diff --git a/docs/images/integrations/github/app/github-app-installation.png b/docs/images/integrations/github/app/github-app-installation.png new file mode 100644 index 000000000..60a2ec4fc Binary files /dev/null and b/docs/images/integrations/github/app/github-app-installation.png differ diff --git a/docs/images/integrations/github/app/github-app-method-selection.png b/docs/images/integrations/github/app/github-app-method-selection.png new file mode 100644 index 000000000..3f66a396e Binary files /dev/null and b/docs/images/integrations/github/app/github-app-method-selection.png differ diff --git a/docs/images/integrations/github/app/integration-overview.png b/docs/images/integrations/github/app/integration-overview.png new file mode 100644 index 000000000..1dad2fb64 Binary files /dev/null and b/docs/images/integrations/github/app/integration-overview.png differ diff --git a/docs/images/integrations/github/app/self-hosted-github-app-basic-details.png b/docs/images/integrations/github/app/self-hosted-github-app-basic-details.png new file mode 100644 index 000000000..463adabd8 Binary files /dev/null and b/docs/images/integrations/github/app/self-hosted-github-app-basic-details.png differ diff --git a/docs/images/integrations/github/app/self-hosted-github-app-create-confirm.png b/docs/images/integrations/github/app/self-hosted-github-app-create-confirm.png new file mode 100644 index 000000000..15dc7f9d6 Binary files /dev/null and b/docs/images/integrations/github/app/self-hosted-github-app-create-confirm.png differ diff --git a/docs/images/integrations/github/app/self-hosted-github-app-create.png b/docs/images/integrations/github/app/self-hosted-github-app-create.png new file mode 100644 index 000000000..d55a49b66 Binary files /dev/null and b/docs/images/integrations/github/app/self-hosted-github-app-create.png differ diff --git a/docs/images/integrations/github/app/self-hosted-github-app-credentials.png b/docs/images/integrations/github/app/self-hosted-github-app-credentials.png new file mode 100644 index 000000000..6e4480bc7 Binary files /dev/null and b/docs/images/integrations/github/app/self-hosted-github-app-credentials.png differ diff --git a/docs/images/integrations/github/app/self-hosted-github-app-organization.png b/docs/images/integrations/github/app/self-hosted-github-app-organization.png new file mode 100644 index 000000000..60ba84151 Binary files /dev/null and b/docs/images/integrations/github/app/self-hosted-github-app-organization.png differ diff --git a/docs/images/integrations/github/app/self-hosted-github-app-private-key.png b/docs/images/integrations/github/app/self-hosted-github-app-private-key.png new file mode 100644 index 000000000..ce03f740e Binary files /dev/null and b/docs/images/integrations/github/app/self-hosted-github-app-private-key.png differ diff --git a/docs/images/integrations/github/app/self-hosted-github-app-repository.png b/docs/images/integrations/github/app/self-hosted-github-app-repository.png new file mode 100644 index 000000000..6f9edc56e Binary files /dev/null and b/docs/images/integrations/github/app/self-hosted-github-app-repository.png differ diff --git a/docs/images/integrations/github/app/self-hosted-github-app-secret.png b/docs/images/integrations/github/app/self-hosted-github-app-secret.png new file mode 100644 index 000000000..8c9918404 Binary files /dev/null and b/docs/images/integrations/github/app/self-hosted-github-app-secret.png differ diff --git a/docs/images/integrations/github/app/self-hosted-github-app-webhook.png b/docs/images/integrations/github/app/self-hosted-github-app-webhook.png new file mode 100644 index 000000000..2b7493fbf Binary files /dev/null and b/docs/images/integrations/github/app/self-hosted-github-app-webhook.png differ diff --git a/docs/images/integrations/github/github-oauth-method-selection.png b/docs/images/integrations/github/github-oauth-method-selection.png new file mode 100644 index 000000000..eb1d00cfc Binary files /dev/null and b/docs/images/integrations/github/github-oauth-method-selection.png differ diff --git a/docs/images/integrations/github/integration-overview.png b/docs/images/integrations/github/integration-overview.png new file mode 100644 index 000000000..1dad2fb64 Binary files /dev/null and b/docs/images/integrations/github/integration-overview.png differ diff --git a/docs/integrations/cicd/githubactions.mdx b/docs/integrations/cicd/githubactions.mdx index 607a58d36..b1495d370 100644 --- a/docs/integrations/cicd/githubactions.mdx +++ b/docs/integrations/cicd/githubactions.mdx @@ -10,6 +10,113 @@ description: "How to sync secrets from Infisical to GitHub Actions" Infisical lets you sync secrets to GitHub at the organization-level, repository-level, and repository environment-level. +## Connecting with Github App (Recommended) + + + + + + Navigate to your project's integrations tab in Infisical and press on the GitHub tile. + + ![integrations](../../images/integrations/github/app/integration-overview.png) + + Select Github App as the authentication method and click **Connect to Github**. + + ![integrations github app auth selection](../../images/integrations/github/app/github-app-method-selection.png) + + You will then be redirected to the Github app installation page. + + ![integrations github app installation](../../images/integrations/github/app/github-app-installation.png) + + Install and authorize the Github application. This will redirect you back to the Infisical integration page. + + + + Select which Infisical environment secrets you want to sync to which GitHub organization, repository, or repository environment. + + + + ![integrations github](../../images/integrations/github/integrations-github-scope-repo.png) + + + ![integrations github](../../images/integrations/github/integrations-github-scope-org.png) + + When using the organization scope, your secrets will be saved in the top-level of your Github Organization. + + You can choose the visibility, which defines which repositories can access the secrets. The options are: + - **All public repositories**: All public repositories in the organization can access the secrets. + - **All private repositories**: All private repositories in the organization can access the secrets. + - **Selected repositories**: Only the selected repositories can access the secrets. This gives a more fine-grained control over which repositories can access the secrets. You can select _both_ private and public repositories with this option. + + + ![integrations github](../../images/integrations/github/integrations-github-scope-env.png) + + + + Finally, press create integration to start syncing secrets to GitHub. + + ![integrations github](../../images/integrations/github/integrations-github.png) + + + + + + Using the GitHub integration with app authentication on a self-hosted instance of Infisical requires configuring an application on GitHub + and registering your instance with it. + + + Navigate to the Github app settings [here](https://github.com/settings/apps). Click **New Github App**. + + ![integrations github app create](../../images/integrations/github/app/self-hosted-github-app-create.png) + + Give the application a name, a homepage URL (your self-hosted domain i.e. `https://your-domain.com`), and a callback URL (i.e. `https://your-domain.com/integrations/github/oauth2/callback`). + + ![integrations github app basic details](../../images/integrations/github/app/self-hosted-github-app-basic-details.png) + + Disable webhook by unchecking the Active checkbox. + ![integrations github app webhook](../../images/integrations/github/app/self-hosted-github-app-webhook.png) + + Set the repository permissions as follows: Metadata: Read-only, Secrets: Read and write. + ![integrations github app repository](../../images/integrations/github/app/self-hosted-github-app-repository.png) + + Similarly, set the organization permissions as follows: Secrets: Read and write. + ![integrations github app organization](../../images/integrations/github/app/self-hosted-github-app-organization.png) + + Create the Github application. + ![integrations github app create confirm](../../images/integrations/github/app/self-hosted-github-app-create-confirm.png) + + + If you have a GitHub organization, you can create an application under it + in your organization Settings > Developer settings > Github Apps > New Github App. + + + + Generate a new **Client Secret** for your GitHub application. + ![integrations github app create secret](../../images/integrations/github/app/self-hosted-github-app-secret.png) + + Generate a new **Private Key** for your Github application. + ![integrations github app create private key](../../images/integrations/github/app/self-hosted-github-app-private-key.png) + + Obtain the necessary Github application credentials. This would be the application slug, client ID, app ID, client secret, and private key. + ![integrations github app credentials](../../images/integrations/github/app/self-hosted-github-app-credentials.png) + + Back in your Infisical instance, add the five new environment variables for the credentials of your GitHub application: + + - `CLIENT_ID_GITHUB_APP`: The **Client ID** of your GitHub application. + - `CLIENT_SECRET_GITHUB_APP`: The **Client Secret** of your GitHub application. + - `CLIENT_SLUG_GITHUB_APP`: The **Slug** of your Github application. This is the one found in the URL. + - `CLIENT_APP_ID_GITHUB_APP`: The **App ID** of your Github application. + - `CLIENT_PRIVATE_KEY_GITHUB_APP`: The **Private Key** of your Github application. + + Once added, restart your Infisical instance and use the GitHub integration via app authentication. + + + + + + +## Connecting with Github OAuth + Prerequisites: - Set up and add envars to [Infisical Cloud](https://app.infisical.com) @@ -19,12 +126,13 @@ Prerequisites: - Navigate to your project's integrations tab in Infisical. + Navigate to your project's integrations tab in Infisical and press on the Github tile. + ![integrations](../../images/integrations/github/integration-overview.png) - ![integrations](../../images/integrations.png) - - Press on the GitHub tile and grant Infisical access to your GitHub account (repo privileges only). + Select OAuth as the authentication method and click **Connect to Github**. + ![integrations github oauth auth selection](../../images/integrations/github/github-oauth-method-selection.png) + Grant Infisical access to your GitHub account (organization and repo privileges). ![integrations github authorization](../../images/integrations/github/integrations-github-auth.png)