Fix secret vuln

.github/workflows/ci.yaml

@@ -74,11 +74,6 @@ jobs:
         id: plan
         working-directory: terraform
         run: terraform plan -out tfplan
-        env:
-          TF_VAR_app_id: ${{ secrets.APP_ID }}
-          TF_VAR_webhook_secret: ${{ secrets.WEBHOOK_SECRET }}
-          TF_VAR_private_key: ${{ secrets.PRIVATE_KEY }}
-          TF_VAR_gputester_pat: ${{ secrets.GPUTESTER_PAT }}
 
       - name: Terraform Apply
         if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'

README.md

@@ -57,13 +57,6 @@ terraform plan
 terraform apply
 ```
 
-### Required Environment Variables
-
-- `APP_ID`: GitHub App ID
-- `WEBHOOK_SECRET`: GitHub Webhook Secret
-- `PRIVATE_KEY`: GitHub App Private Key
-- `GPUTESTER_PAT`: GPU Tester Personal Access Token
-
 ## npm Scripts
 
 ```sh

jest.config.js

@@ -1,9 +1,9 @@
-module.exports = {
+export default {
   roots: ['<rootDir>/src/', '<rootDir>/test/'],
   transform: {
     '^.+\\.tsx?$': 'ts-jest'
   },
   testRegex: '(/__tests__/.*|\\.(test|spec))\\.[tj]sx?$',
   moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'json', 'node'],
-  coveragePathIgnorePatterns: ["/node_modules/", "test/"],
+  coveragePathIgnorePatterns: ["/node_modules/", "test/"]
 }

package.json

@@ -2,6 +2,7 @@
   "name": "ops-bot",
   "version": "1.0.0",
   "private": true,
+  "type": "module",
   "description": "RAPIDS Probot App",
   "author": "AJ Schmidt <[email protected]>",
   "license": "ISC",
@@ -23,6 +24,7 @@
   "dependencies": {
     "@aws-sdk/client-lambda": "^3.398.0",
     "@probot/adapter-aws-lambda-serverless": "^3.0.3",
+    "@aws-sdk/client-secrets-manager": "^3.712.0",
     "axios": "^1.5.0",
     "nunjucks": "^3.2.4",
     "probot": "^12.3.1",

src/index.ts

@@ -22,7 +22,7 @@ import { initRecentlyUpdated } from "./plugins/RecentlyUpdated";
 import { initReleaseDrafter } from "./plugins/ReleaseDrafter";
 import { initForwardMerger } from "./plugins/ForwardMerger";
 
-export = (app: Probot) => {
+export default (app: Probot) => {
   initBranchChecker(app);
   initLabelChecker(app);
   initReleaseDrafter(app);

src/probot.ts

@@ -19,7 +19,49 @@ import {
   createProbot,
 } from "@probot/adapter-aws-lambda-serverless";
 import app from "./index";
+import {
+  GetSecretValueCommand,
+  SecretsManagerClient,
+} from "@aws-sdk/client-secrets-manager";
+import { getPrivateKey } from "@probot/get-private-key";
+
+// get the secrets here and add it to the createProbot function as overrides
+const retreiveCredentials = async () => {
+  const client = new SecretsManagerClient({
+    region: "us-east-2",
+    retryMode: "standard",
+    maxAttempts: 3,
+  });
+  const input = {
+    SecretId:
+      "arn:aws:secretsmanager:us-east-2:279114543810:secret:lambda/ops-bot-handleProbot-qlVFbZ",
+  };
+  const command = new GetSecretValueCommand(input);
+  const { SecretString } = await client.send(command);
+  if (typeof SecretString !== "string") {
+    throw new Error("Error getting secrets");
+  }
+  const obj = JSON.parse(SecretString) as {
+    webhookSecret: string;
+    privateKey: string;
+    appId: number;
+    gputesterPat: string;
+  };
+
+  process.env.GPUTESTER_PAT = obj.gputesterPat;
+
+  return {
+    secret: obj.webhookSecret,
+    // This decodes an optionally base64-encoded private key
+    privateKey: getPrivateKey({
+      env: { PRIVATE_KEY: obj.privateKey },
+    })!,
+    appId: obj.appId,
+  };
+};
+
+const { secret, privateKey, appId } = await retreiveCredentials();
 
 export const handler = createLambdaFunction(app, {
-  probot: createProbot(),
+  probot: createProbot({overrides: {secret, privateKey, appId}}),
 });

terraform/lambda.tf

@@ -11,13 +11,9 @@ resource "aws_lambda_function" "probot_handler" {
 
   environment {
     variables = {
-      NODE_ENV       = "production"
-      LOG_FORMAT     = "json"
-      LOG_LEVEL      = "debug"
-      APP_ID         = var.app_id
-      WEBHOOK_SECRET = var.webhook_secret
-      PRIVATE_KEY    = var.private_key
-      GPUTESTER_PAT  = var.gputester_pat
+      NODE_ENV   = "production"
+      LOG_FORMAT = "json"
+      LOG_LEVEL  = "debug"
     }
   }
 

terraform/variables.tf

@@ -3,27 +3,3 @@ variable "aws_region" {
   type        = string
   default     = "us-east-2"
 }
-
-variable "app_id" {
-  description = "GitHub App ID"
-  type        = string
-  sensitive   = true
-}
-
-variable "webhook_secret" {
-  description = "GitHub Webhook Secret"
-  type        = string
-  sensitive   = true
-}
-
-variable "private_key" {
-  description = "GitHub App Private Key"
-  type        = string
-  sensitive   = true
-}
-
-variable "gputester_pat" {
-  description = "GPU Tester PAT"
-  type        = string
-  sensitive   = true
-}

tsconfig.json

@@ -2,8 +2,8 @@
   "compilerOptions": {
     /* Basic Options */
     "incremental": true /* Enable incremental compilation */,
-    "target": "es5" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
-    "module": "commonjs" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
+    "target": "es2022" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */,
+    "module": "esnext" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */,
     "lib": [
       "es2015",
       "es2017"