1. Packages
  2. Buildkite
  3. API Docs
  4. Pipeline
  5. getSignedSteps
Buildkite v3.1.6 published on Wednesday, Apr 3, 2024 by Pulumiverse

buildkite.Pipeline.getSignedSteps

Explore with Pulumi AI

Buildkite v3.1.6 published on Wednesday, Apr 3, 2024 by Pulumiverse

Use this data source to sign pipeline steps with a JWKS key. You will need to have the corresponding verification key present on the agents that run this the steps in this pipeline. You can then use these steps in a buildkite.Pipeline.Pipeline resource.

See RFC 7517 for more information about the JWKS format.

See the Buildkite documentation for more info about signed pipelines.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as buildkite from "@pulumi/buildkite";
import * as buildkite from "@pulumiverse/buildkite";

const repository = "git@github.com:my-org/my-repo.git";
const my-steps = buildkite.Pipeline.getSignedSteps({
    repository: repository,
    jwksFile: "/path/to/my/jwks.json",
    jwksKeyId: "my-key",
    unsignedSteps: `steps:
- label: ":pipeline:"
  command: buildkite-agent pipeline upload
`,
});
const my_pipeline = new buildkite.pipeline.Pipeline("my-pipeline", {
    repository: repository,
    steps: my_steps.then(my_steps => my_steps.steps),
});
Copy
import pulumi
import pulumi_buildkite as buildkite
import pulumiverse_buildkite as buildkite

repository = "git@github.com:my-org/my-repo.git"
my_steps = buildkite.Pipeline.get_signed_steps(repository=repository,
    jwks_file="/path/to/my/jwks.json",
    jwks_key_id="my-key",
    unsigned_steps="""steps:
- label: ":pipeline:"
  command: buildkite-agent pipeline upload
""")
my_pipeline = buildkite.pipeline.Pipeline("my-pipeline",
    repository=repository,
    steps=my_steps.steps)
Copy
package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-buildkite/sdk/v3/go/buildkite/Pipeline"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		repository := "git@github.com:my-org/my-repo.git"
		my_steps, err := Pipeline.GetSignedSteps(ctx, &pipeline.GetSignedStepsArgs{
			Repository:    repository,
			JwksFile:      pulumi.StringRef("/path/to/my/jwks.json"),
			JwksKeyId:     pulumi.StringRef("my-key"),
			UnsignedSteps: "steps:\n- label: \":pipeline:\"\n  command: buildkite-agent pipeline upload\n",
		}, nil)
		if err != nil {
			return err
		}
		_, err = Pipeline.NewPipeline(ctx, "my-pipeline", &Pipeline.PipelineArgs{
			Repository: pulumi.String(repository),
			Steps:      *pulumi.String(my_steps.Steps),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Buildkite = Pulumi.Buildkite;
using Buildkite = Pulumiverse.Buildkite;

return await Deployment.RunAsync(() => 
{
    var repository = "git@github.com:my-org/my-repo.git";

    var my_steps = Buildkite.Pipeline.GetSignedSteps.Invoke(new()
    {
        Repository = repository,
        JwksFile = "/path/to/my/jwks.json",
        JwksKeyId = "my-key",
        UnsignedSteps = @"steps:
- label: "":pipeline:""
  command: buildkite-agent pipeline upload
",
    });

    var my_pipeline = new Buildkite.Pipeline.Pipeline("my-pipeline", new()
    {
        Repository = repository,
        Steps = my_steps.Apply(my_steps => my_steps.Apply(getSignedStepsResult => getSignedStepsResult.Steps)),
    });

});
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.buildkite.Pipeline.PipelineFunctions;
import com.pulumi.buildkite.Pipeline.inputs.GetSignedStepsArgs;
import com.pulumi.buildkite.Pipeline.Pipeline;
import com.pulumi.buildkite.Pipeline.PipelineArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var repository = "git@github.com:my-org/my-repo.git";

        final var my-steps = PipelineFunctions.getSignedSteps(GetSignedStepsArgs.builder()
            .repository(repository)
            .jwksFile("/path/to/my/jwks.json")
            .jwksKeyId("my-key")
            .unsignedSteps("""
steps:
- label: ":pipeline:"
  command: buildkite-agent pipeline upload
            """)
            .build());

        var my_pipeline = new Pipeline("my-pipeline", PipelineArgs.builder()        
            .repository(repository)
            .steps(my_steps.steps())
            .build());

    }
}
Copy
resources:
  my-pipeline:
    type: buildkite:Pipeline:Pipeline
    properties:
      repository: ${repository}
      steps: ${["my-steps"].steps}
variables:
  repository: git@github.com:my-org/my-repo.git
  my-steps:
    fn::invoke:
      Function: buildkite:Pipeline:getSignedSteps
      Arguments:
        repository: ${repository}
        jwksFile: /path/to/my/jwks.json
        jwksKeyId: my-key
        unsignedSteps: |
          steps:
          - label: ":pipeline:"
            command: buildkite-agent pipeline upload          
Copy

Using getSignedSteps

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getSignedSteps(args: GetSignedStepsArgs, opts?: InvokeOptions): Promise<GetSignedStepsResult>
function getSignedStepsOutput(args: GetSignedStepsOutputArgs, opts?: InvokeOptions): Output<GetSignedStepsResult>
Copy
def get_signed_steps(jwks: Optional[str] = None,
                     jwks_file: Optional[str] = None,
                     jwks_key_id: Optional[str] = None,
                     repository: Optional[str] = None,
                     unsigned_steps: Optional[str] = None,
                     opts: Optional[InvokeOptions] = None) -> GetSignedStepsResult
def get_signed_steps_output(jwks: Optional[pulumi.Input[str]] = None,
                     jwks_file: Optional[pulumi.Input[str]] = None,
                     jwks_key_id: Optional[pulumi.Input[str]] = None,
                     repository: Optional[pulumi.Input[str]] = None,
                     unsigned_steps: Optional[pulumi.Input[str]] = None,
                     opts: Optional[InvokeOptions] = None) -> Output[GetSignedStepsResult]
Copy
func GetSignedSteps(ctx *Context, args *GetSignedStepsArgs, opts ...InvokeOption) (*GetSignedStepsResult, error)
func GetSignedStepsOutput(ctx *Context, args *GetSignedStepsOutputArgs, opts ...InvokeOption) GetSignedStepsResultOutput
Copy

> Note: This function is named GetSignedSteps in the Go SDK.

public static class GetSignedSteps 
{
    public static Task<GetSignedStepsResult> InvokeAsync(GetSignedStepsArgs args, InvokeOptions? opts = null)
    public static Output<GetSignedStepsResult> Invoke(GetSignedStepsInvokeArgs args, InvokeOptions? opts = null)
}
Copy
public static CompletableFuture<GetSignedStepsResult> getSignedSteps(GetSignedStepsArgs args, InvokeOptions options)
public static Output<GetSignedStepsResult> getSignedSteps(GetSignedStepsArgs args, InvokeOptions options)
Copy
fn::invoke:
  function: buildkite:Pipeline/getSignedSteps:getSignedSteps
  arguments:
    # arguments dictionary
Copy

The following arguments are supported:

Repository This property is required. string
The repository that will be checked out in a build of the pipeline.
UnsignedSteps This property is required. string
The steps to sign in YAML format.
Jwks string
The JSON Web Key Set (JWKS) to use for signing. If jwks_key_id is not specified, and the set contains exactly one key, that key will be used.
JwksFile string
JwksKeyId string
Repository This property is required. string
The repository that will be checked out in a build of the pipeline.
UnsignedSteps This property is required. string
The steps to sign in YAML format.
Jwks string
The JSON Web Key Set (JWKS) to use for signing. If jwks_key_id is not specified, and the set contains exactly one key, that key will be used.
JwksFile string
JwksKeyId string
repository This property is required. String
The repository that will be checked out in a build of the pipeline.
unsignedSteps This property is required. String
The steps to sign in YAML format.
jwks String
The JSON Web Key Set (JWKS) to use for signing. If jwks_key_id is not specified, and the set contains exactly one key, that key will be used.
jwksFile String
jwksKeyId String
repository This property is required. string
The repository that will be checked out in a build of the pipeline.
unsignedSteps This property is required. string
The steps to sign in YAML format.
jwks string
The JSON Web Key Set (JWKS) to use for signing. If jwks_key_id is not specified, and the set contains exactly one key, that key will be used.
jwksFile string
jwksKeyId string
repository This property is required. str
The repository that will be checked out in a build of the pipeline.
unsigned_steps This property is required. str
The steps to sign in YAML format.
jwks str
The JSON Web Key Set (JWKS) to use for signing. If jwks_key_id is not specified, and the set contains exactly one key, that key will be used.
jwks_file str
jwks_key_id str
repository This property is required. String
The repository that will be checked out in a build of the pipeline.
unsignedSteps This property is required. String
The steps to sign in YAML format.
jwks String
The JSON Web Key Set (JWKS) to use for signing. If jwks_key_id is not specified, and the set contains exactly one key, that key will be used.
jwksFile String
jwksKeyId String

getSignedSteps Result

The following output properties are available:

Id string
The provider-assigned unique ID for this managed resource.
Repository string
The repository that will be checked out in a build of the pipeline.
Steps string
UnsignedSteps string
The steps to sign in YAML format.
Jwks string
The JSON Web Key Set (JWKS) to use for signing. If jwks_key_id is not specified, and the set contains exactly one key, that key will be used.
JwksFile string
JwksKeyId string
Id string
The provider-assigned unique ID for this managed resource.
Repository string
The repository that will be checked out in a build of the pipeline.
Steps string
UnsignedSteps string
The steps to sign in YAML format.
Jwks string
The JSON Web Key Set (JWKS) to use for signing. If jwks_key_id is not specified, and the set contains exactly one key, that key will be used.
JwksFile string
JwksKeyId string
id String
The provider-assigned unique ID for this managed resource.
repository String
The repository that will be checked out in a build of the pipeline.
steps String
unsignedSteps String
The steps to sign in YAML format.
jwks String
The JSON Web Key Set (JWKS) to use for signing. If jwks_key_id is not specified, and the set contains exactly one key, that key will be used.
jwksFile String
jwksKeyId String
id string
The provider-assigned unique ID for this managed resource.
repository string
The repository that will be checked out in a build of the pipeline.
steps string
unsignedSteps string
The steps to sign in YAML format.
jwks string
The JSON Web Key Set (JWKS) to use for signing. If jwks_key_id is not specified, and the set contains exactly one key, that key will be used.
jwksFile string
jwksKeyId string
id str
The provider-assigned unique ID for this managed resource.
repository str
The repository that will be checked out in a build of the pipeline.
steps str
unsigned_steps str
The steps to sign in YAML format.
jwks str
The JSON Web Key Set (JWKS) to use for signing. If jwks_key_id is not specified, and the set contains exactly one key, that key will be used.
jwks_file str
jwks_key_id str
id String
The provider-assigned unique ID for this managed resource.
repository String
The repository that will be checked out in a build of the pipeline.
steps String
unsignedSteps String
The steps to sign in YAML format.
jwks String
The JSON Web Key Set (JWKS) to use for signing. If jwks_key_id is not specified, and the set contains exactly one key, that key will be used.
jwksFile String
jwksKeyId String

Package Details

Repository
buildkite pulumiverse/pulumi-buildkite
License
Apache-2.0
Notes
This Pulumi package is based on the buildkite Terraform Provider.
Buildkite v3.1.6 published on Wednesday, Apr 3, 2024 by Pulumiverse