Skip to content

Improve infisical workflow #2206

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
djeebus merged 6 commits into from
Apr 8, 2026
+29 −20
Merged

Improve infisical workflow #2206

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
41c6f7d
improve infisical workflow
djeebus Mar 23, 2026
780de28
Supplement the new env vars with old makefile include
djeebus Mar 23, 2026
c7fb9d6
keep the versions consistent
djeebus Mar 23, 2026
1b66bcd
Merge branch 'main' into use-infisical-env-vars
djeebus Apr 2, 2026
05f6ceb
Fix env interpolation security issue
djeebus Apr 6, 2026
b837ce6
Merge branch 'main' into use-infisical-env-vars
djeebus Apr 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 18 additions & 11 deletions .github/actions/deploy-setup/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,30 +4,28 @@ inputs:
environment:
description: "Target environment for deployment, e.g. staging"
required: true
infisical_client_id:
description: "Infisical client ID for accessing secrets"
required: true
infisical_client_secret:
description: "Infisical client secret for accessing secrets"
required: true
install_gcloud:
description: "Whether to install the gcloud CLI (needed for gsutil/docker auth)"
required: false
default: "false"
infisical_machine_identity_id:
description: "Infisical machine identity ID for accessing secrets"
required: true

runs:
using: "composite"
steps:
- uses: Infisical/secrets-action@v1.0.9
- name: Pull infisical secrets into temporary file
uses: Infisical/secrets-action@v1.0.9
Comment thread
djeebus marked this conversation as resolved.
Outdated
with:
client-id: ${{ inputs.infisical_client_id }}
client-secret: ${{ inputs.infisical_client_secret }}
env-slug: ${{ inputs.environment }}
method: "oidc"
identity-id: ${{ inputs.infisical_machine_identity_id }}
project-slug: "infra-deployment"
env-slug: ${{ inputs.environment }}
export-type: "file"
file-output-path: "/.env.infisical"

- name: Load Environment Variables
- name: Transform infisical secrets into make include file, load a few as environment variables
id: load-env
run: |
echo ${{ inputs.environment }} > .last_used_env
Comment thread
djeebus marked this conversation as resolved.
Outdated
Expand All @@ -44,6 +42,15 @@ runs:
echo "GH_WORKLOAD_IDENTITY_PROVIDER=${GH_WORKLOAD_IDENTITY_PROVIDER}" >> $GITHUB_ENV
shell: bash

- name: Load environment variables from Infisical
uses: Infisical/secrets-action@v1.0.15
with:
method: "oidc"
identity-id: ${{ inputs.infisical_machine_identity_id }}
project-slug: "infra-deployment-env"
Comment thread
djeebus marked this conversation as resolved.
env-slug: ${{ inputs.environment }}
export-type: "env"
Comment thread
djeebus marked this conversation as resolved.
Comment thread
djeebus marked this conversation as resolved.

- name: Setup Service Account
uses: google-github-actions/auth@v2
with:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/build-and-upload-job.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ jobs:
deploy:
name: Build and upload job to the ${{ inputs.environment }} environment
runs-on: ci-builder
environment: ${{ inputs.environment }}
permissions:
contents: read
id-token: write
Expand All @@ -45,9 +46,8 @@ jobs:
uses: ./.github/actions/deploy-setup
with:
environment: ${{ inputs.environment }}
infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
install_gcloud: "true"
infisical_machine_identity_id: ${{ vars.INFISICAL_MACHINE_IDENTITY_ID }}

- name: Set up Docker
env:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/deploy-infra.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ jobs:
deploy:
name: Deploy Infra to the ${{ inputs.environment }} environment
runs-on: ubuntu-22.04
environment: ${{ inputs.environment }}
permissions:
contents: read
id-token: write
Expand All @@ -43,9 +44,8 @@ jobs:
uses: ./.github/actions/deploy-setup
with:
environment: ${{ inputs.environment }}
infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
install_gcloud: "true"
infisical_machine_identity_id: ${{ vars.INFISICAL_MACHINE_IDENTITY_ID }}

- name: Run Terraform state migrations
if: inputs.plan_only == 'false'
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/deploy-job.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ jobs:
deploy:
name: Deploy job to the ${{ inputs.environment }} environment
runs-on: ubuntu-22.04
environment: ${{ inputs.environment }}
permissions:
contents: read
id-token: write
Expand All @@ -46,8 +47,7 @@ jobs:
uses: ./.github/actions/deploy-setup
with:
environment: ${{ inputs.environment }}
infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
infisical_machine_identity_id: ${{ vars.INFISICAL_MACHINE_IDENTITY_ID }}

- name: Run Terraform state migrations
if: inputs.plan_only == 'false'
Expand Down
Loading