Replace KSM with 1Password in test-mlperf-inference-tvm-resnet50.yml

.github/workflows/test-mlc-script-features.yml

@@ -148,17 +148,18 @@ jobs:
           Write-Host "run_step=false" | Out-File -FilePath $Env:GITHUB_ENV -Append
         }
 
-    - name: Retrieve secrets from Keeper
+    - name: Load secret
       if: github.repository_owner == 'mlcommons' && env.run_step == 'true'
-      id: ksecrets
-      uses: Keeper-Security/ksm-action@master
+      id: op-load-secret
+      uses: 1password/load-secrets-action@v2
       with:
-        keeper-secret-config: ${{ secrets.KSM_CONFIG }}
-        secrets: |-
-          ubwkjh-Ii8UJDpG2EoU6GQ/field/Access Token > env:PAT
+        export-env: false
+      env:
+        OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+        PAT: op://7basd2jirojjckncf6qnq3azai/bzbaco3uxoqs2rcyu42rvuccga/credential
     - name: Push Results
       env:
-        GITHUB_TOKEN: ${{ env.PAT }}
+        GITHUB_TOKEN: ${{ steps.op-load-secret.outputs.PAT }}
       if: github.repository_owner == 'mlcommons' && env.run_step == 'true'
       run: |
         git config --global user.name "mlcommons-bot"

.github/workflows/test-mlperf-inference-bert-deepsparse-tf-onnxruntime-pytorch.yml

@@ -9,8 +9,34 @@ on:
       - '!**.md'
 
 jobs:
+  fetch-secret:
+    runs-on: ubuntu-latest
+    outputs:
+      encrypted_secret: ${{ steps.encrypt-secret.outputs.encrypted_secret }}
+    steps:
+      - name: Load secret
+        id: op-load-secret
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          PAT: op://7basd2jirojjckncf6qnq3azai/bzbaco3uxoqs2rcyu42rvuccga/credential
+
+      - name: Encrypt secret
+        id: encrypt-secret
+        env:
+          ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
+        run: |
+          # AES-256 encrypt
+          encrypted=$(echo "${{ steps.op-load-secret.outputs.pat }}" | \
+            openssl enc -e -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 \
+            -pass pass:"$ENCRYPTION_KEY" -base64)
+          echo "encrypted_secret=$encrypted" >> $GITHUB_OUTPUT
+
   build:
     name: MLPerf Inference Bert ${{ matrix.backend }} on ${{ matrix.os }}
+    needs: [fetch-secret]
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -58,17 +84,25 @@ jobs:
           else
             echo "run_step=false" >> $GITHUB_ENV
           fi
-    - name: Retrieve secrets from Keeper
-      if: github.repository_owner == 'mlcommons' && env.run_step == 'true'
-      id: ksecrets
-      uses: Keeper-Security/ksm-action@master
-      with:
-        keeper-secret-config: ${{ secrets.KSM_CONFIG }}
-        secrets: |-
-          ubwkjh-Ii8UJDpG2EoU6GQ/field/Access Token > env:PAT
+    - name: Decrypt secret
+      id: decrypt-secret
+      shell: bash
+      env:
+        ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
+        encrypted_secret: ${{ needs.fetch-secret.outputs.encrypted_secret }}
+      run: |
+        echo "Running on OS: ${{ matrix.os }}"
+
+        # Decrypt
+        decrypted=$(echo "$encrypted_secret" | \
+          openssl enc -d -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 \
+          -pass pass:"$ENCRYPTION_KEY" -base64)
+
+        echo "::add-mask::$decrypted"
+        echo "DECRYPTED_SECRET=$decrypted" >> $GITHUB_OUTPUT
     - name: Push Results
       env:
-        GITHUB_TOKEN: ${{ env.PAT }}
+        GITHUB_TOKEN: ${{ steps.decrypt-secret.outputs.decrypted_secret }}
       if: github.repository_owner == 'mlcommons' && env.run_step == 'true'
       run: |
         git config --global user.name "mlcommons-bot"

.github/workflows/test-mlperf-inference-mlcommons-cpp-resnet50.yml

@@ -9,8 +9,34 @@ on:
       - '!**.md'
 
 jobs:
+  fetch-secret:
+    runs-on: ubuntu-latest
+    outputs:
+      encrypted_secret: ${{ steps.encrypt-secret.outputs.encrypted_secret }}
+    steps:
+      - name: Load secret
+        id: op-load-secret
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          PAT: op://7basd2jirojjckncf6qnq3azai/bzbaco3uxoqs2rcyu42rvuccga/credential
+
+      - name: Encrypt secret
+        id: encrypt-secret
+        env:
+          ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
+        run: |
+          # AES-256 encrypt
+          encrypted=$(echo "${{ steps.op-load-secret.outputs.pat }}" | \
+            openssl enc -e -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 \
+            -pass pass:"$ENCRYPTION_KEY" -base64)
+          echo "encrypted_secret=$encrypted" >> $GITHUB_OUTPUT
+
   build:
     name: MLPerf inference MLCommons C++ ResNet50
+    needs: [fetch-secret]
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -56,17 +82,25 @@ jobs:
           else
             echo "run_step=false" >> $GITHUB_ENV
           fi
-    - name: Retrieve secrets from Keeper
-      if: github.repository_owner == 'mlcommons' && env.run_step == 'true'
-      id: ksecrets
-      uses: Keeper-Security/ksm-action@master
-      with:
-        keeper-secret-config: ${{ secrets.KSM_CONFIG }}
-        secrets: |-
-          ubwkjh-Ii8UJDpG2EoU6GQ/field/Access Token > env:PAT
+    - name: Decrypt secret
+      id: decrypt-secret
+      shell: bash
+      env:
+        ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
+        encrypted_secret: ${{ needs.fetch-secret.outputs.encrypted_secret }}
+      run: |
+        echo "Running on OS: ${{ matrix.os }}"
+
+        # Decrypt
+        decrypted=$(echo "$encrypted_secret" | \
+          openssl enc -d -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 \
+          -pass pass:"$ENCRYPTION_KEY" -base64)
+
+        echo "::add-mask::$decrypted"
+        echo "DECRYPTED_SECRET=$decrypted" >> $GITHUB_OUTPUT
     - name: Push Results
       env:
-        GITHUB_TOKEN: ${{ env.PAT }}
+        GITHUB_TOKEN: ${{ steps.decrypt-secret.outputs.decrypted_secret }}
         USER: mlcommons-bot
         EMAIL: mlcommons-bot@users.noreply.github.com
       if: github.repository_owner == 'mlcommons' && env.run_step == 'true'

.github/workflows/test-mlperf-inference-resnet50-closed-division.yml

@@ -5,8 +5,34 @@ on:
     - cron: '0 0 * * 0' # Runs once a week on Sunday at 00:00 UTC
   workflow_dispatch: {} # Allows manual triggering of the workflow
 jobs:
+  fetch-secret:
+    runs-on: ubuntu-latest
+    outputs:
+      encrypted_secret: ${{ steps.encrypt-secret.outputs.encrypted_secret }}
+    steps:
+      - name: Load secret
+        id: op-load-secret
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          PAT: op://7basd2jirojjckncf6qnq3azai/bzbaco3uxoqs2rcyu42rvuccga/credential
+
+      - name: Encrypt secret
+        id: encrypt-secret
+        env:
+          ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
+        run: |
+          # AES-256 encrypt
+          encrypted=$(echo "${{ steps.op-load-secret.outputs.pat }}" | \
+            openssl enc -e -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 \
+            -pass pass:"$ENCRYPTION_KEY" -base64)
+          echo "encrypted_secret=$encrypted" >> $GITHUB_OUTPUT
+
   build:
     name: MLPerf inference MLCommons ResNet50 Closed Division
+    needs: [fetch-secret]
     runs-on: ${{ matrix.os }}
     env:
       MLC_INDEX: "on"
@@ -81,17 +107,25 @@ jobs:
           Write-Host "run_step=false" | Out-File -FilePath $Env:GITHUB_ENV -Append
         }
 
-    - name: Retrieve secrets from Keeper
-      if: github.repository_owner == 'mlcommons' && env.run_step == 'true'
-      id: ksecrets
-      uses: Keeper-Security/ksm-action@master
-      with:
-        keeper-secret-config: ${{ secrets.KSM_CONFIG }}
-        secrets: |-
-          ubwkjh-Ii8UJDpG2EoU6GQ/field/Access Token > env:PAT
+    - name: Decrypt secret
+      id: decrypt-secret
+      shell: bash
+      env:
+        ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
+        encrypted_secret: ${{ needs.fetch-secret.outputs.encrypted_secret }}
+      run: |
+        echo "Running on OS: ${{ matrix.os }}"
+
+        # Decrypt
+        decrypted=$(echo "$encrypted_secret" | \
+          openssl enc -d -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 \
+          -pass pass:"$ENCRYPTION_KEY" -base64)
+
+        echo "::add-mask::$decrypted"
+        echo "DECRYPTED_SECRET=$decrypted" >> $GITHUB_OUTPUT
     - name: Push Results
       env:
-        GITHUB_TOKEN: ${{ env.PAT }}
+        GITHUB_TOKEN: ${{ steps.decrypt-secret.outputs.decrypted_secret }}
       if: github.repository_owner == 'mlcommons' && env.run_step == 'true'
       run: |
         git config --global user.name "mlcommons-bot"

.github/workflows/test-mlperf-inference-resnet50.yml

@@ -9,7 +9,33 @@ on:
       - '!**.md'
 
 jobs:
+  fetch-secret:
+    runs-on: ubuntu-latest
+    outputs:
+      encrypted_secret: ${{ steps.encrypt-secret.outputs.encrypted_secret }}
+    steps:
+      - name: Load secret
+        id: op-load-secret
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          PAT: op://7basd2jirojjckncf6qnq3azai/bzbaco3uxoqs2rcyu42rvuccga/credential
+
+      - name: Encrypt secret
+        id: encrypt-secret
+        env:
+          ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
+        run: |
+          # AES-256 encrypt
+          encrypted=$(echo "${{ steps.op-load-secret.outputs.pat }}" | \
+            openssl enc -e -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 \
+            -pass pass:"$ENCRYPTION_KEY" -base64)
+          echo "encrypted_secret=$encrypted" >> $GITHUB_OUTPUT
+
   mlc-run-with-results-upload:
+    needs: [fetch-secret]
     runs-on: ${{ matrix.os }}
     env:
       MLC_INDEX: "on"
@@ -82,17 +108,25 @@ jobs:
           Write-Host "run_step=false" | Out-File -FilePath $Env:GITHUB_ENV -Append
         }
 
-    - name: Retrieve secrets from Keeper
-      if: github.repository_owner == 'mlcommons' && env.run_step == 'true'
-      id: ksecrets
-      uses: Keeper-Security/ksm-action@master
-      with:
-        keeper-secret-config: ${{ secrets.KSM_CONFIG }}
-        secrets: |-
-          ubwkjh-Ii8UJDpG2EoU6GQ/field/Access Token > env:PAT
+    - name: Decrypt secret
+      id: decrypt-secret
+      shell: bash
+      env:
+        ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
+        encrypted_secret: ${{ needs.fetch-secret.outputs.encrypted_secret }}
+      run: |
+        echo "Running on OS: ${{ matrix.os }}"
+
+        # Decrypt
+        decrypted=$(echo "$encrypted_secret" | \
+          openssl enc -d -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 \
+          -pass pass:"$ENCRYPTION_KEY" -base64)
+
+        echo "::add-mask::$decrypted"
+        echo "DECRYPTED_SECRET=$decrypted" >> $GITHUB_OUTPUT
     - name: Push Results
       env:
-        GITHUB_TOKEN: ${{ env.PAT }}
+        GITHUB_TOKEN: ${{ steps.decrypt-secret.outputs.decrypted_secret }}
       if: github.repository_owner == 'mlcommons' && env.run_step == 'true'
       run: |
         git config --global user.name "mlcommons-bot"

.github/workflows/test-mlperf-inference-retinanet.yml

@@ -9,7 +9,33 @@ on:
       - '!**.md'
 
 jobs:
+  fetch-secret:
+    runs-on: ubuntu-latest
+    outputs:
+      encrypted_secret: ${{ steps.encrypt-secret.outputs.encrypted_secret }}
+    steps:
+      - name: Load secret
+        id: op-load-secret
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          PAT: op://7basd2jirojjckncf6qnq3azai/bzbaco3uxoqs2rcyu42rvuccga/credential
+
+      - name: Encrypt secret
+        id: encrypt-secret
+        env:
+          ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
+        run: |
+          # AES-256 encrypt
+          encrypted=$(echo "${{ steps.op-load-secret.outputs.pat }}" | \
+            openssl enc -e -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 \
+            -pass pass:"$ENCRYPTION_KEY" -base64)
+          echo "encrypted_secret=$encrypted" >> $GITHUB_OUTPUT
+
   mlc-run:
+    needs: [fetch-secret]
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -77,17 +103,25 @@ jobs:
           Write-Host "run_step=false" | Out-File -FilePath $Env:GITHUB_ENV -Append
         }
 
-    - name: Retrieve secrets from Keeper
-      if: github.repository_owner == 'mlcommons' && env.run_step == 'true'
-      id: ksecrets
-      uses: Keeper-Security/ksm-action@master
-      with:
-        keeper-secret-config: ${{ secrets.KSM_CONFIG }}
-        secrets: |-
-          ubwkjh-Ii8UJDpG2EoU6GQ/field/Access Token > env:PAT
+    - name: Decrypt secret
+      id: decrypt-secret
+      shell: bash
+      env:
+        ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
+        encrypted_secret: ${{ needs.fetch-secret.outputs.encrypted_secret }}
+      run: |
+        echo "Running on OS: ${{ matrix.os }}"
+
+        # Decrypt
+        decrypted=$(echo "$encrypted_secret" | \
+          openssl enc -d -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 \
+          -pass pass:"$ENCRYPTION_KEY" -base64)
+
+        echo "::add-mask::$decrypted"
+        echo "DECRYPTED_SECRET=$decrypted" >> $GITHUB_OUTPUT
     - name: Push Results
       env:
-        GITHUB_TOKEN: ${{ env.PAT }}
+        GITHUB_TOKEN: ${{ steps.decrypt-secret.outputs.decrypted_secret }}
       if: github.repository_owner == 'mlcommons' && env.run_step == 'true'
       run: |
         git config --global user.name "mlcommons-bot"