{"id":16779738,"url":"https://github.com/colin-nolan/drone-secrets-sync","last_synced_at":"2025-03-16T19:45:15.866Z","repository":{"id":193869624,"uuid":"682804375","full_name":"colin-nolan/drone-secrets-sync","owner":"colin-nolan","description":"Tool to idempotently synchronise Drone CI secrets","archived":false,"fork":false,"pushed_at":"2023-10-06T16:07:35.000Z","size":136,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-23T06:28:35.135Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/colin-nolan.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-08-25T00:10:06.000Z","updated_at":"2023-09-10T13:35:33.000Z","dependencies_parsed_at":null,"dependency_job_id":"b4c49ce1-2f13-4820-bb42-2f8e7412cc11","html_url":"https://github.com/colin-nolan/drone-secrets-sync","commit_stats":null,"previous_names":["colin-nolan/drone-secrets-sync"],"tags_count":9,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/colin-nolan%2Fdrone-secrets-sync","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/colin-nolan%2Fdrone-secrets-sync/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/colin-nolan%2Fdrone-secrets-sync/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/colin-nolan%2Fdrone-secrets-sync/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/colin-nolan","download_url":"https://codeload.github.com/colin-nolan/drone-secrets-sync/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243924028,"owners_count":20369639,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-13T07:32:04.107Z","updated_at":"2025-03-16T19:45:15.838Z","avatar_url":"https://github.com/colin-nolan.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Build Status](https://ci.colinnolan.uk/api/badges/colin-nolan/drone-secrets-sync/status.svg)](https://ci.colinnolan.uk/colin-nolan/drone-secrets-sync)\n[![Code Coverage](https://codecov.io/gh/colin-nolan/drone-secrets-sync/graph/badge.svg?token=MS3WG5C1W5)](https://codecov.io/gh/colin-nolan/drone-secrets-sync)\n\n## About\n\n`drone-secrets-sync` is able to _idempotently_ synchronise [Drone CI](https://www.drone.io) repository and organisation secrets.\n\n```shell\n# Synchronise repository secrets from JSON file\ndrone-secrets-sync repo octocat/hello-world secrets.json\n\n# Synchronise organisation secrets from JSON file\ndrone-secrets-sync org octocat secrets.json\n```\n\n```shell\n# Synchronise multiple repository secrets from JSON map on stdin\necho '{\"some-secret\": \"example\", \"other-secret\": \"value\"}' \\\n    | drone-secrets-sync repo octocat/hello-world\n\n# Synchronise multiple organisation secrets from JSON map on stdin\necho '{\"some-secret\": \"example\", \"other-secret\": \"value\"}' \\\n    | drone-secrets-sync org octocat\n```\n\nThe tool will output what secrets have changed, e.g.\n\n```json\n[\"some-secret\",\"other-secret\"]\n```\n\nThe Drone CI API does not provide access to secret values. Therefore, to allow the determination as to whether a secret already contains the required value, two secrets are created:\n\n1. The requested secret with the name, and value supplied.\n1. A corresponding \"hash secret\", with a name that contains a salted hash of the secret value.\n\n```shell\ndrone secret ls --format '{{ .Name }}' octocat/hello-world\n```\n\n```text\nsecret\nsecret___e861b26001c00803bb492889c1cf3faaf5a093ebc59f2c6838c7e10edfae4d0a\n```\n\nBe aware that exposing hashes makes it possible for an attacker that has gained access to the Drone API to brute force secret values offline. Hashes are generated using [Argon2](https://github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf) to make attacks more difficult. The memory and compute required to generate hashes can be configured.\n\n## Installation\n\n### Docker\n\n```shell\ndocker run --rm colinnolan/drone-secrets-sync --help\n```\n\n### GitHub Releases\n\nRelease builds for various architectures can be [downloaded from GitHub](https://github.com/colin-nolan/drone-secrets-sync/releases/latest), e.g.\n\n```shell\ncurl -fsL https://github.com/colin-nolan/drone-secrets-sync/releases/latest/drone-secrets-sync_linux-amd64 /usr/local/bin/drone-secrets-sync\nchmod +x /usr/local/bin/drone-secrets-sync\n```\n\n### From GitHub\n\n```shell\ngo install github.com/colin-nolan/drone-secrets-sync/cmd/drone-secrets-sync@latest\n```\n\n### From Source\n\n```shell\nmake install\n```\n\n## Usage\n\nThe tool uses the [Drone API](https://docs.drone.io/api/overview) via the official [drone-go](https://github.com/drone/drone-go) library. It requires `DRONE_TOKEN` and `DRONE_SERVER` environment variables to be set, e.g.\n\n```shell\n# Configure environment - see: https://docs.drone.io/cli/configure\nexport DRONE_TOKEN=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\nexport DRONE_SERVER=http://drone.mycompany.com\n```\n\n```text\nUsage: drone-secrets-sync [--argon2-iterations ARGON2-ITERATIONS] [--argon2-length ARGON2-LENGTH] [--argon2-memory ARGON2-MEMORY] [--argon2-parallelism ARGON2-PARALLELISM] [--dry-run] [--droneserver DRONESERVER] [--dronetoken DRONETOKEN] [--verbose] \u003ccommand\u003e [\u003cargs\u003e]\n\nOptions:\n  --argon2-iterations ARGON2-ITERATIONS, -i ARGON2-ITERATIONS\n                         number of argon2 iterations to create corresponding hash secret name [default: 32]\n  --argon2-length ARGON2-LENGTH, -l ARGON2-LENGTH\n                         length of argon2 hash used in corresponding hash secret name [default: 32]\n  --argon2-memory ARGON2-MEMORY, -m ARGON2-MEMORY\n                         memory for argon2 to use when creating corresponding hash secret name [default: 65536]\n  --argon2-parallelism ARGON2-PARALLELISM, -p ARGON2-PARALLELISM\n                         parallelism used when creating argon2 hash [default: 4]\n  --dry-run, -d          indicate only what secrets would be updated; does not update secrets\n  --droneserver DRONESERVER [env: DRONE_SERVER]\n  --dronetoken DRONETOKEN [env: DRONE_TOKEN]\n  --verbose, -v          enable verbose logging\n  --help, -h             display this help and exit\n  --version              display version and exit\n\nCommands:\n  repository             sync secrets for a repository\n  repo                   sync secrets for a repository\n  organisation           sync secrets for an organisation\n  org                    sync secrets for an organisation\n```\n\n```text\nUsage: drone-secrets-sync repo REPOSITORY [SECRETSFILE]\n\nPositional arguments:\n  REPOSITORY             repository to sync secrets for, e.g. octocat/hello-world\n  SECRETSFILE            location to read secrets from (default: - (stdin))\n\nGlobal options:\n  --argon2-iterations ARGON2-ITERATIONS, -i ARGON2-ITERATIONS\n                         number of argon2 iterations to create corresponding hash secret name [default: 32]\n  --argon2-length ARGON2-LENGTH, -l ARGON2-LENGTH\n                         length of argon2 hash used in corresponding hash secret name [default: 32]\n  --argon2-memory ARGON2-MEMORY, -m ARGON2-MEMORY\n                         memory for argon2 to use when creating corresponding hash secret name [default: 65536]\n  --argon2-parallelism ARGON2-PARALLELISM, -p ARGON2-PARALLELISM\n                         parallelism used when creating argon2 hash [default: 4]\n  --dry-run, -d          indicate only what secrets would be updated; does not update secrets\n  --droneserver DRONESERVER [env: DRONE_SERVER]\n  --dronetoken DRONETOKEN [env: DRONE_TOKEN]\n  --verbose, -v          enable verbose logging\n  --help, -h             display this help and exit\n  --version              display version and exit\n```\n\n```text\nUsage: drone-secrets-sync org NAMESPACE [SECRETSFILE]\n\nPositional arguments:\n  NAMESPACE              name of organisation to sync secrets for, e.g. octocat\n  SECRETSFILE            location to read secrets from (default: - (stdin))\n\nGlobal options:\n  --argon2-iterations ARGON2-ITERATIONS, -i ARGON2-ITERATIONS\n                         number of argon2 iterations to create corresponding hash secret name [default: 32]\n  --argon2-length ARGON2-LENGTH, -l ARGON2-LENGTH\n                         length of argon2 hash used in corresponding hash secret name [default: 32]\n  --argon2-memory ARGON2-MEMORY, -m ARGON2-MEMORY\n                         memory for argon2 to use when creating corresponding hash secret name [default: 65536]\n  --argon2-parallelism ARGON2-PARALLELISM, -p ARGON2-PARALLELISM\n                         parallelism used when creating argon2 hash [default: 4]\n  --dry-run, -d          indicate only what secrets would be updated; does not update secrets\n  --droneserver DRONESERVER [env: DRONE_SERVER]\n  --dronetoken DRONETOKEN [env: DRONE_TOKEN]\n  --verbose, -v          enable verbose logging\n  --help, -h             display this help and exit\n  --version              display version and exit\n```\n\n## Development\n\n### Build and Run\n\n#### Executable\n\n```shell\n# Compile for GOOS and GOARCH of build machine\nmake build\n\n# Compile for multiple targets\nmake build TARGET_BUILDS=\"linux/amd64 linux/arm64 linux/arm darwin/amd64 darwin/arm64\"\n```\n\nTo run after building:\n\n```shell\n./bin/drone-secrets-sync --help\n```\n\n#### Docker Image\n\n```shell\nmake build-image-and-load\n```\n\nTo run after building:\n\n```shell\ndocker run --rm --pull never -e DRONE_SERVER -e DRONE_TOKEN \"colin-nolan/drone-secrets-sync:$(make version)\" --help\n```\n\n### Test\n\n```shell\nmake test\n```\n\n### Linting\n\n```shell\nmake lint\n```\n\nRequires:\n\n- [golangci-lint](https://github.com/golangci/golangci-lint)\n- [mdformat-gfm](https://github.com/executablebooks/mdformat)\n- [jsonnetfmt](https://pkg.go.dev/github.com/google/go-jsonnet@v0.20.0/cmd/jsonnetfmt)\n\n#### Apply Format\n\n```shell\nmake format\n```\n\nRequires: (see Linting)\n\n#### CI\n\nTo run a Drone CI step manually:\n\n```shell\ndrone exec --pipeline=lint \u003c(drone jsonnet --stream --stdout)\n```\n\n### Clear Secrets\n\nWhen testing against a Drone CI installation, to clear all secrets on a repository:\n\n```shell\nrepository=octocat/hello-world\ndrone secret ls --format '{{ .Name }}' \"${repository}\" \\\n    | xargs -I {} drone secret rm --name {} \"${repository}\"\n```\n\nOr on an organisation:\n\n```shell\nnamespace=octocat\ndrone orgsecret ls --format '{{ .Name }}' \"${namespace}\" \\\n    | xargs -n 1 drone orgsecret rm \"${namespace}\"\n```\n\nRequires:\n\n- [drone-cli](https://docs.drone.io/quickstart/cli/)\n\n## Alternatives\n\n- [drone-secret-sync](https://github.com/appleboy/drone-secret-sync) can synchronise secrets across multiple orgs/repositories. It is not idempotent though, meaning it will update all secrets, every time it is ran.\n\n## Legal\n\nGPL v3 (contact for other licencing). Copyright 2023 Colin Nolan.\n\nThis work is in no way related to any company that I may work for.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcolin-nolan%2Fdrone-secrets-sync","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcolin-nolan%2Fdrone-secrets-sync","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcolin-nolan%2Fdrone-secrets-sync/lists"}