Skip to content

Commit 66df270

Browse files
mscolnickmscolnick
authored
ci: doppler secrets (#9236)
Migrating secrets to doppler from GH
1 parent 80fa4cd commit 66df270

11 files changed

Lines changed: 192 additions & 28 deletions

‎.github/workflows/cla.yml‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,28 @@ permissions:
1515
contents: write
1616
pull-requests: write
1717
statuses: write
18+
id-token: write # required for Doppler OIDC
1819

1920
jobs:
2021
CLAAssistant:
2122
runs-on: ubuntu-latest
2223
steps:
24+
- name: 🔐 Fetch Doppler secrets
25+
if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
26+
uses: dopplerhq/secrets-fetch-action@cd2efbf9a404504316435873eff298b82f7e0562 # v1.3.0
27+
id: secrets
28+
with:
29+
auth-method: oidc
30+
doppler-identity-id: ${{ vars.DOPPLER_IDENTITY_ID }}
31+
doppler-project: marimo-oss
32+
doppler-config: ci_cla
33+
2334
- name: "CLA Assistant"
2435
if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
2536
uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
2637
env:
2738
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28-
# the below token should have repo scope and must be manually added by you in the repository's secret
29-
# This token is required only if you have configured to store the signatures in a remote repository/organization
30-
PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
39+
PERSONAL_ACCESS_TOKEN: ${{ steps.secrets.outputs.PERSONAL_ACCESS_TOKEN }}
3140
with:
3241
path-to-signatures: "signatures/version1/cla.json"
3342
path-to-document: "https://marimo.io/cla" # e.g. a CLA or a DCO document

‎.github/workflows/docs.yml‎

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ concurrency:
1313

1414
permissions:
1515
contents: read
16+
id-token: write # required for Doppler OIDC
1617

1718
env:
1819
UV_EXCLUDE_NEWER: "7 days"
@@ -24,6 +25,15 @@ jobs:
2425
steps:
2526
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2627

28+
- name: 🔐 Fetch Doppler secrets
29+
uses: dopplerhq/secrets-fetch-action@cd2efbf9a404504316435873eff298b82f7e0562 # v1.3.0
30+
id: secrets
31+
with:
32+
auth-method: oidc
33+
doppler-identity-id: ${{ vars.DOPPLER_IDENTITY_ID }}
34+
doppler-project: marimo-oss
35+
doppler-config: ci_docs
36+
2737
- name: 🐍 Setup uv
2838
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
2939
with:
@@ -34,16 +44,18 @@ jobs:
3444
run: npm install --global vercel@latest
3545

3646
- name: ⬇️ Pull Vercel Environment Information
37-
run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}
3847
env:
39-
VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
40-
VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
48+
VERCEL_ORG_ID: ${{ steps.secrets.outputs.VERCEL_ORG_ID }}
49+
VERCEL_PROJECT_ID: ${{ steps.secrets.outputs.VERCEL_PROJECT_ID }}
50+
VERCEL_TOKEN: ${{ steps.secrets.outputs.VERCEL_TOKEN }}
51+
run: vercel pull --yes --environment=production
4152

4253
- name: 📚 Build docs
43-
run: vercel build --prod --token=${{ secrets.VERCEL_TOKEN }}
4454
env:
45-
VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
46-
VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
55+
VERCEL_ORG_ID: ${{ steps.secrets.outputs.VERCEL_ORG_ID }}
56+
VERCEL_PROJECT_ID: ${{ steps.secrets.outputs.VERCEL_PROJECT_ID }}
57+
VERCEL_TOKEN: ${{ steps.secrets.outputs.VERCEL_TOKEN }}
58+
run: vercel build --prod
4759

4860
- name: 📝 Generate markdown versions of docs
4961
run: |
@@ -88,7 +100,8 @@ jobs:
88100
89101
- name: 🚀 Deploy to Vercel
90102
if: github.ref == 'refs/heads/main' && steps.latest.outputs.is_latest == 'true'
91-
run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }}
92103
env:
93-
VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
94-
VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
104+
VERCEL_ORG_ID: ${{ steps.secrets.outputs.VERCEL_ORG_ID }}
105+
VERCEL_PROJECT_ID: ${{ steps.secrets.outputs.VERCEL_PROJECT_ID }}
106+
VERCEL_TOKEN: ${{ steps.secrets.outputs.VERCEL_TOKEN }}
107+
run: vercel deploy --prebuilt --prod

‎.github/workflows/marimo-bot.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,19 @@ jobs:
8686
console.log(`Comment created with ID: ${comment.data.id}`);
8787
return comment.data.id;
8888
89+
- name: 🔐 Fetch Doppler secrets
90+
uses: dopplerhq/secrets-fetch-action@cd2efbf9a404504316435873eff298b82f7e0562 # v1.3.0
91+
id: secrets
92+
with:
93+
auth-method: oidc
94+
doppler-identity-id: ${{ vars.DOPPLER_IDENTITY_ID }}
95+
doppler-project: marimo-oss
96+
doppler-config: ci_test
97+
8998
- name: 📦 Build frontend
9099
uses: ./.github/actions/build-frontend
91100
with:
92-
turbo-token: ${{ secrets.TURBO_TOKEN }}
101+
turbo-token: ${{ steps.secrets.outputs.TURBO_TOKEN }}
93102

94103
- name: Install uv
95104
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7

‎.github/workflows/playwright.yml‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ jobs:
3636
if: ${{ needs.changes.outputs.playwright == 'true' }}
3737
timeout-minutes: 18 # 2024-01-18 avg: 5.0m max: 7.0m
3838
runs-on: ubuntu-latest
39+
permissions:
40+
contents: read
41+
id-token: write # required for Doppler OIDC
3942
defaults:
4043
run:
4144
shell: bash
@@ -58,11 +61,23 @@ jobs:
5861
run: |
5962
sed -i 's/auto_instantiate = false/auto_instantiate = true/' pyproject.toml
6063
64+
- name: 🔐 Fetch Doppler secrets
65+
# Skip on PRs from forks: id-token write is downgraded to read, so OIDC fails.
66+
# Downstream tokens (TURBO_TOKEN, CODECOV_TOKEN) are optional and tolerate empty.
67+
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
68+
uses: dopplerhq/secrets-fetch-action@cd2efbf9a404504316435873eff298b82f7e0562 # v1.3.0
69+
id: secrets
70+
with:
71+
auth-method: oidc
72+
doppler-identity-id: ${{ vars.DOPPLER_IDENTITY_ID }}
73+
doppler-project: marimo-oss
74+
doppler-config: ci_test
75+
6176
- name: 📦 Build frontend
6277
uses: ./.github/actions/build-frontend
6378
with:
64-
turbo-token: ${{ secrets.TURBO_TOKEN }}
65-
codecov-token: ${{ secrets.CODECOV_TOKEN }}
79+
turbo-token: ${{ steps.secrets.outputs.TURBO_TOKEN }}
80+
codecov-token: ${{ steps.secrets.outputs.CODECOV_TOKEN }}
6681

6782
- name: 🐍 Setup uv
6883
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7

‎.github/workflows/release-dev.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ jobs:
2020
runs-on: ubuntu-latest
2121
permissions:
2222
contents: read
23+
id-token: write # required for Doppler OIDC
2324
defaults:
2425
run:
2526
shell: bash
@@ -34,11 +35,20 @@ jobs:
3435
# get tag history for version number
3536
fetch-depth: 0
3637

38+
- name: 🔐 Fetch Doppler secrets
39+
uses: dopplerhq/secrets-fetch-action@cd2efbf9a404504316435873eff298b82f7e0562 # v1.3.0
40+
id: secrets
41+
with:
42+
auth-method: oidc
43+
doppler-identity-id: ${{ vars.DOPPLER_IDENTITY_ID }}
44+
doppler-project: marimo-oss
45+
doppler-config: ci_deploy
46+
3747
- name: 📦 Build frontend
3848
uses: ./.github/actions/build-frontend
3949
with:
40-
turbo-token: ${{ secrets.TURBO_TOKEN }}
41-
codecov-token: ${{ secrets.CODECOV_TOKEN }}
50+
turbo-token: ${{ steps.secrets.outputs.TURBO_TOKEN }}
51+
codecov-token: ${{ steps.secrets.outputs.CODECOV_TOKEN }}
4252

4353
- name: Install uv
4454
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7

‎.github/workflows/release-marimo-base.yml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,20 @@ jobs:
3333
- name: ⬇️ Checkout repo
3434
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3535

36+
- name: 🔐 Fetch Doppler secrets
37+
uses: dopplerhq/secrets-fetch-action@cd2efbf9a404504316435873eff298b82f7e0562 # v1.3.0
38+
id: secrets
39+
with:
40+
auth-method: oidc
41+
doppler-identity-id: ${{ vars.DOPPLER_IDENTITY_ID }}
42+
doppler-project: marimo-oss
43+
doppler-config: ci_deploy
44+
3645
- name: 📦 Build frontend
3746
uses: ./.github/actions/build-frontend
3847
with:
39-
turbo-token: ${{ secrets.TURBO_TOKEN }}
40-
codecov-token: ${{ secrets.CODECOV_TOKEN }}
48+
turbo-token: ${{ steps.secrets.outputs.TURBO_TOKEN }}
49+
codecov-token: ${{ steps.secrets.outputs.CODECOV_TOKEN }}
4150

4251
- name: Install uv
4352
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7

‎.github/workflows/release-prod.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ jobs:
2020
runs-on: ubuntu-latest
2121
permissions:
2222
contents: read
23+
id-token: write # required for Doppler OIDC
2324
defaults:
2425
run:
2526
shell: bash
@@ -31,11 +32,20 @@ jobs:
3132
- name: ⬇️ Checkout repo
3233
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3334

35+
- name: 🔐 Fetch Doppler secrets
36+
uses: dopplerhq/secrets-fetch-action@cd2efbf9a404504316435873eff298b82f7e0562 # v1.3.0
37+
id: secrets
38+
with:
39+
auth-method: oidc
40+
doppler-identity-id: ${{ vars.DOPPLER_IDENTITY_ID }}
41+
doppler-project: marimo-oss
42+
doppler-config: ci_deploy
43+
3444
- name: 📦 Build frontend
3545
uses: ./.github/actions/build-frontend
3646
with:
37-
turbo-token: ${{ secrets.TURBO_TOKEN }}
38-
codecov-token: ${{ secrets.CODECOV_TOKEN }}
47+
turbo-token: ${{ steps.secrets.outputs.TURBO_TOKEN }}
48+
codecov-token: ${{ steps.secrets.outputs.CODECOV_TOKEN }}
3949

4050
- name: 🐍 Setup uv
4151
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7

‎.github/workflows/release-tag.yml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ jobs:
1515
runs-on: ubuntu-latest
1616
permissions:
1717
contents: read
18+
id-token: write # required for Doppler OIDC
1819
steps:
1920
- name: Extract version from PR title
2021
id: version
@@ -28,14 +29,23 @@ jobs:
2829
fi
2930
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
3031
32+
- name: 🔐 Fetch Doppler secrets
33+
uses: dopplerhq/secrets-fetch-action@cd2efbf9a404504316435873eff298b82f7e0562 # v1.3.0
34+
id: secrets
35+
with:
36+
auth-method: oidc
37+
doppler-identity-id: ${{ vars.DOPPLER_IDENTITY_ID }}
38+
doppler-project: marimo-oss
39+
doppler-config: ci_deploy
40+
3141
# Use a GitHub App token so the tag push triggers other workflows.
3242
# Tags pushed with the default GITHUB_TOKEN do not trigger workflows.
3343
- name: Generate app token
3444
id: app-token
3545
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
3646
with:
3747
app-id: ${{ vars.RELEASE_APP_ID }}
38-
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
48+
private-key: ${{ steps.secrets.outputs.RELEASE_APP_PRIVATE_KEY }}
3949

4050
- name: Checkout
4151
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

‎.github/workflows/test_be.yaml‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,9 @@ jobs:
186186
name: Test coverage
187187
runs-on: ubuntu-latest
188188
timeout-minutes: 35
189+
permissions:
190+
contents: read
191+
id-token: write # required for Doppler OIDC
189192
steps:
190193
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
191194

@@ -210,6 +213,16 @@ jobs:
210213
--inline-snapshot=disable \
211214
--cov=marimo --cov-report=xml --junitxml=junit.xml -o junit_family=legacy
212215
216+
- name: 🔐 Fetch Doppler secrets
217+
if: ${{ !cancelled() }}
218+
uses: dopplerhq/secrets-fetch-action@cd2efbf9a404504316435873eff298b82f7e0562 # v1.3.0
219+
id: secrets
220+
with:
221+
auth-method: oidc
222+
doppler-identity-id: ${{ vars.DOPPLER_IDENTITY_ID }}
223+
doppler-project: marimo-oss
224+
doppler-config: ci_test
225+
213226
# Only upload coverage on `main` so it is not blocking
214227
# and only on `3.13`, `ubuntu-latest`, with optional deps since it will cover
215228
# the most surface area.
@@ -219,10 +232,10 @@ jobs:
219232
with:
220233
files: ./coverage.xml
221234
env:
222-
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
235+
CODECOV_TOKEN: ${{ steps.secrets.outputs.CODECOV_TOKEN }}
223236

224237
- name: Upload test results to Codecov
225238
if: ${{ !cancelled() }}
226239
uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1
227240
env:
228-
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
241+
CODECOV_TOKEN: ${{ steps.secrets.outputs.CODECOV_TOKEN }}

‎.github/workflows/test_cli.yaml‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ permissions:
1313
contents: read
1414

1515
env:
16-
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
1716
TURBO_TEAM: marimo
1817
MARIMO_SKIP_UPDATE_CHECK: 1
1918
UV_EXCLUDE_NEWER: "7 days"
@@ -38,6 +37,9 @@ jobs:
3837
name: Build marimo wheel
3938
runs-on: ubuntu-latest
4039
timeout-minutes: 8 # 2024-01-18
40+
permissions:
41+
contents: read
42+
id-token: write # required for Doppler OIDC
4143
defaults:
4244
run:
4345
shell: bash
@@ -48,11 +50,23 @@ jobs:
4850
with:
4951
fetch-depth: 0 # so we can run --since on the main branch and turbo can do faster cache hashing
5052

53+
- name: 🔐 Fetch Doppler secrets
54+
# Skip on PRs from forks: id-token write is downgraded to read, so OIDC fails.
55+
# Downstream tokens (TURBO_TOKEN, CODECOV_TOKEN) are optional and tolerate empty.
56+
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
57+
uses: dopplerhq/secrets-fetch-action@cd2efbf9a404504316435873eff298b82f7e0562 # v1.3.0
58+
id: secrets
59+
with:
60+
auth-method: oidc
61+
doppler-identity-id: ${{ vars.DOPPLER_IDENTITY_ID }}
62+
doppler-project: marimo-oss
63+
doppler-config: ci_test
64+
5165
- name: 📦 Build frontend
5266
uses: ./.github/actions/build-frontend
5367
with:
54-
turbo-token: ${{ secrets.TURBO_TOKEN }}
55-
codecov-token: ${{ secrets.CODECOV_TOKEN }}
68+
turbo-token: ${{ steps.secrets.outputs.TURBO_TOKEN }}
69+
codecov-token: ${{ steps.secrets.outputs.CODECOV_TOKEN }}
5670

5771
- name: 🐍 Setup uv
5872
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7

0 commit comments

Comments
 (0)