fix rotation

.github/workflows/refresh-test-credentials.yml

@@ -53,15 +53,15 @@ jobs:
         shell: bash
         run: |
           cd ops/external-prs &&
-          gcloud iam service-accounts keys create dummy.json --iam-account=[email protected] && 
+          bash scripts/rotate-service-account.sh [email protected] dummy.json && 
           pnpm tools refresh-gcp-credentials --secret=false ${{ github.repository }} testing dummy.json GOOGLE_TEST_DUMMY_CREDENTIALS_JSON
       
       # These credentials are intended to be secret
       - name: Refresh credentials for the bigquery-admin user on the external-prs-app environment
         shell: bash
         run: |
           cd ops/external-prs &&
-          gcloud iam service-accounts keys create bigquery-admin.json --iam-account=[email protected] && 
+          bash scripts/rotate-service-account.sh [email protected] bigquery-admin.json && 
           pnpm tools refresh-gcp-credentials ${{ github.repository }} external-prs-app bigquery-admin.json GOOGLE_BQ_ADMIN_CREDENTIALS_JSON
 
   rebuild-docker-public-vars:

ops/external-prs/scripts/rotate-service-account.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+
+set -euo pipefail
+# This would have been a javascript script but it's non-trivial there compared to
+# bash.
+
+iam_account=$1
+output_file=$2
+
+temp_dir=`mktemp -d`
+
+
+list_keys() {
+    iam_account=$1
+    gcloud iam service-accounts keys list --format=json --iam-account="${iam_account}"
+}
+
+create_key() {
+    iam_account=$1
+    output_path=$2
+    gcloud iam service-accounts keys create --iam-account="${iam_account}" "${output_path}"
+}
+
+delete_key() {
+    iam_account=$1
+    key_id=$2
+    gcloud iam service-accounts keys delete -q --iam-account="${iam_account}" "${key_id}"
+}
+
+parse_user_managed() {
+    jq -r '.[] | select(.keyType=="USER_MANAGED" and .validBeforeTime<="'"$(date +'%Y-%m-%dT%H:%M:%S')"'").name | split("/")[5]'
+}
+
+# Check for old keys
+old_keys=$(list_keys "${iam_account}" | parse_user_managed)
+
+# Delete any old keys
+if [[ ! -z "$old_keys" ]]; then
+    echo "${old_keys}" |  while read line ; do
+        echo "Deleting $line"
+        delete_key "${iam_account}" "${line}"
+    done
+fi
+
+# Create a new key
+create_key "${iam_account}" "${output_file}"