Use shared action and fix publish workflow (#110)

Author: Gcaya

.github/workflows/ci.yml

@@ -29,32 +29,27 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: 'Azure CLI login'
-        uses: azure/login@v2
+      - name: Get gsoft-nuget-feed secret
+        id: get_gsoft_nuget_feed_secret
+        uses: workleap/wl-reusable-workflows/retrieve-managed-secret@main
         with:
-          client-id: ${{ vars.AZURE_CLIENT_ID }}
-          tenant-id: ${{ vars.AZURE_TENANT_ID }}
-          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
-
-      - name: Get Secrets from Azure Key Vault
-        id: get_secrets
-        run: |
-          # Set env.ADO_PAT
-          ADO_PAT=$(az keyvault secret show --vault-name ${{ vars.IDP_CICD_KEYVAULT_NAME }} --name "gsoft-nuget-feed-ado-pat" --query value -o tsv)
-          echo "::add-mask::$ADO_PAT"
-          echo "ado_pat=$ADO_PAT" >> $GITHUB_OUTPUT
+          azure-client-id: ${{ vars.AZURE_CLIENT_ID }}
+          azure-tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          azure-subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+          keyvault-name: ${{ vars.IDP_CICD_KEYVAULT_NAME }}
+          secret-name: "gsoft-nuget-feed-ado-pat"
 
       - uses: actions/setup-dotnet@v4
         with:
           source-url: ${{ secrets.NUGET_GSOFTDEV_FEED_URL }}
         env:
-          NUGET_AUTH_TOKEN: ${{ steps.get_secrets.outputs.ado_pat }}
+          NUGET_AUTH_TOKEN: ${{ steps.get_gsoft_nuget_feed_secret.outputs.secret }}
 
       - run: ./Build.ps1
         shell: pwsh
         env:
           NUGET_SOURCE: ${{ secrets.NUGET_GSOFTDEV_FEED_URL }}
-          NUGET_API_KEY: ${{ steps.get_secrets.outputs.ado_pat }}
+          NUGET_API_KEY: ${{ steps.get_gsoft_nuget_feed_secret.outputs.secret }}
 
   linearb:
     needs: [ci]

.github/workflows/publish.yml

@@ -16,33 +16,29 @@ jobs:
   publish:
     runs-on: [self-hosted, idp]
 
+    environment: ci
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: 'Azure CLI login'
-        uses: azure/login@v2
+      - name: Get workleap-api-key secret
+        id: get_workleap_api_key_secret
+        uses: workleap/wl-reusable-workflows/retrieve-managed-secret@main
         with:
-          client-id: ${{ vars.AZURE_CLIENT_ID }}
-          tenant-id: ${{ vars.AZURE_TENANT_ID }}
-          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
-
-      - name: Get Secrets from Azure Key Vault
-        id: get_secrets
-        run: |
-          # Set env.WORKLEAP_NUGET_API_KEY
-          WORKLEAP_NUGET_API_KEY=$(az keyvault secret show --vault-name ${{ vars.IDP_CICD_KEYVAULT_NAME }} --name "nuget-org-workleap-api-key" --query value -o tsv)
-          echo "::add-mask::$WORKLEAP_NUGET_API_KEY"
-          echo "workleap_nuget_api_key=$WORKLEAP_NUGET_API_KEY" >> $GITHUB_OUTPUT
+          azure-client-id: ${{ vars.AZURE_CLIENT_ID }}
+          azure-tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          azure-subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+          keyvault-name: ${{ vars.IDP_CICD_KEYVAULT_NAME }}
+          secret-name: "nuget-org-workleap-api-key"
 
       - uses: actions/setup-dotnet@v4
 
       - run: ./Build.ps1
         shell: pwsh
         env:
           NUGET_SOURCE: ${{ secrets.NUGET_SOURCE }}
-          NUGET_API_KEY: ${{ steps.get_secrets.outputs.workleap_nuget_api_key }}
+          NUGET_API_KEY: ${{ steps.get_workleap_api_key_secret.outputs.secret }}
 
   linearb:
     needs: [publish]