@@ -421,13 +421,17 @@ jobs:
421421 name : Load test configurations
422422 needs : [validate-inputs]
423423 runs-on : ubuntu-latest
424+ environment : integration
425+ permissions :
426+ id-token : write
424427 outputs :
425428 run-docker-tests : ${{ steps.check-matrices.outputs.run-docker-tests }}
426429 run-k8s-tests : ${{ steps.check-matrices.outputs.run-k8s-tests }}
427430 run-in-memory-tests : ${{ steps.check-matrices.outputs.run-in-memory-tests }}
428431 docker-matrix : ${{ steps.set-docker-matrix.outputs.matrix }}
429432 k8s-runner-matrix : ${{ steps.set-k8s-runner-matrix.outputs.matrix }}
430433 in-memory-matrix : ${{ steps.set-in-memory-matrix.outputs.matrix }}
434+ is-image-in-public-registry : ${{ steps.parsed-aws-test-secrets.outputs.is-image-in-public-registry }}
431435 workflow_id : ${{ steps.gen_id.outputs.workflow_id }}
432436 steps :
433437 - name : Checkout code
@@ -600,6 +604,32 @@ jobs:
600604 echo "No tests require secrets. Proceeding without additional secret setup."
601605 fi
602606
607+ - name : Get Test Secrets from AWS Secret Manager
608+ if : ${{ needs.validate-inputs.outputs.aws_test_secrets_key }}
609+ id : aws-test-secrets
610+ uses : smartcontractkit/.github/actions/ctf-fetch-aws-secret@921f4b0ca850dd473dcef9082e3169ccbb83cc52 # ctf-fetch-aws-secret@0.0.0
611+ with :
612+ secret_id : ${{ needs.validate-inputs.outputs.aws_test_secrets_key }}
613+ aws_region : ${{ secrets.QA_AWS_REGION }}
614+ aws_role_to_assume : ${{ secrets.QA_AWS_ROLE_TO_ASSUME }}
615+
616+ - name : Parse and Mask Test Secrets
617+ if : ${{ needs.validate-inputs.outputs.aws_test_secrets_key }}
618+ id : parsed-aws-test-secrets
619+ shell : bash
620+ env :
621+ ENCODED_SECRETS : ${{ steps.aws-test-secrets.outputs.secret_value }}
622+ run : |
623+ cd ./.github/actions/ctf-run-tests/mask-testsecrets
624+ go run main.go "$ENCODED_SECRETS"
625+ if [[ "$E2E_TEST_CHAINLINK_IMAGE" =~ ^public\.ecr ]]; then
626+ echo "Using public registry for Chainlink image (no image built)."
627+ echo "is-image-in-public-registry=true" >> "$GITHUB_OUTPUT"
628+ else
629+ echo "Using private registry for Chainlink image."
630+ echo "is-image-in-public-registry=false" >> "$GITHUB_OUTPUT"
631+ fi
632+
603633 - name : Generate random workflow id
604634 id : gen_id
605635 shell : bash
@@ -610,8 +640,9 @@ jobs:
610640 name : Get Chainlink image
611641 needs : [validate-inputs, load-test-configurations]
612642 if : ${{
613- fromJson(needs.validate-inputs.outputs.require_chainlink_image_versions_in_qa_ecr_matrix)
614- != '' && !inputs.skip_image_build }}
643+ fromJson(needs.validate-inputs.outputs.require_chainlink_image_versions_in_qa_ecr_matrix) != ''
644+ && fromJson(needs.load-test-configurations.outputs.is-image-in-public-registry) != true
645+ && !inputs.skip_image_build }}
615646 runs-on : ubuntu-latest
616647 environment : integration
617648 permissions :
0 commit comments