From 136fce57f81f42f09a41cb4b1277adeba791566d Mon Sep 17 00:00:00 2001
From: Lior Poterman <191881919+cx-lior-poterman@users.noreply.github.com>
Date: Thu, 20 Aug 2026 13:09:13 +0300
Subject: [PATCH] AST-171789: Fetch Maven/OSSRH signing secrets from AWS
 Secrets Manager

Move MAVEN_GPG_PASSPHRASE, MAVEN_GPG_PRIVATE_KEY, OSSRH_TOKEN, and
OSSRH_USERNAME out of GitHub secrets and fetch them from AWS Secrets
Manager via OIDC role assumption, gated behind a new "release" GitHub
Environment that requires cx-maintainers approval before the job can
run and access the environment-scoped AWS role secrets.
---
 .github/workflows/release.yml | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 797fc19..9289323 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -63,8 +63,9 @@ permissions:
 jobs:
   release:
     name: Release
+    environment: release
     permissions:
-      id-token: write  # for Maven Central publishing via OIDC
+      id-token: write  # for Maven Central publishing via OIDC and AWS Secrets Manager
       contents: write  # for git push tag and creating GitHub release
     runs-on: cx-public-ubuntu-x64
     outputs:
@@ -77,6 +78,20 @@ jobs:
           lfs: true
           persist-credentials: false
 
+      - name: Configure AWS Credentials for Secrets Manager
+        uses: step-security/configure-aws-credentials@1448016543d4432bd608e0de7871c7bf9e9be925 # v6.2.1
+        with:
+          role-to-assume: ${{ secrets.SECRET_MANAGER_ROLE_ARN }}
+          aws-region: ${{ secrets.SECRET_MANAGER_AWS_REGION }}
+          role-session-name: release-secrets-fetch
+
+      - name: Fetch secrets from AWS Secrets Manager
+        uses: step-security/aws-secretsmanager-get-secrets@102b6b2a2528747bcc321bb99ef326d8be7ef58f # v3.0.1
+        with:
+          secret-ids: |
+            ${{ secrets.SECRET_MANAGER_SECRET_NAME }}
+          parse-json-secrets: true
+
       - name: Download CLI
         if: inputs.cliTag
         env:
@@ -132,7 +147,7 @@ jobs:
           server-id: central
           server-username: MAVEN_USERNAME
           server-password: MAVEN_PASSWORD
-          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
+          gpg-private-key: ${{ env.MAVEN_GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
       - name: Configure echo mirror for dependency resolution
@@ -160,9 +175,9 @@ jobs:
         if: inputs.publish == true
         run: mvn --batch-mode deploy -DskipTests $AID_PROP
         env:
-          MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-          MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
-          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+          MAVEN_USERNAME: ${{ env.OSSRH_USERNAME }}
+          MAVEN_PASSWORD: ${{ env.OSSRH_TOKEN }}
+          MAVEN_GPG_PASSPHRASE: ${{ env.MAVEN_GPG_PASSPHRASE }}
 
       - name: Release
         uses: step-security/action-gh-release@277bfa82abcfdb73e5bbb19e213fd76532ee2be5 # v3.0.0