diff --git a/.github/workflows/secret-expire-check.yml b/.github/workflows/secret-expire-check.yml deleted file mode 100644 index b75048e..0000000 --- a/.github/workflows/secret-expire-check.yml +++ /dev/null @@ -1,38 +0,0 @@ -name: Daily Check to see if any secrets will expire soon - -on: - workflow_dispatch: - schedule: # At 04:00 every morning - - cron: '0 04 * * *' - - -jobs: - secret-expire-check: - runs-on: ubuntu-latest - permissions: - id-token: write - contents: write - - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Run check if any secrets will expire within next month - id: secrete-expire-check-month - run: | - ./bin/check_secret_expire.sh $(date -d "+1 month" +"%Y-%m-%d") - - - name: Slack Notification on Failure - if: ${{ failure() }} - uses: rtCamp/action-slack-notify@v2 - env: - SLACK_CHANNEL: secret-expire - SLACK_WEBHOOK: ${{ secrets.MERKELY_SLACK_CI_FAILURES_WEBHOOK }} - SLACK_USERNAME: GithubActions - SLACK_COLOR: ${{ job.status }} - SLACKIFY_MARKDOWN: true - SLACK_TITLE: Secret has expired - SLACK_MESSAGE: "Some secrets in `WaveApp` is about to or has expired. Please check the \ - [log](${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}) \ - for more details." - SLACK_FOOTER: diff --git a/.github/workflows/secrets-update.yml b/.github/workflows/secrets-update.yml deleted file mode 100644 index 9463967..0000000 --- a/.github/workflows/secrets-update.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: Check of updates to secrets info files - -on: - push: - branches: - - main - paths: - - 'secrets/*.txt' - - -env: - KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN_PROD }} - - -jobs: - secrets-update: - runs-on: ubuntu-latest - permissions: - id-token: write - contents: write - - steps: - - name: Checkout - uses: actions/checkout@v4 - with: - fetch-depth: 2 - - - name: Setup Kosli CLI - uses: kosli-dev/setup-cli-action@v2 - with: - version: - ${{ vars.KOSLI_CLI_VERSION }} - - - name: Report secrets update - run: - ./bin/report_update_of_secrets.sh ${{ github.repository }} diff --git a/bin/check_secret_expire.sh b/bin/check_secret_expire.sh deleted file mode 100755 index 0998994..0000000 --- a/bin/check_secret_expire.sh +++ /dev/null @@ -1,72 +0,0 @@ -#!/usr/bin/env bash -set -Eeu - -SCRIPT_NAME=check_secret_expire.sh -ROOT_DIR=$(dirname $(readlink -f $0))/.. -NOW_DATE=$(date +%Y-%m-%d) - -print_help() -{ - cat < [yyyy-mm-dd] - -Will search all txt-files in secrets directory to see if any of them -has a secret that has expired. You can specify a date if you want to -know if something expires in the future - -Options are: - -h Print this help menu -EOF -} - -check_arguments() -{ - while getopts "h" opt; do - case $opt in - h) - print_help - exit 1 - ;; - \?) - echo "Invalid option: -$OPTARG" >&2 - exit 1 - ;; - esac - done - - # Remove options from command line - shift $((OPTIND-1)) - - if [ $# -eq 1 ]; then - NOW_DATE=$1; shift - fi -} - -echo_if_secret_expired() -{ - local file=$1; shift - local now_date=$1; shift - local expire_date now_sec expire_sec - expire_date=$(grep "secret-expire:" ${file} | sed "s/secret-expire: *//") - - if [[ ! "${now_date}" < "${expire_date}" ]]; then - grep "secret-name:" ${file} | sed "s/secret-name: */ /" | tr '\n' ' ' - grep "secret-expire:" ${file} - return 1 - fi - return 0 -} - -main() -{ - check_arguments "$@" - local file - local result=0 - echo "The following is a list of secrets in 'secrets/*txt' which will have expired on ${NOW_DATE}" - for file in ${ROOT_DIR}/secrets/*txt; do - echo_if_secret_expired ${file} ${NOW_DATE} || result=1 - done - return $result -} - -main "$@" diff --git a/bin/report_update_of_secrets.sh b/bin/report_update_of_secrets.sh deleted file mode 100755 index 71caec4..0000000 --- a/bin/report_update_of_secrets.sh +++ /dev/null @@ -1,64 +0,0 @@ -#!/usr/bin/env bash -set -Eeu - -REPO_NAME=$1; shift - -export KOSLI_ORG=kosli -export KOSLI_FLOW="secrets-updated" - -SECRETS_PATH="secrets/*.txt" -SECRETS_FILES_REGEXP="^secrets/.*\.txt" - -get_soc_trail_name() -{ - local -r SOC_START_DAY=25 - local -r SOC_START_MONTH=2 - local current_day=$(date +%-d) - local current_month=$(date +%-m) - local current_year=$(date +%Y) - - if [[ ${current_month} -gt ${SOC_START_MONTH} || (${current_month} -eq ${SOC_START_MONTH} && ${current_day} -ge ${SOC_START_DAY}) ]]; then - echo "soc-${current_year}-$((current_year + 1))" - else - echo "soc-$((current_year - 1))-${current_year}" - fi -} - -report_update_of_secrets_to_kosli() -{ - local repo_name=$1; shift - local -r trail_name=$(get_soc_trail_name) - local files_changed secret_name expire_date repository attestation_name - - files_changed=$(git diff --name-only HEAD^ HEAD ${SECRETS_PATH}) - for file in ${files_changed}; do - secret_name=$(grep "^secret-name:" $file | sed "s/secret-name: *//") - expire_date=$(grep "^secret-expire:" $file | sed "s/secret-expire: *//") - secret_updated_by=$(grep "^secret-updated-by:" $file | sed "s/secret-updated-by: *//") - attestation_name="${repo_name//\//_}-${secret_name//\//_}" - - kosli attest generic \ - --name=${attestation_name} \ - --annotate Secret_repository=${repo_name} \ - --annotate Secret_name=${secret_name} \ - --annotate Secret_expire="${expire_date}" \ - --annotate Secret_updated_by="${secret_updated_by}" \ - --trail=${trail_name} - done - - files_deleted=$(git diff --name-only --diff-filter=D HEAD^ HEAD | grep ${SECRETS_FILES_REGEXP}) || true - for file in ${files_deleted}; do - secret_name=$(git show HEAD^:${file} | grep "^secret-name:" | sed "s/secret-name: *//") - attestation_name="${repo_name//\//_}-${secret_name//\//_}" - - kosli attest generic \ - --name=${attestation_name} \ - --annotate Secret_repository=${repo_name} \ - --annotate Secret_name=${secret_name} \ - --annotate Secret_deleted="SECRET DELETED" \ - --trail=${trail_name} - done - -} - -report_update_of_secrets_to_kosli ${REPO_NAME#*/} diff --git a/secrets/gh-repo-azure-credentials.txt b/secrets/gh-repo-azure-credentials.txt deleted file mode 100644 index 1e3def9..0000000 --- a/secrets/gh-repo-azure-credentials.txt +++ /dev/null @@ -1,31 +0,0 @@ -secret-name: AZURE_CREDENTIALS -secret-expire: 2025-10-07 -secret-updated: 2024-10-07 -secret-updated-by: tore -secret-type: gh-repo -is-secret: true -secret-usage: Used to test deploying an azure web app - -update-instructions: -Instructions for generating a new secret: -1. Configuration of Azure is done at https://portal.azure.com/ -2. Go to **App registrations** -3. Select tab **All applications** -4. Find the Application with with Display name: WaveApp-Build - (client) ID that matches `262*****-****-****-****-*********970` -and press the Display name of the application (it opens a new page) -5. Under **Essentials** there is an entry **Client credentials** with link to **secret** -6. Create a **New client secret** -7. Give a **Description** and select **Expires** - -The azure creds is json like this: -{ - "clientSecret": "******", - "subscriptionId": "96c*****-****-****-****-*********632", - "tenantId": "e52*****-****-****-****-*********771", - "clientId": "262*****-****-****-****-*********970" -} - -Go to https://github.com/kosli-dev/cli/settings/secrets/actions -under -Copy and paste in the complete json