feature/PI-43-stored-properties secret stuff 2

NHSDigital · Oct 23, 2023 · c6a7d85 · c6a7d85
1 parent e038376
commit c6a7d85
Show file tree

Hide file tree

Showing 12 changed files with 27 additions and 1 deletion.
diff --git a/.github/actions/make/action.yml b/.github/actions/make/action.yml
@@ -29,7 +29,7 @@ runs:
       if: inputs.requires-aws
       uses: aws-actions/configure-aws-credentials@v4
       with:
-        role-to-assume: ${{ secrets.CI_ROLE_NAME }}
+        role-to-assume: ${{ env.CI_ROLE_NAME }}
         role-session-name: github-actions-ci-${{ env.GITHUB_SHA_SHORT }}
         aws-region: eu-west-2
         output-credentials: true

diff --git a/.github/workflows/deploy-parameters-nonprod.yml b/.github/workflows/deploy-parameters-nonprod.yml
@@ -14,8 +14,17 @@ on:
           - int
 
 jobs:
+  parse-secrets:
+    runs-on: [self-hosted, ci]
+    steps:
+      - id: parse-secrets
+        run: |
+          echo "::add-mask::${{ secrets.CI_ROLE_NAME }}"
+          echo "CI_ROLE_NAME=${{ secrets.CI_ROLE_NAME }}" >> $GITHUB_ENV
+
   deploy:
     uses: ./.github/workflows/_deploy.yml
+    needs: [parse-secrets]
     with:
       workspace: ${{ inputs.workspace }}
       parameter-deploy: "parameter_deploy"

diff --git a/.github/workflows/deploy-parameters-prod.yml b/.github/workflows/deploy-parameters-prod.yml
@@ -4,8 +4,17 @@ on:
   workflow_dispatch:
 
 jobs:
+  parse-secrets:
+    runs-on: [self-hosted, ci]
+    steps:
+      - id: parse-secrets
+        run: |
+          echo "::add-mask::${{ secrets.CI_ROLE_NAME }}"
+          echo "CI_ROLE_NAME=${{ secrets.CI_ROLE_NAME }}" >> $GITHUB_ENV
+
   deploy:
     uses: ./.github/workflows/_deploy.yml
+    needs: [parse-secrets]
     with:
       workspace: prod
       parameter-deploy: "parameter_deploy"

diff --git a/.github/workflows/pull-requests.yml b/.github/workflows/pull-requests.yml
@@ -14,6 +14,14 @@ env:
   RUNNING_IN_CI: 1
 
 jobs:
+  parse-secrets:
+    runs-on: [self-hosted, ci]
+    steps:
+      - id: parse-secrets
+        run: |
+          echo "::add-mask::${{ secrets.CI_ROLE_NAME }}"
+          echo "CI_ROLE_NAME=${{ secrets.CI_ROLE_NAME }}" >> $GITHUB_ENV
+
   create-workspace-name:
     runs-on: [self-hosted, ci]
     outputs:

diff --git a/...ructure/terraform/per_account/dev/main.tf → infrastructure/terraform/per_account/main.tf b/...ructure/terraform/per_account/dev/main.tf → infrastructure/terraform/per_account/main.tf
diff --git a/...m/per_account/dev/modules/placeholder.txt → ...aform/per_account/modules/placeholder.txt b/...m/per_account/dev/modules/placeholder.txt → ...aform/per_account/modules/placeholder.txt
diff --git a/...form/per_account/dev/parameters/locals.tf → ...erraform/per_account/parameters/locals.tf b/...form/per_account/dev/parameters/locals.tf → ...erraform/per_account/parameters/locals.tf
diff --git a/...raform/per_account/dev/parameters/main.tf → .../terraform/per_account/parameters/main.tf b/...raform/per_account/dev/parameters/main.tf → .../terraform/per_account/parameters/main.tf
diff --git a/...rm/per_account/dev/parameters/provider.tf → ...raform/per_account/parameters/provider.tf b/...rm/per_account/dev/parameters/provider.tf → ...raform/per_account/parameters/provider.tf
diff --git a/...m/per_account/dev/parameters/terraform.tf → ...aform/per_account/parameters/terraform.tf b/...m/per_account/dev/parameters/terraform.tf → ...aform/per_account/parameters/terraform.tf
diff --git a/...raform/per_account/dev/parameters/vars.tf → .../terraform/per_account/parameters/vars.tf b/...raform/per_account/dev/parameters/vars.tf → .../terraform/per_account/parameters/vars.tf
diff --git a/...terraform/per_account/dev/placeholder.txt → ...ure/terraform/per_account/placeholder.txt b/...terraform/per_account/dev/placeholder.txt → ...ure/terraform/per_account/placeholder.txt