[CI] Update workflows to fetch secrets from GSM

.github/workflows/handle-contribution.yml

@@ -10,12 +10,33 @@ jobs:
   call-notify-jira-about-contribution:
     if: ${{ github.event.pull_request.head.ref != 'changeset-release/master' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      actions: write
+      pull-requests: write
+      issues: write
     name: Call notify jira about contribution
     steps:
+      - name: GSM Secrets
+        id: secrets_manager
+        uses: toptal/davinci-github-actions/gsm-secrets@main
+        with:
+          workload_identity_provider: ${{ secrets.IDENTITY_POOL }}
+          service_account: ${{ secrets.SA_IDENTITY_POOL }}
+          secrets_name: |-
+            DAVINCI_GITHUB_ACTIONS_JIRA_AUTOMATION_HOOK_FOR_NEW_CONTRIBUTION:toptal-ci/DAVINCI_GITHUB_ACTIONS_JIRA_AUTOMATION_HOOK_FOR_NEW_CONTRIBUTION
+            TOPTAL_DEVBOT_TOKEN:toptal-ci/TOPTAL_DEVBOT_TOKEN
+                
+      - name: Parse secrets
+        id: parse_secrets
+        uses: toptal/davinci-github-actions/expose-json-outputs@main
+        with:
+          json: ${{ steps.secrets_manager.outputs.secrets }}
       - uses: toptal/davinci-github-actions/[email protected]
         with:
           team: frontend-experience-eng
           repo: ${{ github.event.repository.name }}
           pull-number: ${{ github.event.pull_request.number}}
-          jira-hook: ${{ secrets.JIRA_AUTOMATION_HOOK_FOR_NEW_CONTRIBUTION }}
-          github-token: ${{ secrets.TOPTAL_DEVBOT_TOKEN }}
+          jira-hook: ${{ steps.parse_secrets.outputs.DAVINCI_GITHUB_ACTIONS_JIRA_AUTOMATION_HOOK_FOR_NEW_CONTRIBUTION }}
+          github-token: ${{ steps.parse_secrets.outputs.TOPTAL_DEVBOT_TOKEN }}

.github/workflows/release.yml

@@ -6,17 +6,17 @@ on:
       - master
 
 env:
-  SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
   GITHUB_WORKFLOW_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
-  DEVBOT_TOKEN: ${{ secrets.TOPTAL_DEVBOT_TOKEN }}
-  JENKINS_USER: ${{ secrets.TOPTAL_TRIGGERBOT_USERNAME }}
-  JENKINS_BUILD_TOKEN: ${{ secrets.TOPTAL_TRIGGERBOT_BUILD_TOKEN }}
-  PROXY: http://${{ secrets.HTTP_PROXY }}
-
 jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      actions: write
+      pull-requests: write
+      issues: write
     steps:
       - name: Checkout Repo
         uses: actions/[email protected]
@@ -26,6 +26,33 @@ jobs:
           # This forces changesets to use git user, provided by GITHUB_TOKEN env var
           persist-credentials: false
 
+      - name: GSM Secrets
+        id: secrets_manager
+        uses: toptal/davinci-github-actions/gsm-secrets@main
+        with:
+          workload_identity_provider: ${{ secrets.IDENTITY_POOL }}
+          service_account: ${{ secrets.SA_IDENTITY_POOL }}
+          secrets_name: |-
+            HTTP_PROXY:toptal-ci/HTTP_PROXY
+            SLACK_BOT_TOKEN:toptal-ci/SLACK_BOT_TOKEN
+            TOPTAL_DEVBOT_TOKEN:toptal-ci/TOPTAL_DEVBOT_TOKEN
+            TOPTAL_TRIGGERBOT_BUILD_TOKEN:toptal-ci/TOPTAL_TRIGGERBOT_BUILD_TOKEN
+            TOPTAL_TRIGGERBOT_USERNAME:toptal-ci/TOPTAL_TRIGGERBOT_USERNAME
+                
+      - name: Parse secrets
+        id: parse_secrets
+        uses: toptal/davinci-github-actions/expose-json-outputs@main
+        with:
+          json: ${{ steps.secrets_manager.outputs.secrets }}
+
+      - name: Set ENV Variables
+        run: |-
+          echo "SLACK_BOT_TOKEN=${{ steps.parse_secrets.outputs.SLACK_BOT_TOKEN }}" >> $GITHUB_ENV
+          echo "DEVBOT_TOKEN=${{ steps.parse_secrets.outputs.TOPTAL_DEVBOT_TOKEN }}" >> $GITHUB_ENV
+          echo "JENKINS_USER=${{ steps.parse_secrets.outputs.TOPTAL_TRIGGERBOT_USERNAME }}" >> $GITHUB_ENV
+          echo "JENKINS_BUILD_TOKEN=${{ steps.parse_secrets.outputs.TOPTAL_TRIGGERBOT_BUILD_TOKEN }}" >> $GITHUB_ENV
+          echo "PROXY=${{ steps.parse_secrets.outputs.HTTP_PROXY }}" >> $GITHUB_ENV
+                  
       - name: Set up node
         uses: actions/[email protected]
         with:

.gitignore

@@ -31,3 +31,6 @@ yarn-error.log*
 .envrc
 
 anvil_test_results.json
+
+# Ignore generated credentials from google-github-actions/auth
+gha-creds-*.json