Chapter 1. Adding secrets to GitHub Actions for secure integration with external tools Prerequisites Before you configure GitHub Actions, ensure you have the following: Admin access to your GitHub repository and CI/CD settings. Container registry credentials for pulling container images from Quay.io, JFrog Artifactory, or Sonatype Nexus. Authentication details for specific GitHub Actions tasks: For ACS security tasks : ROX Central server endpoint ROX API token For SBOM and artifact signing tasks : Cosign signing key password Private key and public key Trustification URL Client ID and secret Supported CycloneDX version Note The credentials and other details are already Base64-encoded, so you do not need to encode them again. You can find these credentials in your private.env file, which you created during RHTAP installation. 1.1. Adding secrets to GitHub Actions using UI Procedure Log in to GitHub and navigate to your source repository. Go to the Settings tab. In the left navigation pane, select Secrets and variables , then select Actions . Enter the following details: Select New repository secret . In the Name field, enter MY_GITHUB_TOKEN . In the Secret field, enter the token associated with your GitHub account. Repeat steps 3-4 to add the required variables: Variable Description Provide image registry credentials for only one image registry. QUAY_IO_CREDS_USR Username for accessing Quay.io repository. QUAY_IO_CREDS_PSW Password for accessing Quay.io repository. ARTIFACTORY_IO_CREDS_USR Username for accessing JFrog Artifactory repository. ARTIFACTORY_IO_CREDS_PSW Password for accessing JFrog Artifactory repository. NEXUS_IO_CREDS_USR Username for accessing Sonatype Nexus repository. NEXUS_IO_CREDS_PSW Password for accessing Sonatype Nexus repository. Set these variables if GitHub Actions runners do not run on the same cluster as the RHTAP instance. REKOR_HOST URL of your Rekor server. TUF_MIRROR URL of your TUF service. GitOps configuration for GitHub GITOPS_AUTH_PASSWORD The token the system uses to update the GitOps repository for newly built images. GITOPS_AUTH_USERNAME (optional) The parameter required for Jenkins to work with GitHub. You also need to uncomment a line with this parameter in a Jenkinsfile: GITOPS_AUTH_USERNAME = credentials('GITOPS_AUTH_USERNAME'). By default, this line is commented out. Variable required for ACS tasks. ROX_CENTRAL_ENDPOINT Endpoint for the ROX Central server. ROX_API_TOKEN API token for accessing the ROX server. Variables required for SBOM tasks. COSIGN_SECRET_PASSWORD Password for Cosign signing key. COSIGN_SECRET_KEY Private key for Cosign. COSIGN_PUBLIC_KEY Public key for Cosign. TRUSTIFICATION_BOMBASTIC_API_URL URL for Trustification Bombastic API used in SBOM generation. TRUSTIFICATION_OIDC_ISSUER_URL OIDC issuer URL used for authentication when interacting with the Trustification Bombastic API. TRUSTIFICATION_OIDC_CLIENT_ID Client ID for authenticating to the Trustification Bombastic API using OIDC. TRUSTIFICATION_OIDC_CLIENT_SECRET Client secret used alongside the client ID to authenticate to the Trustification Bombastic API. TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION Specifies the CycloneDX SBOM version that is supported and generated by the system. Select Add secret . Rerun the last pipeline run to verify the secrets are applied correctly. Alternatively, switch to you application's source repository in GitHub, make a minor change, and commit it to trigger a new pipeline run. 1.2. Adding secrets to GitHub using CLI Procedure Create a project with two files in your preferred text editor, such as Visual Studio Code: env_vars.sh ghub-set-vars Update the env_vars.sh file with the following environment variables: # env_vars.sh # GitHub credentials export MY_GITHUB_TOKEN="your_github_token_here" export MY_GITHUB_USER="your_github_username_here" export GITOPS_AUTH_PASSWORD="your_OpenShift_GitOps_password_here" export GITOPS_AUTH_USERNAME="your_OpenShift_GitOps_username_here" // Provide the credentials for the image registry you use. # Quay.io credentials export QUAY_IO_CREDS_USR="your_quay_username_here" export QUAY_IO_CREDS_PSW="your_quay_password_here" # JFrog Artifactory credenditals export ARTIFACTORY_IO_CREDS_USR="your_artifactory_username_here" export ARTIFACTORY_IO_CREDS_PSW="your_artifactory_password_here" # Sonatype Nexus credentials export NEXUS_IO_CREDS_USR="your_nexus_username_here" export NEXUS_IO_CREDS_PSW="your_nexus_password_here" # Rekor and TUF routes export REKOR_HOST="your rekor server url here" export TUF_MIRROR="your tuf service url here" // Variables required for ACS tasks # ROX variables export ROX_CENTRAL_ENDPOINT="your_rox_central_endpoint_here" export ROX_API_TOKEN="your_rox_api_token_here" // Set these variables if GitHub Actions runners do not run on the same cluster as the {ProductShortName} instance. export ROX_CENTRAL_ENDPOINT="your_rox_central_endpoint_here" export ROX_API_TOKEN="your_rox_api_token_here" // Variables required for SBOM tasks. # Cosign secrets export COSIGN_SECRET_PASSWORD="your_cosign_secret_password_here" export COSIGN_SECRET_KEY="your_cosign_secret_key_here" export COSIGN_PUBLIC_KEY="your_cosign_public_key_here" # Trustification credentials export TRUSTIFICATION_BOMBASTIC_API_URL="your__BOMBASTIC_API_URL_here" export TRUSTIFICATION_OIDC_ISSUER_URL="your_OIDC_ISSUER_URL_here" export TRUSTIFICATION_OIDC_CLIENT_ID="your_OIDC_CLIENT_ID_here" export TRUSTIFICATION_OIDC_CLIENT_SECRET="your_OIDC_CLIENT_SECRET_here" export TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION="your_SUPPORTED_CYCLONEDX_VERSION_here" Update the ghub-set-vars file with the following information: #!/bin/bash SCRIPTDIR="USD(cd "USD(dirname "USD{BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)" if [ USD# -ne 1 ]; then echo "Missing param, provide gitlab repo name" echo "Note: This script uses MY_GITHUB_TOKEN and MY_GITHUB_USER env vars" exit fi REPO=USD1 HEADER="PRIVATE-TOKEN: USDMY_GITHUB_TOKEN" URL=https://github.com/api/v4/projects # Look up the project ID so we can use it below PID=USD(curl -s -L --header "USDHEADER" "USDURL/USDMY_GITHUB_USER%2FUSDREPO" | jq ".id") function setVars() { NAME=USD1 VALUE=USD2 MASKED=USD{3:-true} echo "setting USDNAME in https://github.com/USDMY_GITHUB_USER/USDREPO" # Delete first because if the secret already exists then its value # won't be changed by the POST below curl -s --request DELETE --header "USDHEADER" "USDURL/USDPID/variables/USDNAME" # Set the new key/value curl -s --request POST --header "USDHEADER" "USDURL/USDPID/variables" \ --form "key=USDNAME" --form "value=USDVALUE" --form "masked=USDMASKED" | jq } setVars ROX_CENTRAL_ENDPOINT USDROX_CENTRAL_ENDPOINT setVars ROX_API_TOKEN USDROX_API_TOKEN setVars GITOPS_AUTH_PASSWORD USDMY_GITLAB_TOKEN setVars GITOPS_AUTH_USERNAME USDMY_GITLAB_USER setVars QUAY_IO_CREDS_USR USDQUAY_IO_CREDS_USR setVars QUAY_IO_CREDS_PSW USDQUAY_IO_CREDS_PSW setVars COSIGN_SECRET_PASSWORD USDCOSIGN_SECRET_PASSWORD setVars COSIGN_SECRET_KEY USDCOSIGN_SECRET_KEY setVars COSIGN_PUBLIC_KEY USDCOSIGN_PUBLIC_KEY setVars TRUSTIFICATION_BOMBASTIC_API_URL "USDTRUSTIFICATION_BOMBASTIC_API_URL" setVars TRUSTIFICATION_OIDC_ISSUER_URL "USDTRUSTIFICATION_OIDC_ISSUER_URL" setVars TRUSTIFICATION_OIDC_CLIENT_ID "USDTRUSTIFICATION_OIDC_CLIENT_ID" setVars TRUSTIFICATION_OIDC_CLIENT_SECRET "USDTRUSTIFICATION_OIDC_CLIENT_SECRET" setVars TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION "USDTRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION" setVars ARTIFACTORY_IO_CREDS_USR USDARTIFACTORY_IO_CREDS_USR setVars ARTIFACTORY_IO_CREDS_PSW USDARTIFACTORY_IO_CREDS_PSW setVars NEXUS_IO_CREDS_USR USDNEXUS_IO_CREDS_USR setVars NEXUS_IO_CREDS_PSW USDNEXUS_IO_CREDS_PSW setVars REKOR_HOST USDREKOR_HOST setVars TUF_MIRROR USDTUF_MIRROR (Optional) Modify the ghub-set-vars file to disable variables that are not required. For example, to disable setVars ROX_API_TOKEN USDROX_API_TOKEN , add false to it. ROX_API_TOKEN USDROX_API_TOKEN false Load the environment variables into your current shell session: source env_vars.sh Make the ghub-set-vars script executable, and run it with your repository name to set the variables in your GitHub repository. chmod +x ghub-set-vars ./ghub-set-vars your_repository_name Rerun the last pipeline run to verify the secrets are applied correctly. Alternatively, switch to you application's source repository in GitLab, make a minor change, and commit it to trigger a new pipeline run. Revised on 2025-02-12 15:08:56 UTC

Commands:
env_vars.sh GitHub credentials export MY_GITHUB_TOKEN="your_github_token_here" export MY_GITHUB_USER="your_github_username_here" export GITOPS_AUTH_PASSWORD="your_OpenShift_GitOps_password_here" export GITOPS_AUTH_USERNAME="your_OpenShift_GitOps_username_here" // Provide the credentials for the image registry you use. Quay.io credentials export QUAY_IO_CREDS_USR="your_quay_username_here" export QUAY_IO_CREDS_PSW="your_quay_password_here" JFrog Artifactory credenditals export ARTIFACTORY_IO_CREDS_USR="your_artifactory_username_here" export ARTIFACTORY_IO_CREDS_PSW="your_artifactory_password_here" Sonatype Nexus credentials export NEXUS_IO_CREDS_USR="your_nexus_username_here" export NEXUS_IO_CREDS_PSW="your_nexus_password_here" Rekor and TUF routes export REKOR_HOST="your rekor server url here" export TUF_MIRROR="your tuf service url here" // Variables required for ACS tasks ROX variables export ROX_CENTRAL_ENDPOINT="your_rox_central_endpoint_here" export ROX_API_TOKEN="your_rox_api_token_here" // Set these variables if GitHub Actions runners do not run on the same cluster as the {ProductShortName} instance. export ROX_CENTRAL_ENDPOINT="your_rox_central_endpoint_here" export ROX_API_TOKEN="your_rox_api_token_here" // Variables required for SBOM tasks. Cosign secrets export COSIGN_SECRET_PASSWORD="your_cosign_secret_password_here" export COSIGN_SECRET_KEY="your_cosign_secret_key_here" export COSIGN_PUBLIC_KEY="your_cosign_public_key_here" Trustification credentials export TRUSTIFICATION_BOMBASTIC_API_URL="your__BOMBASTIC_API_URL_here" export TRUSTIFICATION_OIDC_ISSUER_URL="your_OIDC_ISSUER_URL_here" export TRUSTIFICATION_OIDC_CLIENT_ID="your_OIDC_CLIENT_ID_here" export TRUSTIFICATION_OIDC_CLIENT_SECRET="your_OIDC_CLIENT_SECRET_here" export TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION="your_SUPPORTED_CYCLONEDX_VERSION_here"
#!/bin/bash SCRIPTDIR="USD(cd "USD(dirname "USD{BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)" if [ USD# -ne 1 ]; then echo "Missing param, provide gitlab repo name" echo "Note: This script uses MY_GITHUB_TOKEN and MY_GITHUB_USER env vars" exit fi REPO=USD1 HEADER="PRIVATE-TOKEN: USDMY_GITHUB_TOKEN" URL=https://github.com/api/v4/projects Look up the project ID so we can use it below PID=USD(curl -s -L --header "USDHEADER" "USDURL/USDMY_GITHUB_USER%2FUSDREPO" | jq ".id") function setVars() { NAME=USD1 VALUE=USD2 MASKED=USD{3:-true} echo "setting USDNAME in https://github.com/USDMY_GITHUB_USER/USDREPO" # Delete first because if the secret already exists then its value # won't be changed by the POST below curl -s --request DELETE --header "USDHEADER" "USDURL/USDPID/variables/USDNAME" # Set the new key/value curl -s --request POST --header "USDHEADER" "USDURL/USDPID/variables" --form "key=USDNAME" --form "value=USDVALUE" --form "masked=USDMASKED" | jq } setVars ROX_CENTRAL_ENDPOINT USDROX_CENTRAL_ENDPOINT setVars ROX_API_TOKEN USDROX_API_TOKEN setVars GITOPS_AUTH_PASSWORD USDMY_GITLAB_TOKEN setVars GITOPS_AUTH_USERNAME USDMY_GITLAB_USER setVars QUAY_IO_CREDS_USR USDQUAY_IO_CREDS_USR setVars QUAY_IO_CREDS_PSW USDQUAY_IO_CREDS_PSW setVars COSIGN_SECRET_PASSWORD USDCOSIGN_SECRET_PASSWORD setVars COSIGN_SECRET_KEY USDCOSIGN_SECRET_KEY setVars COSIGN_PUBLIC_KEY USDCOSIGN_PUBLIC_KEY setVars TRUSTIFICATION_BOMBASTIC_API_URL "USDTRUSTIFICATION_BOMBASTIC_API_URL" setVars TRUSTIFICATION_OIDC_ISSUER_URL "USDTRUSTIFICATION_OIDC_ISSUER_URL" setVars TRUSTIFICATION_OIDC_CLIENT_ID "USDTRUSTIFICATION_OIDC_CLIENT_ID" setVars TRUSTIFICATION_OIDC_CLIENT_SECRET "USDTRUSTIFICATION_OIDC_CLIENT_SECRET" setVars TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION "USDTRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION" setVars ARTIFACTORY_IO_CREDS_USR USDARTIFACTORY_IO_CREDS_USR setVars ARTIFACTORY_IO_CREDS_PSW USDARTIFACTORY_IO_CREDS_PSW setVars NEXUS_IO_CREDS_USR USDNEXUS_IO_CREDS_USR setVars NEXUS_IO_CREDS_PSW USDNEXUS_IO_CREDS_PSW setVars REKOR_HOST USDREKOR_HOST setVars TUF_MIRROR USDTUF_MIRROR
ROX_API_TOKEN USDROX_API_TOKEN false
source env_vars.sh
chmod +x ghub-set-vars ./ghub-set-vars your_repository_name