add octo sts, tweak base path for skip-apps (#541)

kartverket · Sep 17, 2024 · d076022 · d076022
1 parent a2d0e98
commit d076022
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 4 deletions.
diff --git a/.github/workflows/build-and-deploy.yaml b/.github/workflows/build-and-deploy.yaml
@@ -120,15 +120,23 @@ jobs:
     if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'workflow_dispatch')
     needs: [build, generate]
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     env:
-      BASE_DIR: ./bases/skiperator
+      BASE_DIR: ./bases/skiperator-latest
       TMP_FILE: tmp_kustomization.yaml
     steps:
+      - uses: octo-sts/action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0
+        id: octo-sts
+        with:
+          scope: kartverket/skip-apps
+          identity: skiperator
+
       - name: Checkout apps repo
         uses: actions/checkout@v4
         with:
           repository: kartverket/skip-apps
-          token: ${{ secrets.SKIPERATOR_DEPLOY_SECRET }}
+          token: ${{ steps.octo-sts.outputs.token }}
 
       - name: Download CRD and RBAC
         uses: actions/download-artifact@v4

diff --git a/.github/workflows/release-version.yaml b/.github/workflows/release-version.yaml
@@ -91,15 +91,23 @@ jobs:
   deploy-argo:
     needs: [ goreleaser, generate ]
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     env:
-      BASE_DIR: ./bases/skiperator
+      BASE_DIR: ./bases/skiperator-stable
       TMP_FILE: tmp_kustomization.yaml
     steps:
+      - uses: octo-sts/action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0
+        id: octo-sts
+        with:
+          scope: kartverket/skip-apps
+          identity: skiperator
+
       - name: Checkout apps repo
         uses: actions/checkout@v4
         with:
           repository: kartverket/skip-apps
-          token: ${{ secrets.SKIPERATOR_DEPLOY_SECRET }}
+          token: ${{ steps.octo-sts.outputs.token }}
 
       - name: Download CRD and RBAC
         uses: actions/download-artifact@v4