getting the binary secret #19
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - chore/publish-kotlin-ret-maven | |
| jobs: | |
| build: | |
| permissions: | |
| contents: read | |
| id-token: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Install AWS CLI | |
| uses: unfor19/install-aws-cli-action@ee0eb151cf1bca186ccf8c35d314b08d62e0e878 # v1 | |
| with: | |
| version: 2 | |
| - name: Checkout actions-oidc-debugger | |
| uses: actions/checkout@v3 | |
| with: | |
| repository: github/actions-oidc-debugger | |
| ref: main | |
| token: ${{ github.token }} | |
| path: ./.github/actions/actions-oidc-debugger | |
| - name: Debug OIDC Claims | |
| uses: ./.github/actions/actions-oidc-debugger | |
| with: | |
| audience: 'https://github.com/github' | |
| - name: Configure AWS credentials to fetch secrets | |
| uses: aws-actions/configure-aws-credentials@97271860067ec931c45b8d104fbf0d15954ab85c # branch v1-node16 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_RET_ROLE_NAME }} | |
| aws-region: eu-west-2 | |
| role-session-name: ret-${{ github.run_id }}-${{ github.run_attempt }} | |
| - name: Fetch AWS secrets | |
| uses: aws-actions/aws-secretsmanager-get-secrets@287592d14d9c9c48199db83dc182ae12af3df18e # v1.0.1 | |
| with: | |
| parse-json-secrets: true | |
| secret-ids: | | |
| MAVEN_CENTRAL_,${{ secrets.MAVEN_CENTRAL_SECRET_ID }}, | |
| GPG_PASSPHRASE,${{ secrets.GPG_PASSPHRASE_SECRET_ID }} | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-java@v3 | |
| with: | |
| distribution: temurin | |
| java-version: 8 | |
| - name: Setup Gradle | |
| uses: gradle/gradle-build-action@v2 | |
| - name: Execute Gradle build | |
| run: | | |
| cd interop/kotlin/ret-kotlin/lib/ | |
| aws secretsmanager get-secret-value --secret-id ${{ secrets.GPG_BINARY_SECRET_ID }} --query SecretBinary --output text | base64 --decode > rdx-secring.gpg | |
| ls -la | |
| gradle build publish -Psigning.secretKeyRingFile=rdx-secring.gpg -Psigning.password=secret -Psigning.keyId=24875D73 -PossrhUsername=your-jira-id -PossrhPassword=your-jira-password |