From e69d3759a1c78598dfba5b0ce5573e6a19707725 Mon Sep 17 00:00:00 2001 From: Carlos Matos Date: Tue, 7 Jul 2026 15:21:39 -0400 Subject: [PATCH 1/2] ci: remove GitHub secrets from release workflow and fix release trigger Replace secrets.WORKLOAD_IDENTITY_PROVIDER, secrets.SERVICE_ACCOUNT, and secrets.SERVICE_ANNOTATION with repository variables (vars.*), and inline the gcr.io login username as the well-known oauth2accesstoken value. None of these are secret: the WIF provider path and service account email are keyless-auth identifiers, the annotation is OCI image metadata, and oauth2accesstoken is the canonical username used with a short-lived GCP access token. Also switch the release trigger from types:[created] to types:[published] so releases published from a draft fire the workflow. --- .github/workflows/release.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8bed875..dc79519 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -2,7 +2,7 @@ name: Release on: release: - types: [created] + types: [published] env: IMAGE_REGISTRY: gcr.io @@ -54,15 +54,15 @@ jobs: uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: token_format: access_token - workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }} - service_account: ${{ secrets.SERVICE_ACCOUNT }} + workload_identity_provider: ${{ vars.WORKLOAD_IDENTITY_PROVIDER }} + service_account: ${{ vars.SERVICE_ACCOUNT }} access_token_lifetime: 600s - name: Login to gcr.io uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: registry: ${{ env.IMAGE_REGISTRY }} - username: ${{ secrets.REGISTRY_LOGIN }} + username: oauth2accesstoken password: ${{ steps.auth.outputs.access_token }} - name: Set up Docker Buildx @@ -78,7 +78,7 @@ jobs: type=raw,value=latest,enable={{is_default_branch}} type=match,pattern=\d.\d type=match,pattern=\d.\d.\d - annotations: ${{ secrets.SERVICE_ANNOTATION }} + annotations: ${{ vars.SERVICE_ANNOTATION }} - name: Build and push uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 @@ -106,15 +106,15 @@ jobs: uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: token_format: access_token - workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }} - service_account: ${{ secrets.SERVICE_ACCOUNT }} + workload_identity_provider: ${{ vars.WORKLOAD_IDENTITY_PROVIDER }} + service_account: ${{ vars.SERVICE_ACCOUNT }} access_token_lifetime: 600s - name: Login to gcr.io uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: registry: ${{ env.IMAGE_REGISTRY }} - username: ${{ secrets.REGISTRY_LOGIN }} + username: oauth2accesstoken password: ${{ steps.auth.outputs.access_token }} - name: Set up Docker Buildx @@ -134,7 +134,7 @@ jobs: type=raw,value=latest,enable={{is_default_branch}} type=match,pattern=\d.\d type=match,pattern=\d.\d.\d - annotations: ${{ secrets.SERVICE_ANNOTATION }} + annotations: ${{ vars.SERVICE_ANNOTATION }} - name: Build and push uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 From a5e75068e9f4f7881ee41b6d83db2a0655dfadd2 Mon Sep 17 00:00:00 2001 From: Carlos Matos Date: Wed, 8 Jul 2026 11:06:49 -0400 Subject: [PATCH 2/2] Replace GitHub secrets with variables in release workflow --- .github/workflows/release.yml | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dc79519..753fc91 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -2,12 +2,7 @@ name: Release on: release: - types: [published] - -env: - IMAGE_REGISTRY: gcr.io - IMAGE_NAME: gcr.io/crowdstrike-public/falcon-integration-gateway - DEPLOYER: gcr.io/crowdstrike-public/falcon-integration-gateway/deployer + types: [created] permissions: # added using https://github.com/step-security/secure-repo contents: read @@ -55,13 +50,13 @@ jobs: with: token_format: access_token workload_identity_provider: ${{ vars.WORKLOAD_IDENTITY_PROVIDER }} - service_account: ${{ vars.SERVICE_ACCOUNT }} + service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} access_token_lifetime: 600s - name: Login to gcr.io uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: - registry: ${{ env.IMAGE_REGISTRY }} + registry: ${{ vars.IMAGE_REGISTRY }} username: oauth2accesstoken password: ${{ steps.auth.outputs.access_token }} @@ -72,7 +67,7 @@ jobs: id: meta uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0 with: - images: ${{ env.IMAGE_NAME }} + images: ${{ vars.IMAGE_NAME }} tags: | # set latest tag for default branch type=raw,value=latest,enable={{is_default_branch}} @@ -107,13 +102,13 @@ jobs: with: token_format: access_token workload_identity_provider: ${{ vars.WORKLOAD_IDENTITY_PROVIDER }} - service_account: ${{ vars.SERVICE_ACCOUNT }} + service_account: ${{ vars.GCP_SERVICE_ACCOUNT }} access_token_lifetime: 600s - name: Login to gcr.io uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: - registry: ${{ env.IMAGE_REGISTRY }} + registry: ${{ vars.IMAGE_REGISTRY }} username: oauth2accesstoken password: ${{ steps.auth.outputs.access_token }} @@ -122,13 +117,13 @@ jobs: - name: Pull latest onbuild image run: | - docker pull gcr.io/cloud-marketplace-tools/k8s/deployer_helm/onbuild + docker pull ${{ vars.ONBUILD_IMAGE }} - name: Extract metadata id: meta uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0 with: - images: ${{ env.DEPLOYER }} + images: ${{ vars.DEPLOYER_IMAGE }} tags: | # set latest tag for default branch type=raw,value=latest,enable={{is_default_branch}}