Merge pull request #473 from furkatgofurov7/use-secrets-from-vault

Build and Push Prime images using prime registry secrets from vault
rancher · Oct 17, 2024 · 49618fe · 49618fe
2 parents a94a579 + e2b3fc2
commit 49618fe
Showing 1 changed file with 25 additions and 6 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -7,14 +7,16 @@ on:
 
 env:
   TAG: ${{ github.ref_name }}
-  REGISTRY: ghcr.io
+  GHCR_REGISTRY: ghcr.io
 
 jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
+      actions: read
+      id-token: write
     steps:
     - name: Checkout
       uses: actions/checkout@v4
@@ -24,16 +26,33 @@ jobs:
       uses: actions/setup-go@v5
       with:
         go-version: '=1.21.8'
-    - name: Docker login
+    - name: Docker login ghcr.io
       uses: docker/login-action@v3
       with:
-        registry: ${{ env.REGISTRY }}
+        registry: ${{ env.GHCR_REGISTRY }}
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-    - name: Build docker image
+    - name: Build docker image for ghcr.io
       run: make docker-build-all TAG=${{ env.TAG }}
-    - name: Push docker image
-      run: make docker-push-all TAG=${{ env.TAG }} PROD_REGISTRY=${{ env.REGISTRY }}
+    - name: Push docker image to ghcr.io
+      run: make docker-push-all TAG=${{ env.TAG }} PROD_REGISTRY=${{ env.GHCR_REGISTRY }}
+    - name: Read prime registry secrets
+      uses: rancher-eio/read-vault-secrets@main
+      with:
+        secrets: |
+          secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials username |  PRIME-REGISTRY-USERNAME;
+          secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials password |  PRIME-REGISTRY-PASSWORD;
+          secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials registry |  PRIME-REGISTRY-REGISTRY;
+    - name: Docker login to prime registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.PRIME-REGISTRY-REGISTRY }}
+        username: ${{ env.PRIME-REGISTRY-USERNAME }}
+        password: ${{ env.PRIME-REGISTRY-PASSWORD }}
+    - name: Build docker image for prime registry
+      run: make docker-build-all TAG=${{ env.TAG }}
+    - name: Push docker image to prime registry
+      run: make docker-push-all TAG=${{ env.TAG }} PROD_REGISTRY=${{ env.PRIME-REGISTRY-REGISTRY }}
   release:
     runs-on: ubuntu-latest
     permissions: