feat: replace Infisical with OpenBao as OSS secrets backend #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| jobs: | |
| # ── Job 1: Helm lint & render ────────────────────────────────────────────── | |
| helm-lint: | |
| name: Helm lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Helm | |
| uses: azure/setup-helm@v4 | |
| with: | |
| version: "latest" | |
| - name: Lint openbao-init (local values) | |
| run: helm lint apps/openbao-init/ -f apps/openbao-init/values-local.yaml | |
| - name: Lint openbao-init (scaleway values) | |
| run: helm lint apps/openbao-init/ -f apps/openbao-init/values-scaleway.yaml | |
| - name: Render bootstrap chart (local) | |
| run: helm template boot bootstrap/ --set env=local --set revision=main | |
| - name: Render clusters/local chart | |
| run: helm template loc clusters/local/ --set revision=main | |
| - name: Render clusters/scaleway chart | |
| run: helm template loc clusters/scaleway/ --set revision=main | |
| # ── Job 2: Infisical absent ──────────────────────────────────────────────── | |
| infisical-absent: | |
| name: Infisical absent | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Assert no Infisical references in active GitOps manifests | |
| run: | | |
| if git grep -ri infisical apps/ platform/ clusters/ bootstrap/ 2>/dev/null; then | |
| echo "ERROR: Infisical references found in GitOps manifests" | |
| exit 1 | |
| fi | |
| echo "OK: No Infisical references found" | |
| # ── Job 3: Secrets restore (destroy/recreate) ────────────────────────────── | |
| secrets-restore: | |
| name: Secrets restore | |
| runs-on: ubuntu-latest | |
| environment: dev | |
| env: | |
| BAO_VERSION: "2.5.5" | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Helm | |
| uses: azure/setup-helm@v4 | |
| with: | |
| version: "latest" | |
| - name: Install yq | |
| run: | | |
| sudo wget -qO /usr/local/bin/yq \ | |
| https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 | |
| sudo chmod +x /usr/local/bin/yq | |
| yq --version | |
| - name: Install bao CLI | |
| run: | | |
| curl -sSfL \ | |
| "https://github.com/openbao/openbao/releases/download/v${BAO_VERSION}/openbao_${BAO_VERSION}_linux_amd64.deb" \ | |
| -o openbao.deb | |
| sudo dpkg -i openbao.deb | |
| bao version | |
| - name: Start minikube | |
| uses: medyagh/setup-minikube@latest | |
| - name: Run smoke test (SC-001) | |
| env: | |
| SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }} | |
| SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }} | |
| SCW_S3_BUCKET: ${{ vars.SCW_S3_BUCKET }} | |
| CANARY_VALUE: survive-${{ github.run_id }} | |
| run: bash scripts/smoke-test.sh | |
| - name: Assert no Infisical pods (SC-003) | |
| run: | | |
| if kubectl get pods -A -o name | grep -i infisical; then | |
| echo "ERROR: Infisical pods found in cluster" | |
| exit 1 | |
| fi | |
| echo "OK: No Infisical pods in cluster" |