buildkite.Pipeline.getSignedSteps
Explore with Pulumi AI
Use this data source to sign pipeline steps with a JWKS key. You will need to have
the corresponding verification key present on the agents that run this the steps in
this pipeline. You can then use these steps in a buildkite.Pipeline.Pipeline
resource.
See RFC 7517 for more information about the JWKS format.
See the Buildkite documentation for more info about signed pipelines.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as buildkite from "@pulumi/buildkite";
import * as buildkite from "@pulumiverse/buildkite";
const repository = "git@github.com:my-org/my-repo.git";
const my-steps = buildkite.Pipeline.getSignedSteps({
repository: repository,
jwksFile: "/path/to/my/jwks.json",
jwksKeyId: "my-key",
unsignedSteps: `steps:
- label: ":pipeline:"
command: buildkite-agent pipeline upload
`,
});
const my_pipeline = new buildkite.pipeline.Pipeline("my-pipeline", {
repository: repository,
steps: my_steps.then(my_steps => my_steps.steps),
});
import pulumi
import pulumi_buildkite as buildkite
import pulumiverse_buildkite as buildkite
repository = "git@github.com:my-org/my-repo.git"
my_steps = buildkite.Pipeline.get_signed_steps(repository=repository,
jwks_file="/path/to/my/jwks.json",
jwks_key_id="my-key",
unsigned_steps="""steps:
- label: ":pipeline:"
command: buildkite-agent pipeline upload
""")
my_pipeline = buildkite.pipeline.Pipeline("my-pipeline",
repository=repository,
steps=my_steps.steps)
package main
import (
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
"github.com/pulumiverse/pulumi-buildkite/sdk/v3/go/buildkite/Pipeline"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
repository := "git@github.com:my-org/my-repo.git"
my_steps, err := Pipeline.GetSignedSteps(ctx, &pipeline.GetSignedStepsArgs{
Repository: repository,
JwksFile: pulumi.StringRef("/path/to/my/jwks.json"),
JwksKeyId: pulumi.StringRef("my-key"),
UnsignedSteps: "steps:\n- label: \":pipeline:\"\n command: buildkite-agent pipeline upload\n",
}, nil)
if err != nil {
return err
}
_, err = Pipeline.NewPipeline(ctx, "my-pipeline", &Pipeline.PipelineArgs{
Repository: pulumi.String(repository),
Steps: *pulumi.String(my_steps.Steps),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Buildkite = Pulumi.Buildkite;
using Buildkite = Pulumiverse.Buildkite;
return await Deployment.RunAsync(() =>
{
var repository = "git@github.com:my-org/my-repo.git";
var my_steps = Buildkite.Pipeline.GetSignedSteps.Invoke(new()
{
Repository = repository,
JwksFile = "/path/to/my/jwks.json",
JwksKeyId = "my-key",
UnsignedSteps = @"steps:
- label: "":pipeline:""
command: buildkite-agent pipeline upload
",
});
var my_pipeline = new Buildkite.Pipeline.Pipeline("my-pipeline", new()
{
Repository = repository,
Steps = my_steps.Apply(my_steps => my_steps.Apply(getSignedStepsResult => getSignedStepsResult.Steps)),
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.buildkite.Pipeline.PipelineFunctions;
import com.pulumi.buildkite.Pipeline.inputs.GetSignedStepsArgs;
import com.pulumi.buildkite.Pipeline.Pipeline;
import com.pulumi.buildkite.Pipeline.PipelineArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var repository = "git@github.com:my-org/my-repo.git";
final var my-steps = PipelineFunctions.getSignedSteps(GetSignedStepsArgs.builder()
.repository(repository)
.jwksFile("/path/to/my/jwks.json")
.jwksKeyId("my-key")
.unsignedSteps("""
steps:
- label: ":pipeline:"
command: buildkite-agent pipeline upload
""")
.build());
var my_pipeline = new Pipeline("my-pipeline", PipelineArgs.builder()
.repository(repository)
.steps(my_steps.steps())
.build());
}
}
resources:
my-pipeline:
type: buildkite:Pipeline:Pipeline
properties:
repository: ${repository}
steps: ${["my-steps"].steps}
variables:
repository: git@github.com:my-org/my-repo.git
my-steps:
fn::invoke:
Function: buildkite:Pipeline:getSignedSteps
Arguments:
repository: ${repository}
jwksFile: /path/to/my/jwks.json
jwksKeyId: my-key
unsignedSteps: |
steps:
- label: ":pipeline:"
command: buildkite-agent pipeline upload
Using getSignedSteps
Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.
function getSignedSteps(args: GetSignedStepsArgs, opts?: InvokeOptions): Promise<GetSignedStepsResult>
function getSignedStepsOutput(args: GetSignedStepsOutputArgs, opts?: InvokeOptions): Output<GetSignedStepsResult>
def get_signed_steps(jwks: Optional[str] = None,
jwks_file: Optional[str] = None,
jwks_key_id: Optional[str] = None,
repository: Optional[str] = None,
unsigned_steps: Optional[str] = None,
opts: Optional[InvokeOptions] = None) -> GetSignedStepsResult
def get_signed_steps_output(jwks: Optional[pulumi.Input[str]] = None,
jwks_file: Optional[pulumi.Input[str]] = None,
jwks_key_id: Optional[pulumi.Input[str]] = None,
repository: Optional[pulumi.Input[str]] = None,
unsigned_steps: Optional[pulumi.Input[str]] = None,
opts: Optional[InvokeOptions] = None) -> Output[GetSignedStepsResult]
func GetSignedSteps(ctx *Context, args *GetSignedStepsArgs, opts ...InvokeOption) (*GetSignedStepsResult, error)
func GetSignedStepsOutput(ctx *Context, args *GetSignedStepsOutputArgs, opts ...InvokeOption) GetSignedStepsResultOutput
> Note: This function is named GetSignedSteps
in the Go SDK.
public static class GetSignedSteps
{
public static Task<GetSignedStepsResult> InvokeAsync(GetSignedStepsArgs args, InvokeOptions? opts = null)
public static Output<GetSignedStepsResult> Invoke(GetSignedStepsInvokeArgs args, InvokeOptions? opts = null)
}
public static CompletableFuture<GetSignedStepsResult> getSignedSteps(GetSignedStepsArgs args, InvokeOptions options)
// Output-based functions aren't available in Java yet
fn::invoke:
function: buildkite:Pipeline/getSignedSteps:getSignedSteps
arguments:
# arguments dictionary
The following arguments are supported:
- Repository string
- The repository that will be checked out in a build of the pipeline.
- Unsigned
Steps string - The steps to sign in YAML format.
- Jwks string
- The JSON Web Key Set (JWKS) to use for signing.
If
jwks_key_id
is not specified, and the set contains exactly one key, that key will be used. - Jwks
File string - Jwks
Key stringId
- Repository string
- The repository that will be checked out in a build of the pipeline.
- Unsigned
Steps string - The steps to sign in YAML format.
- Jwks string
- The JSON Web Key Set (JWKS) to use for signing.
If
jwks_key_id
is not specified, and the set contains exactly one key, that key will be used. - Jwks
File string - Jwks
Key stringId
- repository String
- The repository that will be checked out in a build of the pipeline.
- unsigned
Steps String - The steps to sign in YAML format.
- jwks String
- The JSON Web Key Set (JWKS) to use for signing.
If
jwks_key_id
is not specified, and the set contains exactly one key, that key will be used. - jwks
File String - jwks
Key StringId
- repository string
- The repository that will be checked out in a build of the pipeline.
- unsigned
Steps string - The steps to sign in YAML format.
- jwks string
- The JSON Web Key Set (JWKS) to use for signing.
If
jwks_key_id
is not specified, and the set contains exactly one key, that key will be used. - jwks
File string - jwks
Key stringId
- repository str
- The repository that will be checked out in a build of the pipeline.
- unsigned_
steps str - The steps to sign in YAML format.
- jwks str
- The JSON Web Key Set (JWKS) to use for signing.
If
jwks_key_id
is not specified, and the set contains exactly one key, that key will be used. - jwks_
file str - jwks_
key_ strid
- repository String
- The repository that will be checked out in a build of the pipeline.
- unsigned
Steps String - The steps to sign in YAML format.
- jwks String
- The JSON Web Key Set (JWKS) to use for signing.
If
jwks_key_id
is not specified, and the set contains exactly one key, that key will be used. - jwks
File String - jwks
Key StringId
getSignedSteps Result
The following output properties are available:
- Id string
- The provider-assigned unique ID for this managed resource.
- Repository string
- The repository that will be checked out in a build of the pipeline.
- Steps string
- Unsigned
Steps string - The steps to sign in YAML format.
- Jwks string
- The JSON Web Key Set (JWKS) to use for signing.
If
jwks_key_id
is not specified, and the set contains exactly one key, that key will be used. - Jwks
File string - Jwks
Key stringId
- Id string
- The provider-assigned unique ID for this managed resource.
- Repository string
- The repository that will be checked out in a build of the pipeline.
- Steps string
- Unsigned
Steps string - The steps to sign in YAML format.
- Jwks string
- The JSON Web Key Set (JWKS) to use for signing.
If
jwks_key_id
is not specified, and the set contains exactly one key, that key will be used. - Jwks
File string - Jwks
Key stringId
- id String
- The provider-assigned unique ID for this managed resource.
- repository String
- The repository that will be checked out in a build of the pipeline.
- steps String
- unsigned
Steps String - The steps to sign in YAML format.
- jwks String
- The JSON Web Key Set (JWKS) to use for signing.
If
jwks_key_id
is not specified, and the set contains exactly one key, that key will be used. - jwks
File String - jwks
Key StringId
- id string
- The provider-assigned unique ID for this managed resource.
- repository string
- The repository that will be checked out in a build of the pipeline.
- steps string
- unsigned
Steps string - The steps to sign in YAML format.
- jwks string
- The JSON Web Key Set (JWKS) to use for signing.
If
jwks_key_id
is not specified, and the set contains exactly one key, that key will be used. - jwks
File string - jwks
Key stringId
- id str
- The provider-assigned unique ID for this managed resource.
- repository str
- The repository that will be checked out in a build of the pipeline.
- steps str
- unsigned_
steps str - The steps to sign in YAML format.
- jwks str
- The JSON Web Key Set (JWKS) to use for signing.
If
jwks_key_id
is not specified, and the set contains exactly one key, that key will be used. - jwks_
file str - jwks_
key_ strid
- id String
- The provider-assigned unique ID for this managed resource.
- repository String
- The repository that will be checked out in a build of the pipeline.
- steps String
- unsigned
Steps String - The steps to sign in YAML format.
- jwks String
- The JSON Web Key Set (JWKS) to use for signing.
If
jwks_key_id
is not specified, and the set contains exactly one key, that key will be used. - jwks
File String - jwks
Key StringId
Package Details
- Repository
- buildkite pulumiverse/pulumi-buildkite
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
buildkite
Terraform Provider.