buildkite.Pipeline.getSignedSteps
Explore with Pulumi AI
Use this data source to sign pipeline steps with a JWKS key. You will need to have
the corresponding verification key present on the agents that run this the steps in
this pipeline. You can then use these steps in a buildkite.Pipeline.Pipeline resource.
See RFC 7517 for more information about the JWKS format.
See the Buildkite documentation for more info about signed pipelines.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as buildkite from "@pulumi/buildkite";
import * as buildkite from "@pulumiverse/buildkite";
const repository = "git@github.com:my-org/my-repo.git";
const my-steps = buildkite.Pipeline.getSignedSteps({
    repository: repository,
    jwksFile: "/path/to/my/jwks.json",
    jwksKeyId: "my-key",
    unsignedSteps: `steps:
- label: ":pipeline:"
  command: buildkite-agent pipeline upload
`,
});
const my_pipeline = new buildkite.pipeline.Pipeline("my-pipeline", {
    repository: repository,
    steps: my_steps.then(my_steps => my_steps.steps),
});
import pulumi
import pulumi_buildkite as buildkite
import pulumiverse_buildkite as buildkite
repository = "git@github.com:my-org/my-repo.git"
my_steps = buildkite.Pipeline.get_signed_steps(repository=repository,
    jwks_file="/path/to/my/jwks.json",
    jwks_key_id="my-key",
    unsigned_steps="""steps:
- label: ":pipeline:"
  command: buildkite-agent pipeline upload
""")
my_pipeline = buildkite.pipeline.Pipeline("my-pipeline",
    repository=repository,
    steps=my_steps.steps)
package main
import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-buildkite/sdk/v3/go/buildkite/Pipeline"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		repository := "git@github.com:my-org/my-repo.git"
		my_steps, err := Pipeline.GetSignedSteps(ctx, &pipeline.GetSignedStepsArgs{
			Repository:    repository,
			JwksFile:      pulumi.StringRef("/path/to/my/jwks.json"),
			JwksKeyId:     pulumi.StringRef("my-key"),
			UnsignedSteps: "steps:\n- label: \":pipeline:\"\n  command: buildkite-agent pipeline upload\n",
		}, nil)
		if err != nil {
			return err
		}
		_, err = Pipeline.NewPipeline(ctx, "my-pipeline", &Pipeline.PipelineArgs{
			Repository: pulumi.String(repository),
			Steps:      *pulumi.String(my_steps.Steps),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Buildkite = Pulumi.Buildkite;
using Buildkite = Pulumiverse.Buildkite;
return await Deployment.RunAsync(() => 
{
    var repository = "git@github.com:my-org/my-repo.git";
    var my_steps = Buildkite.Pipeline.GetSignedSteps.Invoke(new()
    {
        Repository = repository,
        JwksFile = "/path/to/my/jwks.json",
        JwksKeyId = "my-key",
        UnsignedSteps = @"steps:
- label: "":pipeline:""
  command: buildkite-agent pipeline upload
",
    });
    var my_pipeline = new Buildkite.Pipeline.Pipeline("my-pipeline", new()
    {
        Repository = repository,
        Steps = my_steps.Apply(my_steps => my_steps.Apply(getSignedStepsResult => getSignedStepsResult.Steps)),
    });
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.buildkite.Pipeline.PipelineFunctions;
import com.pulumi.buildkite.Pipeline.inputs.GetSignedStepsArgs;
import com.pulumi.buildkite.Pipeline.Pipeline;
import com.pulumi.buildkite.Pipeline.PipelineArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var repository = "git@github.com:my-org/my-repo.git";
        final var my-steps = PipelineFunctions.getSignedSteps(GetSignedStepsArgs.builder()
            .repository(repository)
            .jwksFile("/path/to/my/jwks.json")
            .jwksKeyId("my-key")
            .unsignedSteps("""
steps:
- label: ":pipeline:"
  command: buildkite-agent pipeline upload
            """)
            .build());
        var my_pipeline = new Pipeline("my-pipeline", PipelineArgs.builder()        
            .repository(repository)
            .steps(my_steps.steps())
            .build());
    }
}
resources:
  my-pipeline:
    type: buildkite:Pipeline:Pipeline
    properties:
      repository: ${repository}
      steps: ${["my-steps"].steps}
variables:
  repository: git@github.com:my-org/my-repo.git
  my-steps:
    fn::invoke:
      Function: buildkite:Pipeline:getSignedSteps
      Arguments:
        repository: ${repository}
        jwksFile: /path/to/my/jwks.json
        jwksKeyId: my-key
        unsignedSteps: |
          steps:
          - label: ":pipeline:"
            command: buildkite-agent pipeline upload          
Using getSignedSteps
Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.
function getSignedSteps(args: GetSignedStepsArgs, opts?: InvokeOptions): Promise<GetSignedStepsResult>
function getSignedStepsOutput(args: GetSignedStepsOutputArgs, opts?: InvokeOptions): Output<GetSignedStepsResult>def get_signed_steps(jwks: Optional[str] = None,
                     jwks_file: Optional[str] = None,
                     jwks_key_id: Optional[str] = None,
                     repository: Optional[str] = None,
                     unsigned_steps: Optional[str] = None,
                     opts: Optional[InvokeOptions] = None) -> GetSignedStepsResult
def get_signed_steps_output(jwks: Optional[pulumi.Input[str]] = None,
                     jwks_file: Optional[pulumi.Input[str]] = None,
                     jwks_key_id: Optional[pulumi.Input[str]] = None,
                     repository: Optional[pulumi.Input[str]] = None,
                     unsigned_steps: Optional[pulumi.Input[str]] = None,
                     opts: Optional[InvokeOptions] = None) -> Output[GetSignedStepsResult]func GetSignedSteps(ctx *Context, args *GetSignedStepsArgs, opts ...InvokeOption) (*GetSignedStepsResult, error)
func GetSignedStepsOutput(ctx *Context, args *GetSignedStepsOutputArgs, opts ...InvokeOption) GetSignedStepsResultOutput> Note: This function is named GetSignedSteps in the Go SDK.
public static class GetSignedSteps 
{
    public static Task<GetSignedStepsResult> InvokeAsync(GetSignedStepsArgs args, InvokeOptions? opts = null)
    public static Output<GetSignedStepsResult> Invoke(GetSignedStepsInvokeArgs args, InvokeOptions? opts = null)
}public static CompletableFuture<GetSignedStepsResult> getSignedSteps(GetSignedStepsArgs args, InvokeOptions options)
public static Output<GetSignedStepsResult> getSignedSteps(GetSignedStepsArgs args, InvokeOptions options)
fn::invoke:
  function: buildkite:Pipeline/getSignedSteps:getSignedSteps
  arguments:
    # arguments dictionaryThe following arguments are supported:
- Repository string
- The repository that will be checked out in a build of the pipeline.
- UnsignedSteps string
- The steps to sign in YAML format.
- Jwks string
- The JSON Web Key Set (JWKS) to use for signing.
If jwks_key_idis not specified, and the set contains exactly one key, that key will be used.
- JwksFile string
- JwksKey stringId 
- Repository string
- The repository that will be checked out in a build of the pipeline.
- UnsignedSteps string
- The steps to sign in YAML format.
- Jwks string
- The JSON Web Key Set (JWKS) to use for signing.
If jwks_key_idis not specified, and the set contains exactly one key, that key will be used.
- JwksFile string
- JwksKey stringId 
- repository String
- The repository that will be checked out in a build of the pipeline.
- unsignedSteps String
- The steps to sign in YAML format.
- jwks String
- The JSON Web Key Set (JWKS) to use for signing.
If jwks_key_idis not specified, and the set contains exactly one key, that key will be used.
- jwksFile String
- jwksKey StringId 
- repository string
- The repository that will be checked out in a build of the pipeline.
- unsignedSteps string
- The steps to sign in YAML format.
- jwks string
- The JSON Web Key Set (JWKS) to use for signing.
If jwks_key_idis not specified, and the set contains exactly one key, that key will be used.
- jwksFile string
- jwksKey stringId 
- repository str
- The repository that will be checked out in a build of the pipeline.
- unsigned_steps str
- The steps to sign in YAML format.
- jwks str
- The JSON Web Key Set (JWKS) to use for signing.
If jwks_key_idis not specified, and the set contains exactly one key, that key will be used.
- jwks_file str
- jwks_key_ strid 
- repository String
- The repository that will be checked out in a build of the pipeline.
- unsignedSteps String
- The steps to sign in YAML format.
- jwks String
- The JSON Web Key Set (JWKS) to use for signing.
If jwks_key_idis not specified, and the set contains exactly one key, that key will be used.
- jwksFile String
- jwksKey StringId 
getSignedSteps Result
The following output properties are available:
- Id string
- The provider-assigned unique ID for this managed resource.
- Repository string
- The repository that will be checked out in a build of the pipeline.
- Steps string
- UnsignedSteps string
- The steps to sign in YAML format.
- Jwks string
- The JSON Web Key Set (JWKS) to use for signing.
If jwks_key_idis not specified, and the set contains exactly one key, that key will be used.
- JwksFile string
- JwksKey stringId 
- Id string
- The provider-assigned unique ID for this managed resource.
- Repository string
- The repository that will be checked out in a build of the pipeline.
- Steps string
- UnsignedSteps string
- The steps to sign in YAML format.
- Jwks string
- The JSON Web Key Set (JWKS) to use for signing.
If jwks_key_idis not specified, and the set contains exactly one key, that key will be used.
- JwksFile string
- JwksKey stringId 
- id String
- The provider-assigned unique ID for this managed resource.
- repository String
- The repository that will be checked out in a build of the pipeline.
- steps String
- unsignedSteps String
- The steps to sign in YAML format.
- jwks String
- The JSON Web Key Set (JWKS) to use for signing.
If jwks_key_idis not specified, and the set contains exactly one key, that key will be used.
- jwksFile String
- jwksKey StringId 
- id string
- The provider-assigned unique ID for this managed resource.
- repository string
- The repository that will be checked out in a build of the pipeline.
- steps string
- unsignedSteps string
- The steps to sign in YAML format.
- jwks string
- The JSON Web Key Set (JWKS) to use for signing.
If jwks_key_idis not specified, and the set contains exactly one key, that key will be used.
- jwksFile string
- jwksKey stringId 
- id str
- The provider-assigned unique ID for this managed resource.
- repository str
- The repository that will be checked out in a build of the pipeline.
- steps str
- unsigned_steps str
- The steps to sign in YAML format.
- jwks str
- The JSON Web Key Set (JWKS) to use for signing.
If jwks_key_idis not specified, and the set contains exactly one key, that key will be used.
- jwks_file str
- jwks_key_ strid 
- id String
- The provider-assigned unique ID for this managed resource.
- repository String
- The repository that will be checked out in a build of the pipeline.
- steps String
- unsignedSteps String
- The steps to sign in YAML format.
- jwks String
- The JSON Web Key Set (JWKS) to use for signing.
If jwks_key_idis not specified, and the set contains exactly one key, that key will be used.
- jwksFile String
- jwksKey StringId 
Package Details
- Repository
- buildkite pulumiverse/pulumi-buildkite
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the buildkiteTerraform Provider.
