+      packages: read
+      contents: write
    steps:
      - name: Download all artifacts
        if: ${{ inputs.release_type != 'Dry Run' }}
--- a/.github/workflows/scan.yml
+++ b/.github/workflows/scan.yml
@@ -12,7 +12,7 @@ on:
  pull_request_target:
    types: [opened, synchronize, reopened]
    branches:
-      - "main"
+      - main

 permissions: {}

@@ -31,6 +31,7 @@ jobs:
      contents: read
      pull-requests: write
      security-events: write
+      id-token: write

    steps:
      - name: Check out repo
@@ -38,16 +39,33 @@ jobs:
        with:
          ref: ${{ github.event.pull_request.head.sha }}

+      - name: Log in to Azure
+        uses: bitwarden/gh-actions/azure-login@main
+        with:
+          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          client_id: ${{ secrets.AZURE_CLIENT_ID }}
+
+      - name: Get Azure Key Vault secrets
+        id: get-kv-secrets
+        uses: bitwarden/gh-actions/get-keyvault-secrets@main
+        with:
+          keyvault: gh-org-bitwarden
+          secrets: "CHECKMARX-TENANT,CHECKMARX-CLIENT-ID,CHECKMARX-SECRET"
+
+      - name: Log out from Azure
+        uses: bitwarden/gh-actions/azure-logout@main
+
      - name: Scan with Checkmarx
        uses: checkmarx/ast-github-action@184bf2f64f55d1c93fd6636d539edf274703e434 # 2.0.41
        env:
          INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}"
        with:
          project_name: ${{ github.repository }}
-          cx_tenant: ${{ secrets.CHECKMARX_TENANT }}
+          cx_tenant: ${{ steps.get-kv-secrets.outputs.CHECKMARX-TENANT }}
          base_uri: https://ast.checkmarx.net/
-          cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }}
-          cx_client_secret: ${{ secrets.CHECKMARX_SECRET }}
+          cx_client_id: ${{ steps.get-kv-secrets.outputs.CHECKMARX-CLIENT-ID }}
+          cx_client_secret: ${{ steps.get-kv-secrets.outputs.CHECKMARX-SECRET }}
          additional_params: |
            --report-format sarif \
            --filter "state=TO_VERIFY;PROPOSED_NOT_EXPLOITABLE;CONFIRMED;URGENT" \
@@ -67,6 +85,7 @@ jobs:
    permissions:
      contents: read
      pull-requests: write
+      id-token: write

    steps:
      - name: Check out repo
@@ -75,10 +94,27 @@ jobs:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}

+      - name: Log in to Azure
+        uses: bitwarden/gh-actions/azure-login@main
+        with:
+          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          client_id: ${{ secrets.AZURE_CLIENT_ID }}
+
+      - name: Get Azure Key Vault secrets
+        id: get-kv-secrets
+        uses: bitwarden/gh-actions/get-keyvault-secrets@main
+        with:
+          keyvault: gh-org-bitwarden
+          secrets: "SONAR-TOKEN"
+
+      - name: Log out from Azure
+        uses: bitwarden/gh-actions/azure-logout@main
+
      - name: Scan with SonarCloud
        uses: sonarsource/sonarqube-scan-action@2500896589ef8f7247069a56136f8dc177c27ccf # v5.2.0
        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_TOKEN: ${{ steps.get-kv-secrets.outputs.SONAR-TOKEN }}
        with:
          args: >
            -Dsonar.organization=${{ github.repository_owner }}
--- a/.github/workflows/version-bump.yml
+++ b/.github/workflows/version-bump.yml
@@ -12,6 +12,9 @@ jobs:
  bump_version:
    name: Bump Version
    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      id-token: write
    steps:
      - name: Validate version input
        if: ${{ inputs.version_number_override != '' }}
@@ -19,12 +22,29 @@ jobs:
        with:
          version: ${{ inputs.version_number_override }}

+      - name: Log in to Azure
+        uses: bitwarden/gh-actions/azure-login@main
+        with:
+          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          client_id: ${{ secrets.AZURE_CLIENT_ID }}
+
+      - name: Get Azure Key Vault secrets
+        id: get-kv-secrets
+        uses: bitwarden/gh-actions/get-keyvault-secrets@main
+        with:
+          keyvault: gh-org-bitwarden
+          secrets: "BW-GHAPP-ID,BW-GHAPP-KEY"
+
+      - name: Log out from Azure
+        uses: bitwarden/gh-actions/azure-logout@main
+
      - name: Generate GH App token
        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
        id: app-token
        with:
-          app-id: ${{ secrets.BW_GHAPP_ID }}
-          private-key: ${{ secrets.BW_GHAPP_KEY }}
+          app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
+          private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}

      - name: Checkout Branch
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2