Skip to content

Commit 1b1f02e

Browse files
maxcoulombeTomNorth
maxcoulombe
authored and
TomNorth
committed
Development flow enhancements (hashicorp#430)
+ added a contribution section to the readme + added a local workflow to test changes + made the vault token configurable for tests * bumped action/checkout
1 parent ffb39fb commit 1b1f02e

7 files changed

Lines changed: 146 additions & 40 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,9 @@ jobs:
1010
build:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/checkout@v2
13+
- uses: actions/checkout@v3
14+
with:
15+
ref: ${{ github.ref }}
1416

1517
- uses: actions/setup-node@v3
1618
with:
@@ -37,7 +39,9 @@ jobs:
3739
runs-on: ubuntu-latest
3840

3941
steps:
40-
- uses: actions/checkout@v1
42+
- uses: actions/checkout@v3
43+
with:
44+
ref: ${{ github.ref }}
4145

4246
- name: Run docker-compose
4347
run: docker-compose up -d vault
@@ -71,7 +75,9 @@ jobs:
7175
runs-on: ubuntu-latest
7276

7377
steps:
74-
- uses: actions/checkout@v1
78+
- uses: actions/checkout@v3
79+
with:
80+
ref: ${{ github.ref }}
7581

7682
- name: Run docker-compose
7783
run: docker-compose up -d vault-enterprise
@@ -107,7 +113,9 @@ jobs:
107113
runs-on: ubuntu-latest
108114

109115
steps:
110-
- uses: actions/checkout@v1
116+
- uses: actions/checkout@v3
117+
with:
118+
ref: ${{ github.ref }}
111119

112120
- name: Run docker-compose
113121
run: docker-compose up -d vault
@@ -175,7 +183,9 @@ jobs:
175183
runs-on: ubuntu-latest
176184

177185
steps:
178-
- uses: actions/checkout@v1
186+
- uses: actions/checkout@v3
187+
with:
188+
ref: ${{ github.ref }}
179189

180190
- name: Run docker-compose
181191
run: docker-compose up -d vault-tls

‎.github/workflows/local-test.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# This is a sample workflow to help test contributions
2+
# Change the branch name, url and token to fit with your own environment
3+
4+
# Use 'on: push' instead of 'on: local-test' if you wish to run the test on github
5+
# If running locally with act, run the workflow with 'act local-test'
6+
7+
# Don't forget to revert the file changes and invalidate any tokens that were committed before opening a pull-request
8+
on: local-test
9+
10+
name: local-test
11+
12+
jobs:
13+
build:
14+
name: local-test
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Import Secrets
18+
uses: hashicorp/vault-action@YOUR_BRANCH_NAME
19+
with:
20+
url: http://localhost:8200
21+
method: token
22+
token: testtoken
23+
secrets: |
24+
secret/data/test secret | SAMPLE_SECRET;

‎README.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ A helper action for easily pulling secrets from HashiCorp Vault™.
3131
- [Reference](#reference)
3232
- [Masking - Hiding Secrets from Logs](#masking---hiding-secrets-from-logs)
3333
- [Normalization](#normalization)
34+
- [Contributing](#contributing)
3435

3536
<!-- /TOC -->
3637

@@ -420,3 +421,70 @@ This action uses GitHub Action's built-in masking, so all variables will automat
420421
## Normalization
421422

422423
To make it simpler to consume certain secrets as env vars, if no Env/Output Var Name is specified `vault-action` will replace and `.` chars with `__`, remove any other non-letter or number characters. If you're concerned about the result, it's recommended to provide an explicit Output Var Key.
424+
425+
## Contributing
426+
427+
If you wish to contribute to this project, the following dependencies are recommended for local development:
428+
- [npm](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm) to install dependencies, build project and run tests
429+
- [docker](https://docs.docker.com/get-docker/) to run the pre-configured vault containers for acceptance tests
430+
- [docker-compose](https://docs.docker.com/compose/) to spin up the pre-configured vault containers for acceptance tests
431+
- [act](https://github.com/nektos/act) to run the vault-action locally
432+
433+
### Build
434+
435+
Use npm to install dependencies and build the project:
436+
437+
```sh
438+
$ npm install && npm run build
439+
```
440+
441+
### Vault test instance
442+
443+
The Github Action needs access to a working Vault instance to function.
444+
Multiple docker configurations are available via the docker-compose.yml file to run containers compatible with the various acceptance test suites.
445+
446+
```sh
447+
$ docker-compose up -d vault # Choose one of: vault, vault-enterprise, vault-tls depending on which tests you would like to run
448+
```
449+
450+
Instead of using one of the dockerized instance, you can also use your own local or remote Vault instance by exporting these environment variables:
451+
452+
```sh
453+
$ export VAULT_HOST=<YOUR VAULT CLUSTER LOCATION> # localhost if undefined
454+
$ export VAULT_PORT=<YOUR VAULT PORT> # 8200 if undefined
455+
$ export VAULT_TOKEN=<YOUR VAULT TOKEN> # testtoken if undefined
456+
```
457+
458+
### Running unit tests
459+
460+
Unit tests can be executed at any time with no dependencies or prior setup.
461+
462+
```sh
463+
$ npm test
464+
```
465+
466+
### Running acceptance tests
467+
468+
With a succesful build to take your local changes into account and a working Vault instance configured, you can now run acceptance tests to validate if any regressions were introduced.
469+
470+
```sh
471+
$ npm run test:integration:basic # Choose one of: basic, enterprise, e2e, e2e-tls
472+
```
473+
474+
### Running the action locally
475+
476+
You can use the [act](https://github.com/nektos/act) command to test your changes locally if desired. Unfortunately it is not currently possible to use uncommitted local changes for a shared workfow. You will still need to push
477+
the changes you would like to validate beforehand. Even if a commit is necessary, this is still a more detailed and faster feedback loop than waiting for the action to be executed by Github in a different repository.
478+
479+
Push your changes into a feature branch.
480+
```sh
481+
$ git checkout -b my-feature-branch
482+
$ git commit -m "testing new changes"
483+
$ git push
484+
```
485+
486+
Edit the ./.github/workflows/local-test.yaml file to use your new feature branch. You may have to additionally edit the vault url, token and secret path if you are not using one of the provided containerized instance.
487+
Run your feature branch locally.
488+
```sh
489+
$ act local-test
490+
```

‎integrationTests/basic/integration.test.js‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,20 +8,21 @@ const { when } = require('jest-when');
88
const { exportSecrets } = require('../../src/action');
99

1010
const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8200'}`;
11+
const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
1112

1213
describe('integration', () => {
1314
beforeAll(async () => {
1415
// Verify Connection
1516
await got(`${vaultUrl}/v1/secret/config`, {
1617
headers: {
17-
'X-Vault-Token': 'testtoken',
18+
'X-Vault-Token': vaultToken,
1819
},
1920
});
2021

2122
await got(`${vaultUrl}/v1/secret/data/test`, {
2223
method: 'POST',
2324
headers: {
24-
'X-Vault-Token': 'testtoken',
25+
'X-Vault-Token': vaultToken,
2526
},
2627
json: {
2728
data: {
@@ -33,7 +34,7 @@ describe('integration', () => {
3334
await got(`${vaultUrl}/v1/secret/data/nested/test`, {
3435
method: 'POST',
3536
headers: {
36-
'X-Vault-Token': 'testtoken',
37+
'X-Vault-Token': vaultToken,
3738
},
3839
json: {
3940
data: {
@@ -45,7 +46,7 @@ describe('integration', () => {
4546
await got(`${vaultUrl}/v1/secret/data/foobar`, {
4647
method: 'POST',
4748
headers: {
48-
'X-Vault-Token': 'testtoken',
49+
'X-Vault-Token': vaultToken,
4950
},
5051
json: {
5152
data: {
@@ -59,7 +60,7 @@ describe('integration', () => {
5960
await got(`${vaultUrl}/v1/sys/mounts/secret-kv1`, {
6061
method: 'POST',
6162
headers: {
62-
'X-Vault-Token': 'testtoken',
63+
'X-Vault-Token': vaultToken,
6364
},
6465
json: {
6566
type: 'kv'
@@ -77,7 +78,7 @@ describe('integration', () => {
7778
await got(`${vaultUrl}/v1/secret-kv1/test`, {
7879
method: 'POST',
7980
headers: {
80-
'X-Vault-Token': 'testtoken',
81+
'X-Vault-Token': vaultToken,
8182
},
8283
json: {
8384
secret: 'CUSTOMSECRET',
@@ -87,7 +88,7 @@ describe('integration', () => {
8788
await got(`${vaultUrl}/v1/secret-kv1/foobar`, {
8889
method: 'POST',
8990
headers: {
90-
'X-Vault-Token': 'testtoken',
91+
'X-Vault-Token': vaultToken,
9192
},
9293
json: {
9394
fookv1: 'bar',
@@ -97,7 +98,7 @@ describe('integration', () => {
9798
await got(`${vaultUrl}/v1/secret-kv1/nested/test`, {
9899
method: 'POST',
99100
headers: {
100-
'X-Vault-Token': 'testtoken',
101+
'X-Vault-Token': vaultToken,
101102
},
102103
json: {
103104
"other-Secret-dash": 'OTHERCUSTOMSECRET',
@@ -114,7 +115,7 @@ describe('integration', () => {
114115

115116
when(core.getInput)
116117
.calledWith('token', expect.anything())
117-
.mockReturnValueOnce('testtoken');
118+
.mockReturnValueOnce(vaultToken);
118119
});
119120

120121
function mockInput(secrets) {
@@ -207,7 +208,7 @@ describe('integration', () => {
207208
await got(`${vaultUrl}/v1/cubbyhole/test`, {
208209
method: 'POST',
209210
headers: {
210-
'X-Vault-Token': 'testtoken',
211+
'X-Vault-Token': vaultToken,
211212
},
212213
json: {
213214
foo: "bar",

‎integrationTests/basic/jwt_auth.test.js‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ const { when } = require('jest-when');
1414
const { exportSecrets } = require('../../src/action');
1515

1616
const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8200'}`;
17+
const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
1718

1819
/**
1920
* Returns Github OIDC response mock
@@ -59,15 +60,15 @@ describe('jwt auth', () => {
5960
// Verify Connection
6061
await got(`${vaultUrl}/v1/secret/config`, {
6162
headers: {
62-
'X-Vault-Token': 'testtoken',
63+
'X-Vault-Token': vaultToken,
6364
},
6465
});
6566

6667
try {
6768
await got(`${vaultUrl}/v1/sys/auth/jwt`, {
6869
method: 'POST',
6970
headers: {
70-
'X-Vault-Token': 'testtoken',
71+
'X-Vault-Token': vaultToken,
7172
},
7273
json: {
7374
type: 'jwt'
@@ -85,7 +86,7 @@ describe('jwt auth', () => {
8586
await got(`${vaultUrl}/v1/sys/policy/reader`, {
8687
method: 'PUT',
8788
headers: {
88-
'X-Vault-Token': 'testtoken',
89+
'X-Vault-Token': vaultToken,
8990
},
9091
json: {
9192
policy: `
@@ -99,7 +100,7 @@ describe('jwt auth', () => {
99100
await got(`${vaultUrl}/v1/auth/jwt/config`, {
100101
method: 'POST',
101102
headers: {
102-
'X-Vault-Token': 'testtoken',
103+
'X-Vault-Token': vaultToken,
103104
},
104105
json: {
105106
jwt_validation_pubkeys: publicRsaKey,
@@ -110,7 +111,7 @@ describe('jwt auth', () => {
110111
await got(`${vaultUrl}/v1/auth/jwt/role/default`, {
111112
method: 'POST',
112113
headers: {
113-
'X-Vault-Token': 'testtoken',
114+
'X-Vault-Token': vaultToken,
114115
},
115116
json: {
116117
role_type: 'jwt',
@@ -126,7 +127,7 @@ describe('jwt auth', () => {
126127
await got(`${vaultUrl}/v1/secret/data/test`, {
127128
method: 'POST',
128129
headers: {
129-
'X-Vault-Token': 'testtoken',
130+
'X-Vault-Token': vaultToken,
130131
},
131132
json: {
132133
data: {
@@ -172,7 +173,7 @@ describe('jwt auth', () => {
172173
await got(`${vaultUrl}/v1/auth/jwt/role/default-sigstore`, {
173174
method: 'POST',
174175
headers: {
175-
'X-Vault-Token': 'testtoken',
176+
'X-Vault-Token': vaultToken,
176177
},
177178
json: {
178179
role_type: 'jwt',

‎integrationTests/e2e/setup.js‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,21 @@
11
const got = require('got');
22

33
const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
4+
const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
45

56
(async () => {
67
try {
78
// Verify Connection
89
await got(`http://${vaultUrl}/v1/secret/config`, {
910
headers: {
10-
'X-Vault-Token': 'testtoken',
11+
'X-Vault-Token': vaultToken,
1112
},
1213
});
1314

1415
await got(`http://${vaultUrl}/v1/secret/data/test`, {
1516
method: 'POST',
1617
headers: {
17-
'X-Vault-Token': 'testtoken',
18+
'X-Vault-Token': vaultToken,
1819
},
1920
json: {
2021
data: {
@@ -26,7 +27,7 @@ const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
2627
await got(`http://${vaultUrl}/v1/secret/data/nested/test`, {
2728
method: 'POST',
2829
headers: {
29-
'X-Vault-Token': 'testtoken',
30+
'X-Vault-Token': vaultToken,
3031
},
3132
json: {
3233
data: {
@@ -38,7 +39,7 @@ const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
3839
await got(`http://${vaultUrl}/v1/sys/mounts/my-secret`, {
3940
method: 'POST',
4041
headers: {
41-
'X-Vault-Token': 'testtoken',
42+
'X-Vault-Token': vaultToken,
4243
},
4344
json: {
4445
type: 'kv'
@@ -48,7 +49,7 @@ const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
4849
await got(`http://${vaultUrl}/v1/my-secret/test`, {
4950
method: 'POST',
5051
headers: {
51-
'X-Vault-Token': 'testtoken',
52+
'X-Vault-Token': vaultToken,
5253
},
5354
json: {
5455
altSecret: 'CUSTOMSECRET',
@@ -58,7 +59,7 @@ const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
5859
await got(`http://${vaultUrl}/v1/my-secret/nested/test`, {
5960
method: 'POST',
6061
headers: {
61-
'X-Vault-Token': 'testtoken',
62+
'X-Vault-Token': vaultToken,
6263
},
6364
json: {
6465
otherAltSecret: 'OTHERCUSTOMSECRET',
@@ -68,7 +69,7 @@ const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
6869
await got(`http://${vaultUrl}/v1/cubbyhole/test`, {
6970
method: 'POST',
7071
headers: {
71-
'X-Vault-Token': 'testtoken',
72+
'X-Vault-Token': vaultToken,
7273
},
7374
json: {
7475
foo: 'bar',

0 commit comments

Comments
 (0)