zoo/universe
2
0
Fork 0
Code Issues Pull Requests Releases Activity

Fetch secrets from the Hanzo KMS, not the Infisical API

Browse Source 
The KMS fetch steps called `/api/v1/auth/universal-auth/login` and
`/api/v3/secrets/raw?workspaceSlug=...` — the Infisical surface. We do not run
Infisical; kms.hanzo.ai serves the Hanzo-native door and 404s those paths, so
every secret fetch failed and the build died at "KMS auth failed".

Rewritten to the canonical contract the working repos use:
`/v1/kms/auth/login` returning `.accessToken`, then
`/v1/kms/secrets/ci/<name>?env=prod` returning `.value`. The org is read from
the credential, so the `zoo-platform` workspace slug is gone.

Co-authored-by: Hanzo AI <[email protected]>
This commit is contained in:
zeekay
2026-09-07 21:45:04 -07:00
co-authored by Hanzo AI
parent bbc3b5b230
commit d9eb4f38be
2 changed files with 15 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-service.yml
+9 -12
View File
@@ -88,10 +88,9 @@ jobs:
run: |
set -euo pipefail
KMS_URL="${KMS_URL:-https://kms.hanzo.ai}"
WORKSPACE="zoo-platform"
ACCESS_TOKEN="$(
curl -fsS --max-time 10 -X POST "${KMS_URL}/api/v1/auth/universal-auth/login" \
curl -fsS --max-time 10 -X POST "${KMS_URL}/v1/kms/auth/login" \
-H "Content-Type: application/json" \
-d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}" \
| jq -r '.accessToken'
@@ -100,9 +99,9 @@ jobs:
[ -n "${ACCESS_TOKEN}" ] && [ "${ACCESS_TOKEN}" != "null" ] || { echo "::error::KMS auth failed"; exit 1; }
fetch_secret() {
curl -fsS "${KMS_URL}/api/v3/secrets/raw/${1}?workspaceSlug=${WORKSPACE}&environment=prod&secretPath=/ci&viewSecretValue=true&include_imports=true" \
curl -fsS "${KMS_URL}/v1/kms/secrets/ci/${1}?env=prod" \
-H "Authorization: Bearer ${ACCESS_TOKEN}" \
| jq -r '.secret.secretValue'
| jq -r '.value // empty'
}
for name in GCP_CREDENTIAL TOKEN_GITHUB_CICD DIGITALOCEAN_ACCESS_TOKEN; do
@@ -170,10 +169,9 @@ jobs:
run: |
set -euo pipefail
KMS_URL="${KMS_URL:-https://kms.hanzo.ai}"
WORKSPACE="zoo-platform"
ACCESS_TOKEN="$(
curl -fsS --max-time 10 -X POST "${KMS_URL}/api/v1/auth/universal-auth/login" \
curl -fsS --max-time 10 -X POST "${KMS_URL}/v1/kms/auth/login" \
-H "Content-Type: application/json" \
-d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}" \
| jq -r '.accessToken'
@@ -182,9 +180,9 @@ jobs:
[ -n "${ACCESS_TOKEN}" ] && [ "${ACCESS_TOKEN}" != "null" ] || { echo "::error::KMS auth failed"; exit 1; }
fetch_secret() {
curl -fsS "${KMS_URL}/api/v3/secrets/raw/${1}?workspaceSlug=${WORKSPACE}&environment=prod&secretPath=/ci&viewSecretValue=true&include_imports=true" \
curl -fsS "${KMS_URL}/v1/kms/secrets/ci/${1}?env=prod" \
-H "Authorization: Bearer ${ACCESS_TOKEN}" \
| jq -r '.secret.secretValue'
| jq -r '.value // empty'
}
for name in GCP_CREDENTIAL TOKEN_GITHUB_CICD DIGITALOCEAN_ACCESS_TOKEN; do
@@ -318,10 +316,9 @@ jobs:
run: |
set -euo pipefail
KMS_URL="${KMS_URL:-https://kms.hanzo.ai}"
WORKSPACE="zoo-platform"
ACCESS_TOKEN="$(
curl -fsS --max-time 10 -X POST "${KMS_URL}/api/v1/auth/universal-auth/login" \
curl -fsS --max-time 10 -X POST "${KMS_URL}/v1/kms/auth/login" \
-H "Content-Type: application/json" \
-d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}" \
| jq -r '.accessToken'
@@ -330,9 +327,9 @@ jobs:
[ -n "${ACCESS_TOKEN}" ] && [ "${ACCESS_TOKEN}" != "null" ] || { echo "::error::KMS auth failed"; exit 1; }
fetch_secret() {
curl -fsS "${KMS_URL}/api/v3/secrets/raw/${1}?workspaceSlug=${WORKSPACE}&environment=prod&secretPath=/ci&viewSecretValue=true&include_imports=true" \
curl -fsS "${KMS_URL}/v1/kms/secrets/ci/${1}?env=prod" \
-H "Authorization: Bearer ${ACCESS_TOKEN}" \
| jq -r '.secret.secretValue'
| jq -r '.value // empty'
}
for name in GCP_CREDENTIAL TOKEN_GITHUB_CICD DIGITALOCEAN_ACCESS_TOKEN; do
.github/workflows/ci.yml
+6 -8
View File
@@ -150,10 +150,9 @@ jobs:
run: |
set -euo pipefail
KMS_URL="${KMS_URL:-https://kms.hanzo.ai}"
WORKSPACE="zoo-platform"
ACCESS_TOKEN="$(
curl -fsS --max-time 10 -X POST "${KMS_URL}/api/v1/auth/universal-auth/login" \
curl -fsS --max-time 10 -X POST "${KMS_URL}/v1/kms/auth/login" \
-H "Content-Type: application/json" \
-d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}" \
| jq -r '.accessToken'
@@ -162,9 +161,9 @@ jobs:
[ -n "${ACCESS_TOKEN}" ] && [ "${ACCESS_TOKEN}" != "null" ] || { echo "::error::KMS auth failed"; exit 1; }
fetch_secret() {
curl -fsS "${KMS_URL}/api/v3/secrets/raw/${1}?workspaceSlug=${WORKSPACE}&environment=prod&secretPath=/ci&viewSecretValue=true&include_imports=true" \
curl -fsS "${KMS_URL}/v1/kms/secrets/ci/${1}?env=prod" \
-H "Authorization: Bearer ${ACCESS_TOKEN}" \
| jq -r '.secret.secretValue'
| jq -r '.value // empty'
}
for name in GCP_CREDENTIAL TOKEN_GITHUB_CICD DIGITALOCEAN_ACCESS_TOKEN; do
@@ -256,10 +255,9 @@ jobs:
run: |
set -euo pipefail
KMS_URL="${KMS_URL:-https://kms.hanzo.ai}"
WORKSPACE="zoo-platform"
ACCESS_TOKEN="$(
curl -fsS --max-time 10 -X POST "${KMS_URL}/api/v1/auth/universal-auth/login" \
curl -fsS --max-time 10 -X POST "${KMS_URL}/v1/kms/auth/login" \
-H "Content-Type: application/json" \
-d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}" \
| jq -r '.accessToken'
@@ -268,9 +266,9 @@ jobs:
[ -n "${ACCESS_TOKEN}" ] && [ "${ACCESS_TOKEN}" != "null" ] || { echo "::error::KMS auth failed"; exit 1; }
fetch_secret() {
curl -fsS "${KMS_URL}/api/v3/secrets/raw/${1}?workspaceSlug=${WORKSPACE}&environment=prod&secretPath=/ci&viewSecretValue=true&include_imports=true" \
curl -fsS "${KMS_URL}/v1/kms/secrets/ci/${1}?env=prod" \
-H "Authorization: Bearer ${ACCESS_TOKEN}" \
| jq -r '.secret.secretValue'
| jq -r '.value // empty'
}
for name in GCP_CREDENTIAL TOKEN_GITHUB_CICD DIGITALOCEAN_ACCESS_TOKEN; do