ci: use secrets from the source of truth (#493)

.github/workflows/smoke-tests.yml

@@ -31,7 +31,9 @@ jobs:
       TF_VAR_REPO: "${{ github.repository }}"
       SMOKETEST_VERSIONS: "${{ inputs.smoketest_versions || 'latest' }}"
       SKIP_DESTROY: 0
-      EC_API_KEY: ${{ secrets.OBSERVABILITY_EC_API_KEY }}
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - name: Bootstrap Action Workspace
@@ -41,7 +43,13 @@ jobs:
       - uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.2.3
-      - uses: elastic/oblt-actions/aws/[email protected]
+      - uses: elastic/oblt-actions/aws/auth@v1
+      - uses: elastic/oblt-actions/google/auth@v1
+      - uses: google-github-actions/get-secretmanager-secrets@dc4a1392bad0fd60aee00bb2097e30ef07a1caae # v2.1.3
+        with:
+          export_to_environment: true
+          secrets: |-
+            EC_API_KEY:elastic-observability/elastic-cloud-observability-team-pro-api-key
       - run: make smoketest/run TEST_DIR=./tf
       - if: always()
         name: Tear down