SRE-904: Split token minting from the release run

.github/actions/decrypt-secret/action.yml

@@ -0,0 +1,36 @@
+name: Decrypt secret
+description: Decrypts a ciphertext produced by encrypt-secret, masking every plaintext line before it is output.
+inputs:
+  encrypted_value:
+    description: The encrypted value, base64-encoded.
+    required: true
+  encryption_key:
+    description: The symmetric key decrypting the value.
+    required: true
+outputs:
+  value:
+    description: The decrypted value.
+    value: ${{ steps.decrypt.outputs.value }}
+
+runs:
+  using: composite
+  steps:
+    - name: Decrypt value
+      id: decrypt
+      shell: bash
+      env:
+        ENCRYPTED_VALUE: ${{ inputs.encrypted_value }}
+        ENC_KEY: ${{ inputs.encryption_key }}
+      run: |
+        : "${ENCRYPTED_VALUE:?}" "${ENC_KEY:?}"
+        value=$(printf '%s' "${ENCRYPTED_VALUE}" | openssl enc -d -aes-256-cbc -pbkdf2 -pass env:ENC_KEY -base64 -A)
+        while IFS= read -r line; do
+          if [[ -n "${line}" ]]; then
+            echo "::add-mask::${line}"
+          fi
+        done <<<"${value}"
+        {
+          echo "value<<__VALUE_EOF__"
+          printf '%s\n' "${value}"
+          echo "__VALUE_EOF__"
+        } >>"${GITHUB_OUTPUT}"

.github/actions/encrypt-secret/action.yml

@@ -0,0 +1,27 @@
+name: Encrypt secret
+description: Encrypts a value with a symmetric key so that only ciphertext crosses a job boundary.
+inputs:
+  value:
+    description: The plaintext to encrypt. May span multiple lines.
+    required: true
+  encryption_key:
+    description: The symmetric key encrypting the value.
+    required: true
+outputs:
+  encrypted_value:
+    description: The encrypted value, base64-encoded.
+    value: ${{ steps.encrypt.outputs.encrypted_value }}
+
+runs:
+  using: composite
+  steps:
+    - name: Encrypt value
+      id: encrypt
+      shell: bash
+      env:
+        VALUE: ${{ inputs.value }}
+        ENC_KEY: ${{ inputs.encryption_key }}
+      run: |
+        : "${VALUE:?}" "${ENC_KEY:?}"
+        encrypted_value=$(printf '%s' "${VALUE}" | openssl enc -aes-256-cbc -pbkdf2 -salt -pass env:ENC_KEY -base64 -A)
+        echo "encrypted_value=${encrypted_value}" >>"${GITHUB_OUTPUT}"

.github/actions/install-sccache/action.yml

@@ -1,36 +1,41 @@
 name: Install sccache
 description: Setup sccache for Rust project caching
 inputs:
-  vault_address:
-    description: The URL of the Vault server holding `ci/sccache/r2`.
+  encrypted_credentials:
+    description: Encrypted credential bundle from mint-sccache-credentials.
     required: true
-  cf_access_client_id:
-    description: Cloudflare Access service-token client ID for that Vault.
-    required: true
-  cf_access_client_secret:
-    description: Cloudflare Access service-token client secret for that Vault.
+  encryption_key:
+    description: The symmetric key decrypting `encrypted_credentials`.
     required: true
 
 runs:
   using: composite
   steps:
-    - name: Retrieve secrets
-      id: secrets
-      uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
+    - name: Decrypt credentials
+      id: decrypt
+      uses: $/.github/actions/decrypt-secret
       with:
-        # The endpoint sits behind Cloudflare Access, hence the service-token
-        # headers. Vault's own ACL still decides what the role may read.
-        url: ${{ inputs.vault_address }}
-        method: jwt
-        role: ci-hash-sccache
-        extraHeaders: |
-          CF-Access-Client-Id: ${{ inputs.cf_access_client_id }}
-          CF-Access-Client-Secret: ${{ inputs.cf_access_client_secret }}
-        secrets: |
-          ci/data/sccache/r2 account_id | SCCACHE_ACCOUNT_ID ;
-          ci/data/sccache/r2 bucket | SCCACHE_BUCKET ;
-          ci/data/sccache/r2 access_key_id | SCCACHE_AWS_ACCESS_KEY_ID ;
-          ci/data/sccache/r2 secret_access_key | SCCACHE_AWS_SECRET_ACCESS_KEY ;
+        encrypted_value: ${{ inputs.encrypted_credentials }}
+        encryption_key: ${{ inputs.encryption_key }}
+
+    - name: Export credentials
+      shell: bash
+      env:
+        CREDENTIALS: ${{ steps.decrypt.outputs.value }}
+      run: |
+        account_id=$(jq --raw-output --exit-status '.account_id' <<<"${CREDENTIALS}")
+        bucket=$(jq --raw-output --exit-status '.bucket' <<<"${CREDENTIALS}")
+        access_key_id=$(jq --raw-output --exit-status '.access_key_id' <<<"${CREDENTIALS}")
+        secret_access_key=$(jq --raw-output --exit-status '.secret_access_key' <<<"${CREDENTIALS}")
+        for value in "${account_id}" "${bucket}" "${access_key_id}" "${secret_access_key}"; do
+          echo "::add-mask::${value}"
+        done
+        {
+          echo "SCCACHE_ACCOUNT_ID=${account_id}"
+          echo "SCCACHE_BUCKET=${bucket}"
+          echo "SCCACHE_AWS_ACCESS_KEY_ID=${access_key_id}"
+          echo "SCCACHE_AWS_SECRET_ACCESS_KEY=${secret_access_key}"
+        } >>"${GITHUB_ENV}"
 
     - name: Setup sccache
       uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10

.github/actions/install-tools/action.yml

@@ -5,14 +5,11 @@ inputs:
   token:
     description: GitHub token for authentication
     required: true
-  vault_address:
-    description: The URL of the Vault server holding the sccache credentials.
+  encrypted_sccache_credentials:
+    description: Encrypted sccache credential bundle from mint-sccache-credentials. Empty on fork pull requests, which is what skips sccache there.
     default: ""
-  cf_access_client_id:
-    description: Cloudflare Access service-token client ID for that Vault.
-    default: ""
-  cf_access_client_secret:
-    description: Cloudflare Access service-token client secret for that Vault. Empty on fork pull requests, which is what skips sccache there.
+  sccache_encryption_key:
+    description: The symmetric key decrypting `encrypted_sccache_credentials`.
     default: ""
   rust:
     description: Should Rust be installed? Can either be `"true"` or `true`
@@ -55,10 +52,9 @@ runs:
         command: ${{ github.action_path }}/install-rust.sh
 
     - name: "Install sccache"
-      if: ${{ (inputs.rust == true || inputs.rust == 'true') && (inputs.sccache == true || inputs.sccache == 'true') && inputs.cf_access_client_secret != '' }}
+      if: ${{ (inputs.rust == true || inputs.rust == 'true') && (inputs.sccache == true || inputs.sccache == 'true') && inputs.encrypted_sccache_credentials != '' }}
       continue-on-error: true
       uses: $/.github/actions/install-sccache
       with:
-        vault_address: ${{ inputs.vault_address }}
-        cf_access_client_id: ${{ inputs.cf_access_client_id }}
-        cf_access_client_secret: ${{ inputs.cf_access_client_secret }}
+        encrypted_credentials: ${{ inputs.encrypted_sccache_credentials }}
+        encryption_key: ${{ inputs.sccache_encryption_key }}

.github/actions/mint-sccache-credentials/action.yml

@@ -0,0 +1,61 @@
+name: Mint sccache credentials
+description: Fetches the sccache R2 credentials from Vault and encrypts them for a job-boundary handoff.
+inputs:
+  vault_address:
+    description: The URL of the Vault server holding `ci/sccache/r2`.
+    required: true
+  cf_access_client_id:
+    description: Cloudflare Access service-token client ID for that Vault.
+    required: true
+  cf_access_client_secret:
+    description: Cloudflare Access service-token client secret for that Vault. Empty on fork pull requests, which is what skips the fetch there.
+    default: ""
+  encryption_key:
+    description: The symmetric key encrypting the credential bundle.
+    default: ""
+outputs:
+  encrypted_credentials:
+    description: The encrypted credential bundle, JSON with named keys. Empty when the fetch was skipped or failed.
+    value: ${{ steps.encrypt.outputs.encrypted_value }}
+
+runs:
+  using: composite
+  steps:
+    - name: Retrieve secrets
+      id: secrets
+      if: ${{ inputs.cf_access_client_secret != '' }}
+      continue-on-error: true
+      uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
+      with:
+        url: ${{ inputs.vault_address }}
+        method: jwt
+        role: ci-hash-sccache
+        extraHeaders: |
+          CF-Access-Client-Id: ${{ inputs.cf_access_client_id }}
+          CF-Access-Client-Secret: ${{ inputs.cf_access_client_secret }}
+        secrets: |
+          ci/data/sccache/r2 account_id | SCCACHE_ACCOUNT_ID ;
+          ci/data/sccache/r2 bucket | SCCACHE_BUCKET ;
+          ci/data/sccache/r2 access_key_id | SCCACHE_AWS_ACCESS_KEY_ID ;
+          ci/data/sccache/r2 secret_access_key | SCCACHE_AWS_SECRET_ACCESS_KEY ;
+
+    - name: Bundle credentials
+      id: bundle
+      if: ${{ steps.secrets.outcome == 'success' }}
+      shell: bash
+      run: |
+        credentials=$(jq --null-input --compact-output \
+          --arg account_id "${SCCACHE_ACCOUNT_ID:?}" \
+          --arg bucket "${SCCACHE_BUCKET:?}" \
+          --arg access_key_id "${SCCACHE_AWS_ACCESS_KEY_ID:?}" \
+          --arg secret_access_key "${SCCACHE_AWS_SECRET_ACCESS_KEY:?}" \
+          '$ARGS.named')
+        echo "credentials=${credentials}" >>"${GITHUB_OUTPUT}"
+
+    - name: Encrypt credentials
+      id: encrypt
+      if: ${{ steps.secrets.outcome == 'success' }}
+      uses: $/.github/actions/encrypt-secret
+      with:
+        value: ${{ steps.bundle.outputs.credentials }}
+        encryption_key: ${{ inputs.encryption_key }}

.github/workflows/bench.yml

@@ -37,7 +37,7 @@ jobs:
     if: needs.optimize-ci.outputs.skip == 'false'
     runs-on: ubuntu-24.04
     permissions:
-      id-token: write
+      contents: read
     outputs:
       unit: ${{ steps.packages.outputs.unit }}
       integration: ${{ steps.packages.outputs.integration }}
@@ -51,9 +51,6 @@ jobs:
         uses: $/.github/actions/install-tools
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          vault_address: ${{ vars.VAULT_STAGE_ADDR }}
-          cf_access_client_id: ${{ vars.CF_ACCESS_STAGE_CLIENT_ID }}
-          cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }}
           rust: false
 
       - name: Determine changed packages
@@ -70,9 +67,31 @@ jobs:
           echo "unit=$UNIT_BENCH_PACKAGES" | tee -a "$GITHUB_OUTPUT"
           echo "integration=$INTEGRATION_BENCH_PACKAGES" | tee -a "$GITHUB_OUTPUT"
 
+  sccache-credentials:
+    needs: [optimize-ci]
+    if: needs.optimize-ci.outputs.skip == 'false'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+    outputs:
+      encrypted-credentials: ${{ steps.mint.outputs.encrypted_credentials }}
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Mint sccache credentials
+        id: mint
+        uses: $/.github/actions/mint-sccache-credentials
+        with:
+          vault_address: ${{ vars.VAULT_STAGE_ADDR }}
+          cf_access_client_id: ${{ vars.CF_ACCESS_STAGE_CLIENT_ID }}
+          cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }}
+          encryption_key: ${{ secrets.SCCACHE_ENC_KEY }}
+
   unit-benches:
     name: Unit
-    needs: [setup]
+    needs: [setup, sccache-credentials]
     permissions:
       id-token: write
       contents: read
@@ -97,9 +116,8 @@ jobs:
         uses: $/.github/actions/install-tools
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          vault_address: ${{ vars.VAULT_STAGE_ADDR }}
-          cf_access_client_id: ${{ vars.CF_ACCESS_STAGE_CLIENT_ID }}
-          cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }}
+          encrypted_sccache_credentials: ${{ needs.sccache-credentials.outputs.encrypted-credentials }}
+          sccache_encryption_key: ${{ secrets.SCCACHE_ENC_KEY }}
 
       - name: Prune repository
         if: github.event_name == 'pull_request'
@@ -138,9 +156,8 @@ jobs:
         uses: $/.github/actions/install-tools
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          vault_address: ${{ vars.VAULT_STAGE_ADDR }}
-          cf_access_client_id: ${{ vars.CF_ACCESS_STAGE_CLIENT_ID }}
-          cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }}
+          encrypted_sccache_credentials: ${{ needs.sccache-credentials.outputs.encrypted-credentials }}
+          sccache_encryption_key: ${{ secrets.SCCACHE_ENC_KEY }}
 
       - name: Prune repository
         uses: $/.github/actions/prune-repository
@@ -192,7 +209,7 @@ jobs:
 
   integration-benches:
     name: Integration
-    needs: [setup]
+    needs: [setup, sccache-credentials]
     permissions:
       id-token: write
       contents: read
@@ -217,9 +234,8 @@ jobs:
         uses: $/.github/actions/install-tools
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          vault_address: ${{ vars.VAULT_STAGE_ADDR }}
-          cf_access_client_id: ${{ vars.CF_ACCESS_STAGE_CLIENT_ID }}
-          cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }}
+          encrypted_sccache_credentials: ${{ needs.sccache-credentials.outputs.encrypted-credentials }}
+          sccache_encryption_key: ${{ secrets.SCCACHE_ENC_KEY }}
 
       - name: Prune repository
         if: github.event_name == 'pull_request'
@@ -317,9 +333,6 @@ jobs:
         uses: $/.github/actions/install-tools
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          vault_address: ${{ vars.VAULT_STAGE_ADDR }}
-          cf_access_client_id: ${{ vars.CF_ACCESS_STAGE_CLIENT_ID }}
-          cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }}
           sccache: false # sccache is already running in the background
 
       - name: Prune repository
@@ -425,7 +438,14 @@ jobs:
 
   passed:
     name: Benches passed
-    needs: [setup, unit-benches, integration-benches, optimize-ci]
+    needs:
+      [
+        setup,
+        sccache-credentials,
+        unit-benches,
+        integration-benches,
+        optimize-ci,
+      ]
     if: always() && needs.optimize-ci.outputs.skip == 'false'
     runs-on: ubuntu-latest
     permissions:
@@ -434,6 +454,9 @@ jobs:
       - name: Check setup script
         run: |
           [[ ${{ needs.setup.result }} = success ]]
+      - name: Check sccache credentials
+        run: |
+          [[ ${{ needs.sccache-credentials.result }} = success ]]
       - name: Check unit benches
         run: |
           [[ ${{ needs.unit-benches.result }} =~ success|skipped ]]