4 - Gestione dei Segreti nelle Pipeline CI/CD

# Accedere ai segreti del repository
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to Firebase
        env:
          FIREBASE_TOKEN: ${{ secrets.FIREBASE_TOKEN }}
        run: firebase deploy --token "$FIREBASE_TOKEN"

      # I segreti vengono automaticamente mascherati nei log
      - name: Debug (il segreto viene mostrato come ***)
        run: echo "Token is ${{ secrets.FIREBASE_TOKEN }}"
      

# Segreti per ambiente
jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - name: Deploy to staging
        env:
          # Usa il segreto dell'ambiente "staging"
          API_KEY: ${{ secrets.API_KEY }}
          DEPLOY_URL: ${{ vars.DEPLOY_URL }}
        run: |
          echo "Deploying to $DEPLOY_URL"
          firebase deploy --token "${{ secrets.FIREBASE_TOKEN }}"

  deploy-production:
    runs-on: ubuntu-latest
    environment: production
    needs: deploy-staging
    steps:
      - name: Deploy to production
        env:
          # Usa il segreto dell'ambiente "production" (diverso!)
          API_KEY: ${{ secrets.API_KEY }}
        run: firebase deploy --token "${{ secrets.FIREBASE_TOKEN }}"
      

# Esempio: variabili vs segreti
jobs:
  build:
    runs-on: ubuntu-latest
    environment: production
    env:
      # Variabili: configurazione non sensibile
      API_URL: ${{ vars.API_URL }}
      APP_NAME: ${{ vars.APP_NAME }}
      ENABLE_ANALYTICS: ${{ vars.ENABLE_ANALYTICS }}
    steps:
      - uses: actions/checkout@v4
      - name: Build with environment config
        env:
          # Segreti: informazioni sensibili
          FIREBASE_TOKEN: ${{ secrets.FIREBASE_TOKEN }}
          ANALYTICS_KEY: ${{ secrets.ANALYTICS_KEY }}
        run: |
          echo "Building for $API_URL"
          npm run build -- --configuration=production
      

# Struttura dei file .env nel progetto
project/
  .env                 # MAI committato (in .gitignore)
  .env.example         # Template SENZA valori reali (committato)
  .env.development     # Valori di sviluppo (opzionale, in .gitignore)
  .env.production      # MAI committato, MAI nel repository
      

# .env.example - Template committato nel repository
# Copiare in .env e compilare con i valori reali
API_URL=https://api.example.com
FIREBASE_PROJECT_ID=your-project-id
ANALYTICS_ID=
SECRET_KEY=

# .env - File locale (DEVE essere in .gitignore)
API_URL=https://api.example.com
FIREBASE_PROJECT_ID=my-actual-project
ANALYTICS_ID=G-XXXXXXXXXX
SECRET_KEY=super-secret-value-123
      

# .gitignore - Escludere SEMPRE i file .env
.env
.env.local
.env.development.local
.env.test.local
.env.production.local
.env.production

# Ma NON escludere il template
!.env.example
      

// environment.ts - Cosa e sicuro e cosa NO

// SICURO: chiavi pubbliche con restrizioni di dominio
export const environment = {
  production: true,
  apiUrl: 'https://api.example.com',
  googleMapsKey: 'AIza...',  // OK: limitata per dominio nella console Google
  analyticsId: 'G-XXXXX',   // OK: e un identificatore pubblico
  sentryDsn: 'https://xxx@sentry.io/123',  // OK: limitata per dominio
};

// MAI FARE QUESTO:
// firebaseAdminKey: 'xxxxx',    // PERICOLOSO: accesso admin completo
// stripeSecretKey: 'sk_xxxxx',  // PERICOLOSO: accesso ai pagamenti
// dbPassword: 'password123',     // PERICOLOSO: accesso al database
      

# Iniettare valori sicuri al build time
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      # Sostituire i placeholder nell'environment file
      - name: Configure environment
        run: |
          cat > src/environments/environment.prod.ts << 'ENVEOF'
          export const environment = {
            production: true,
            apiUrl: '${{ vars.API_URL }}',
            analyticsId: '${{ vars.ANALYTICS_ID }}',
          };
          ENVEOF

      - run: npm ci
      - run: npx ng build --configuration=production
      

# Workflow per promemoria di rotazione
name: Secret Rotation Reminder

on:
  schedule:
    - cron: '0 9 1 */3 *'  # Primo giorno di ogni trimestre

jobs:
  remind:
    runs-on: ubuntu-latest
    steps:
      - name: Check secret age
        run: |
          echo "Reminder: E il momento di ruotare i segreti del repository."
          echo "Segreti da controllare:"
          echo "- FIREBASE_SERVICE_ACCOUNT"
          echo "- NPM_TOKEN"
          echo "- DOCKER_HUB_TOKEN"
          echo "Vai su Settings > Secrets per aggiornare i valori."

      - name: Create GitHub Issue
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: 'Rotazione trimestrale dei segreti',
              body: 'E il momento di ruotare i segreti CI/CD.',
              labels: ['security', 'maintenance']
            });
      

# Integrare HashiCorp Vault con GitHub Actions
jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Import Secrets from Vault
        uses: hashicorp/vault-action@v3
        with:
          url: https://vault.example.com
          method: jwt
          role: github-actions
          secrets: |
            secret/data/production/firebase token | FIREBASE_TOKEN ;
            secret/data/production/api key | API_KEY ;

      - name: Use imported secrets
        run: |
          echo "Firebase token is available as env var"
          firebase deploy --token "$FIREBASE_TOKEN"
      

# Installare git-secrets
# macOS
brew install git-secrets

# Linux
git clone https://github.com/awslabs/git-secrets.git
cd git-secrets && make install

# Configurare nel repository
cd my-project
git secrets --install
git secrets --register-aws

# Aggiungere pattern personalizzati
git secrets --add 'FIREBASE_TOKEN[=:]\s*[A-Za-z0-9]+'
git secrets --add 'sk_live_[A-Za-z0-9]+'
git secrets --add 'AIza[0-9A-Za-z\\-_]{35}'

# Scansionare il repository esistente
git secrets --scan
      

# Installare husky
npm install -D husky
npx husky init

# Creare il pre-commit hook
cat > .husky/pre-commit << 'HOOKEOF'
#!/bin/sh

# Controllare che nessun segreto venga committato
echo "Checking for secrets..."

# Pattern comuni di segreti
PATTERNS=(
  'AKIA[0-9A-Z]{16}'           # AWS Access Key
  'sk_live_[a-zA-Z0-9]+'       # Stripe Secret Key
  'AIza[0-9A-Za-z\-_]{35}'     # Google API Key
  'ghp_[a-zA-Z0-9]{36}'        # GitHub Personal Token
  'xox[bpoas]-[a-zA-Z0-9-]+'   # Slack Token
)

for pattern in "${PATTERNS[@]}"; do
  if git diff --cached --name-only -z | xargs -0 grep -lP "$pattern" 2>/dev/null; then
    echo "ERRORE: Possibile segreto rilevato!"
    echo "Pattern: $pattern"
    exit 1
  fi
done

echo "Nessun segreto rilevato."
HOOKEOF

chmod +x .husky/pre-commit
      

# Workflow con logging dettagliato
jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Log deployment attempt
        run: |
          echo "=== DEPLOYMENT AUDIT LOG ==="
          echo "Timestamp: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
          echo "Actor: ${{ github.actor }}"
          echo "Ref: ${{ github.ref }}"
          echo "SHA: ${{ github.sha }}"
          echo "Workflow: ${{ github.workflow }}"
          echo "Run ID: ${{ github.run_id }}"
          echo "Environment: production"
          echo "==========================="

      - name: Deploy
        run: firebase deploy --token "${{ secrets.FIREBASE_TOKEN }}"

      - name: Log deployment result
        if: always()
        run: |
          echo "Deploy status: ${{ job.status }}"