From 3198c0e2fa575896efb2c052f9681e5750aa886d Mon Sep 17 00:00:00 2001 From: robmonte <17119716+robmonte@users.noreply.github.com> Date: Thu, 7 Aug 2025 10:01:06 -0500 Subject: [PATCH 1/2] Add api-docs field description and docs feature explanation --- .../content/api-docs/system/secrets-sync.mdx | 2 ++ .../v1.21.x (rc)/content/docs/sync/github.mdx | 21 +++++++++++++++++-- 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/content/vault/v1.21.x (rc)/content/api-docs/system/secrets-sync.mdx b/content/vault/v1.21.x (rc)/content/api-docs/system/secrets-sync.mdx index f50aa72fc4..fcd60578f1 100644 --- a/content/vault/v1.21.x (rc)/content/api-docs/system/secrets-sync.mdx +++ b/content/vault/v1.21.x (rc)/content/api-docs/system/secrets-sync.mdx @@ -476,6 +476,8 @@ This endpoint creates a destination to synchronize action secrets with a GitHub - `name` `(string: )` - Specifies the name for this destination. This is specified as part of the URL. +- `enterprise_url` `(string: "")` - The URL of the GitHub Enterprise Server instance (self-hosted GitHub) to target for syncing secrets. + - `secrets_location` `(string: "repository")` - The GitHub location type of secrets to sync. Must be either `organization` or `repository`. - `access_token` `(string: ""` - Fine-grained or personal access token. diff --git a/content/vault/v1.21.x (rc)/content/docs/sync/github.mdx b/content/vault/v1.21.x (rc)/content/docs/sync/github.mdx index 29aa9610e5..e2831ced5e 100644 --- a/content/vault/v1.21.x (rc)/content/docs/sync/github.mdx +++ b/content/vault/v1.21.x (rc)/content/docs/sync/github.mdx @@ -7,7 +7,7 @@ description: >- # Sync secrets from Vault to GitHub -The GitHub actions sync destination allows Vault to safely synchronize secrets as GitHub organization, repository, or environment secrets. +The GitHub Actions sync destination allows Vault to safely synchronize secrets as GitHub organization, repository, or environment secrets. This is a low footprint option that enables your applications to benefit from Vault-managed secrets without requiring them to connect directly with Vault. This guide walks you through the configuration process. @@ -153,6 +153,22 @@ Use `vault write` to configure an organization sync destination: +### GitHub Enterprise + +GitHub Enterprise Server (self-hosted GitHub) destinations are configured similarly to standard github.com +destinations, but require an extra field on the configuration to specify the URL of the +server instance. + +Using repository secrets as an example: + + ```shell-session + $ vault write sys/sync/destinations/gh/DESTINATION_NAME \ + enterprise_url="https://github.example.com" \ + access_token="GITHUB_ACCESS_TOKEN" \ + secrets_location="GITHUB_SECRETS_LOCATION" \ + repository_owner="GITHUB_OWNER_NAME" \ + repository_name="GITHUB_REPO_NAME" + ``` ## Usage @@ -314,6 +330,7 @@ fingerprint name private_key ***** ``` + @@ -325,7 +342,6 @@ For more information, see [Verifying private keys](https://docs.github.com/en/ap - Next, use `vault write` with the `sys/sync/destinations/gh` endpoint to configure a GitHub destination that references your new GitHub application: @@ -345,6 +361,7 @@ name my-dest options map[custom_tags:map[] granularity_level:secret-key secret_name_template:VAULT_{{ .MountAccessor | uppercase }}_{{ .SecretPath | uppercase }}_{{ .SecretKey | uppercase }}] type gh ``` + You can now [use your GitHub application to sync secrets with your GitHub repository](#usage). From 691d03cddb7f0070c38337cf4ea70b7e154e088e Mon Sep 17 00:00:00 2001 From: Robert <17119716+robmonte@users.noreply.github.com> Date: Thu, 7 Aug 2025 15:19:44 -0500 Subject: [PATCH 2/2] Update content/vault/v1.21.x (rc)/content/docs/sync/github.mdx Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com> --- content/vault/v1.21.x (rc)/content/docs/sync/github.mdx | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/content/vault/v1.21.x (rc)/content/docs/sync/github.mdx b/content/vault/v1.21.x (rc)/content/docs/sync/github.mdx index e2831ced5e..a7a209eb04 100644 --- a/content/vault/v1.21.x (rc)/content/docs/sync/github.mdx +++ b/content/vault/v1.21.x (rc)/content/docs/sync/github.mdx @@ -155,11 +155,10 @@ Use `vault write` to configure an organization sync destination: ### GitHub Enterprise -GitHub Enterprise Server (self-hosted GitHub) destinations are configured similarly to standard github.com -destinations, but require an extra field on the configuration to specify the URL of the -server instance. - -Using repository secrets as an example: +In addition to the standard `github.com` destination parameters, you must +provide your Enterprise server URL with `enterprise_url` to configure GitHub +Enterprise Server (self-hosted GitHub) destinations. For example, to configure +repository secrets with GitHub Enterprise: ```shell-session $ vault write sys/sync/destinations/gh/DESTINATION_NAME \