Compare commits
1 Commits
v2
...
eddy/cli-c
| Author | SHA1 | Date | |
|---|---|---|---|
|
61def4eb0f |
24
.github/workflows/test.yml
vendored
24
.github/workflows/test.yml
vendored
@@ -2,21 +2,11 @@ on: push
|
||||
name: Run acceptance tests
|
||||
|
||||
jobs:
|
||||
unit-tests:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: actions/setup-node@v3
|
||||
with:
|
||||
node-version: 20
|
||||
- run: npm ci
|
||||
- run: npm test
|
||||
|
||||
test-with-output-secrets:
|
||||
strategy:
|
||||
matrix:
|
||||
os: [ubuntu-latest, macos-latest]
|
||||
auth: [connect, service-account]
|
||||
os: [ ubuntu-latest, macos-latest ]
|
||||
auth: [ connect, service-account ]
|
||||
exclude:
|
||||
- os: macos-latest
|
||||
auth: connect
|
||||
@@ -39,7 +29,7 @@ jobs:
|
||||
if: ${{ matrix.auth == 'connect' }}
|
||||
uses: ./configure # 1password/load-secrets-action/configure@<version>
|
||||
with:
|
||||
connect-host: http://localhost:8080
|
||||
connect-host: localhost:8080
|
||||
connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
|
||||
- name: Load secrets
|
||||
id: load_secrets
|
||||
@@ -59,8 +49,8 @@ jobs:
|
||||
test-with-export-env:
|
||||
strategy:
|
||||
matrix:
|
||||
os: [ubuntu-latest, macos-latest]
|
||||
auth: [connect, service-account]
|
||||
os: [ ubuntu-latest, macos-latest ]
|
||||
auth: [ connect, service-account ]
|
||||
exclude:
|
||||
- os: macos-latest
|
||||
auth: connect
|
||||
@@ -103,8 +93,8 @@ jobs:
|
||||
test-references-with-ids:
|
||||
strategy:
|
||||
matrix:
|
||||
os: [ubuntu-latest, macos-latest]
|
||||
auth: [connect, service-account]
|
||||
os: [ ubuntu-latest, macos-latest ]
|
||||
auth: [ connect, service-account ]
|
||||
exclude:
|
||||
- os: macos-latest
|
||||
auth: connect
|
||||
|
||||
458
README.md
458
README.md
@@ -1,27 +1,38 @@
|
||||
<!-- Image sourced from https://blog.1password.com/1password-service-accounts/ -->
|
||||
<img alt="" role="img" src="https://blog.1password.com/posts/2023/1password-service-accounts/header.png"/>
|
||||
# Load Secrets from 1Password - GitHub Action
|
||||
|
||||
<div align="center">
|
||||
<h1>Load Secrets from 1Password - GitHub Action</h1>
|
||||
<p>Provide the secrets your GitHub runner needs from 1Password.</p>
|
||||
<a href="https://developer.1password.com/docs/ci-cd/github-actions">
|
||||
<img alt="Get started" src="https://user-images.githubusercontent.com/45081667/226940040-16d3684b-60f4-4d95-adb2-5757a8f1bc15.png" height="37"/>
|
||||
</a>
|
||||
</div>
|
||||
|
||||
---
|
||||
|
||||
`load-secrets-action` loads secrets from 1Password into GitHub Actions using [Service Accounts](https://developer.1password.com/docs/service-accounts) or [1Password Connect](https://developer.1password.com/docs/connect).
|
||||
This action loads secrets from 1Password into GitHub Actions using [1Password Connect](https://developer.1password.com/docs/connect) or a [Service Account <sup>[BETA]</sup>](https://developer.1password.com/docs/service-accounts).
|
||||
|
||||
Specify in your workflow YAML file which secrets from 1Password should be loaded into your job, and the action will make them available as environment variables for the next steps.
|
||||
|
||||
Read more on the [1Password Developer Portal](https://developer.1password.com/docs/ci-cd/github-actions).
|
||||
|
||||
## 🪄 See it in action!
|
||||
## Requirements
|
||||
|
||||
[](https://www.youtube.com/watch?v=kVBl5iQYgSA "Using 1Password Service Accounts with GitHub Actions")
|
||||
Before you get started, you'll need to:
|
||||
|
||||
## ✨ Quickstart
|
||||
- [Deploy 1Password Connect](/docs/connect/get-started#step-2-deploy-1password-connect-server) in your infrastructure.
|
||||
- Set the `OP_CONNECT_HOST` and `OP_CONNECT_TOKEN` environment variables to your Connect instance's credentials, so it'll be used to load secrets.
|
||||
|
||||
_Supported runners_: You can run the action on Mac and Linux runners. Windows is currently not supported.
|
||||
|
||||
## Usage
|
||||
|
||||
You can configure the action to use your 1Password Connect instance.
|
||||
|
||||
If you provide `OP_CONNECT_HOST` and `OP_CONNECT_TOKEN` variables, the Connect instance will be used to load secrets. Make sure [1Password Connect](https://support.1password.com/secrets-automation/#step-2-deploy-a-1password-connect-server) is deployed in your infrastructure.
|
||||
|
||||
If you provide `OP_SERVICE_ACCOUNT_TOKEN` variable, the service account will be used to load secrets.
|
||||
|
||||
**_Note_**: If all environment variables have been set, the Connect credentials will take precedence over the provided service account token. You must unset the Connect environment variables to ensure the action uses the service account token.
|
||||
|
||||
There are two ways that secrets can be loaded:
|
||||
|
||||
- [use the secrets from the action's ouput](#use-secrets-from-the-actions-output)
|
||||
- [export secrets as environment variables](#export-secrets-as-environment-variables)
|
||||
|
||||
### Use secrets from the action's output
|
||||
|
||||
This method allows for you to use the loaded secrets as an output from the step: `steps.step-id.outputs.secret-name`. You will need to set an id for the step that uses this action to be able to access its outputs. For more details, , see [`outputs.<output_id>`](https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputsoutput_id).
|
||||
|
||||
```yml
|
||||
on: push
|
||||
@@ -32,7 +43,151 @@ jobs:
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
- name: Load secret
|
||||
uses: 1password/load-secrets-action@v2
|
||||
id: op-load-secret
|
||||
uses: 1password/load-secrets-action@v1
|
||||
with:
|
||||
export-env: false
|
||||
env:
|
||||
OP_CONNECT_HOST: <Your Connect instance URL>
|
||||
OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
|
||||
SECRET: op://app-cicd/hello-world/secret
|
||||
|
||||
- name: Print masked secret
|
||||
run: echo "Secret: ${{ steps.op-load-secret.outputs.SECRET }}"
|
||||
# Prints: Secret: ***
|
||||
```
|
||||
|
||||
<details>
|
||||
<summary><b>Usage example with Service Accounts <sup>BETA</sup></b></summary>
|
||||
|
||||
```yml
|
||||
on: push
|
||||
jobs:
|
||||
hello-world:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
- name: Load secret
|
||||
id: op-load-secret
|
||||
uses: 1password/load-secrets-action@v1
|
||||
with:
|
||||
export-env: false
|
||||
env:
|
||||
OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
|
||||
SECRET: op://app-cicd/hello-world/secret
|
||||
|
||||
- name: Print masked secret
|
||||
run: echo "Secret: ${{ steps.op-load-secret.outputs.SECRET }}"
|
||||
# Prints: Secret: ***
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><b>Longer usage example</b></summary>
|
||||
|
||||
```yml
|
||||
on: push
|
||||
name: Deploy app
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
- name: Configure 1Password Connect
|
||||
uses: 1password/load-secrets-action/configure@v1
|
||||
with:
|
||||
# Persist the 1Password Connect URL for next steps. You can also persist
|
||||
# the Connect token using input `connect-token`, but keep in mind that
|
||||
# this will grant all steps of the job access to the token.
|
||||
connect-host: https://1password.acme.com
|
||||
|
||||
- name: Load Docker credentials
|
||||
id: load-docker-credentials
|
||||
uses: 1password/load-secrets-action@v1
|
||||
with:
|
||||
export-env: false
|
||||
env:
|
||||
OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
|
||||
DOCKERHUB_USERNAME: op://app-cicd/docker/username
|
||||
DOCKERHUB_TOKEN: op://app-cicd/docker/token
|
||||
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ steps.load-docker-credentials.outputs.DOCKERHUB_USERNAME }}
|
||||
password: ${{ steps.load-docker-credentials.outputs.DOCKERHUB_TOKEN }}
|
||||
|
||||
- name: Build and push Docker image
|
||||
uses: docker/build-push-action@v3
|
||||
with:
|
||||
push: true
|
||||
tags: acme/app:latest
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><b>Longer usage example with Service Accounts <sup>BETA</sup></b></summary>
|
||||
|
||||
```yml
|
||||
on: push
|
||||
name: Deploy app
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
- name: Configure 1Password Connect
|
||||
uses: 1password/load-secrets-action/configure@v1
|
||||
with:
|
||||
# Persist the 1Password Service Account token. This will grant
|
||||
# all steps of the job access to the token.
|
||||
service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
|
||||
|
||||
- name: Load Docker credentials
|
||||
id: load-docker-credentials
|
||||
uses: 1password/load-secrets-action@v1
|
||||
with:
|
||||
export-env: false
|
||||
env:
|
||||
DOCKERHUB_USERNAME: op://app-cicd/docker/username
|
||||
DOCKERHUB_TOKEN: op://app-cicd/docker/token
|
||||
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ steps.load-docker-credentials.outputs.DOCKERHUB_USERNAME }}
|
||||
password: ${{ steps.load-docker-credentials.outputs.DOCKERHUB_TOKEN }}
|
||||
|
||||
- name: Build and push Docker image
|
||||
uses: docker/build-push-action@v3
|
||||
with:
|
||||
push: true
|
||||
tags: acme/app:latest
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
### Export secrets as environment variables
|
||||
|
||||
This method, allows the action to access the loaded secrets as environment variables. These environment variables are accessible at a job level.
|
||||
|
||||
```yml
|
||||
on: push
|
||||
jobs:
|
||||
hello-world:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
- name: Load secret
|
||||
uses: 1password/load-secrets-action@v1
|
||||
with:
|
||||
# Export loaded secrets as environment variables
|
||||
export-env: true
|
||||
@@ -41,20 +196,273 @@ jobs:
|
||||
SECRET: op://app-cicd/hello-world/secret
|
||||
|
||||
- name: Print masked secret
|
||||
run: 'echo "Secret: $SECRET"'
|
||||
run: echo "Secret: $SECRET"
|
||||
# Prints: Secret: ***
|
||||
```
|
||||
|
||||
## 💙 Community & Support
|
||||
<details>
|
||||
<summary><b>Usage example with Service Accounts <sup>BETA</sup></b></summary>
|
||||
|
||||
- File an [issue](https://github.com/1Password/load-secrets-action/issues) for bugs and feature requests.
|
||||
- Join the [Developer Slack workspace](https://join.slack.com/t/1password-devs/shared_invite/zt-1halo11ps-6o9pEv96xZ3LtX_VE0fJQA).
|
||||
- Subscribe to the [Developer Newsletter](https://1password.com/dev-subscribe/).
|
||||
```yml
|
||||
on: push
|
||||
jobs:
|
||||
hello-world:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
## 🔐 Security
|
||||
- name: Load secret
|
||||
uses: 1password/load-secrets-action@v1
|
||||
with:
|
||||
# Export loaded secrets as environment variables
|
||||
export-env: true
|
||||
env:
|
||||
OP_CONNECT_HOST: <Your Connect instance URL>
|
||||
OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
|
||||
SECRET: op://app-cicd/hello-world/secret
|
||||
|
||||
- name: Print masked secret
|
||||
run: echo "Secret: $SECRET"
|
||||
# Prints: Secret: ***
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><b>Longer usage example</b></summary>
|
||||
|
||||
```yml
|
||||
on: push
|
||||
name: Deploy app
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
- name: Configure 1Password Connect
|
||||
uses: 1password/load-secrets-action/configure@v1
|
||||
with:
|
||||
# Persist the 1Password Connect URL for next steps. You can also persist
|
||||
# the Connect token using input `connect-token`, but keep in mind that
|
||||
# this will grant all steps of the job access to the token.
|
||||
connect-host: https://1password.acme.com
|
||||
|
||||
- name: Load Docker credentials
|
||||
uses: 1password/load-secrets-action@v1
|
||||
with:
|
||||
# Export loaded secrets as environment variables
|
||||
export-env: true
|
||||
env:
|
||||
OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
|
||||
DOCKERHUB_USERNAME: op://app-cicd/docker/username
|
||||
DOCKERHUB_TOKEN: op://app-cicd/docker/token
|
||||
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ env.DOCKERHUB_USERNAME }}
|
||||
password: ${{ env.DOCKERHUB_TOKEN }}
|
||||
|
||||
- name: Print environment variables with masked secrets
|
||||
run: printenv
|
||||
|
||||
- name: Build and push Docker image
|
||||
uses: docker/build-push-action@v3
|
||||
with:
|
||||
push: true
|
||||
tags: acme/app:latest
|
||||
|
||||
- name: Load AWS credentials
|
||||
uses: 1password/load-secrets-action@v1
|
||||
with:
|
||||
# Export loaded secrets as environment variables
|
||||
export-env: true
|
||||
# Remove local copies of the Docker credentials, which aren't needed anymore
|
||||
unset-previous: true
|
||||
env:
|
||||
OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
|
||||
AWS_ACCESS_KEY_ID: op://app-cicd/aws/access-key-id
|
||||
AWS_SECRET_ACCESS_KEY: op://app-cicd/aws/secret-access-key
|
||||
|
||||
- name: Deploy app
|
||||
# This script expects AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY to be set.
|
||||
# This happened using secret references in the preceding lines.
|
||||
run: ./deploy.sh
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><b>Longer usage example with Service Accounts <sup>BETA</sup></b></summary>
|
||||
|
||||
```yml
|
||||
on: push
|
||||
name: Deploy app
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
- name: Configure 1Password Connect
|
||||
uses: 1password/load-secrets-action/configure@v1
|
||||
with:
|
||||
# Persist the 1Password Service Account token. This will grant
|
||||
# all steps of the job access to the token.
|
||||
service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
|
||||
|
||||
- name: Load Docker credentials
|
||||
uses: 1password/load-secrets-action@v1
|
||||
with:
|
||||
# Export loaded secrets as environment variables
|
||||
export-env: true
|
||||
env:
|
||||
DOCKERHUB_USERNAME: op://app-cicd/docker/username
|
||||
DOCKERHUB_TOKEN: op://app-cicd/docker/token
|
||||
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ env.DOCKERHUB_USERNAME }}
|
||||
password: ${{ env.DOCKERHUB_TOKEN }}
|
||||
|
||||
- name: Print environment variables with masked secrets
|
||||
run: printenv
|
||||
|
||||
- name: Build and push Docker image
|
||||
uses: docker/build-push-action@v3
|
||||
with:
|
||||
push: true
|
||||
tags: acme/app:latest
|
||||
|
||||
- name: Load AWS credentials
|
||||
uses: 1password/load-secrets-action@v1
|
||||
with:
|
||||
# Export loaded secrets as environment variables
|
||||
export-env: true
|
||||
# Remove local copies of the Docker credentials, which aren't needed anymore
|
||||
unset-previous: true
|
||||
env:
|
||||
AWS_ACCESS_KEY_ID: op://app-cicd/aws/access-key-id
|
||||
AWS_SECRET_ACCESS_KEY: op://app-cicd/aws/secret-access-key
|
||||
|
||||
- name: Deploy app
|
||||
# This script expects AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY to be set.
|
||||
# This happened using secret references in the preceding lines.
|
||||
run: ./deploy.sh
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
## Action Inputs
|
||||
|
||||
| Name | Default | Description |
|
||||
| ---------------- | ------- | ---------------------------------------------------------------------------------- |
|
||||
| `export-env` | `true` | Export the loaded secrets as environment variables |
|
||||
| `unset-previous` | `false` | Whether to unset environment variables populated by 1Password in earlier job steps |
|
||||
|
||||
## Secrets Reference Syntax
|
||||
|
||||
To specify which secret should be loaded into which environment variable, the action will look for `op://` reference URIs in environment variables, and replace those with the actual secret values.
|
||||
|
||||
These reference URIs have the following syntax:
|
||||
|
||||
> `op://<vault>/<item>[/<section>]/<field>`
|
||||
|
||||
So for example, the reference URI `op://app-cicd/aws/secret-access-key` would be interpreted as:
|
||||
|
||||
- **Vault:** `app-cicd`
|
||||
- **Item:** `aws`
|
||||
- **Section:** default section
|
||||
- **Field:** `secret-access-key`
|
||||
|
||||
## Masking
|
||||
|
||||
Similar to regular GitHub repository secrets, fields from 1Password will automatically be masked from the GitHub Actions logs too.
|
||||
So if one of these values accidentally gets printed, it'll get replaced with `***`.
|
||||
|
||||
## 1Password Configuration
|
||||
|
||||
To use the action with Connect, you need to have a [1Password Connect](https://support.1password.com/secrets-automation/#step-1-set-up-a-secrets-automation-workflow) instance deployed somewhere.
|
||||
To configure the action with your Connect host and token, set the `OP_CONNECT_HOST` and `OP_CONNECT_TOKEN` environment variables.
|
||||
|
||||
To configure the action with your service account token <sup>BETA</sup>, set the `OP_SERVICE_ACCOUNT_TOKEN` environment variable.
|
||||
|
||||
If you're using the `load-secrets` action more than once in a single job, you can use the `configure` action to avoid duplicate configuration:
|
||||
|
||||
```yml
|
||||
on: push
|
||||
jobs:
|
||||
hello-world:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
- name: Configure 1Password Connect
|
||||
uses: 1password/load-secrets-action/configure@v1
|
||||
with:
|
||||
connect-host: <Your Connect instance URL>
|
||||
connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
|
||||
- name: Load secret
|
||||
uses: 1password/load-secrets-action@v1
|
||||
env:
|
||||
SECRET: op://app-cicd/hello-world/secret
|
||||
```
|
||||
|
||||
### `configure` Action Inputs
|
||||
|
||||
| Name | Environment variable | Description |
|
||||
| ----------------------- | -------------------------- | -------------------------------------------------------- |
|
||||
| `connect-host` | `OP_CONNECT_HOST` | Your 1Password Connect instance URL |
|
||||
| `connect-token` | `OP_CONNECT_TOKEN` | Token to authenticate to your 1Password Connect instance |
|
||||
| `service-account-token` | `OP_SERVICE_ACCOUNT_TOKEN` | Your 1Password service account token |
|
||||
|
||||
## Supported Runners
|
||||
|
||||
You can run the action on Linux and macOS runners. Windows is currently not supported.
|
||||
|
||||
## Warnings
|
||||
|
||||
If you're using the CLI in your GitHub pipelines and you want to create items with it, the following command will fail:
|
||||
|
||||
```
|
||||
op item create --category=login --title='My Example Item' --vault='Test' \
|
||||
--url https://www.acme.com/login \
|
||||
--generate-password=20,letters,digits \
|
||||
username=jane@acme.com \
|
||||
'Test Field 1=my test secret' \
|
||||
'Test Section 1.Test Field2[text]=Jane Doe' \
|
||||
'Test Section 1.Test Field3[date]=1995-02-23' \
|
||||
'Test Section 2.Test Field4[text]='$myNotes
|
||||
```
|
||||
|
||||
This is caused by the fact that the environment in these pipelines is in piped mode, which triggers the CLI's pipe detection to expect a piped input.
|
||||
To be able to create items in such environments, do the following steps:
|
||||
|
||||
1. Get the template of the item category you want:
|
||||
|
||||
```sh
|
||||
op item template get --out-file=new-item.json <category>
|
||||
```
|
||||
|
||||
2. Edit [the template](https://developer.1password.com/docs/cli/item-template-json) to add your information.
|
||||
3. Pipe the item content to the command:
|
||||
|
||||
```sh
|
||||
cat new-item.json | op item create --vault='Test'
|
||||
```
|
||||
|
||||
## Security
|
||||
|
||||
1Password requests you practice responsible disclosure if you discover a vulnerability.
|
||||
|
||||
Please file requests via [**BugCrowd**](https://bugcrowd.com/agilebits).
|
||||
Please file requests through [BugCrowd](https://bugcrowd.com/agilebits).
|
||||
|
||||
For information about security practices, please visit the [1Password Bug Bounty Program](https://bugcrowd.com/agilebits).
|
||||
For information about our security practices, visit the [1Password Security homepage](https://1password.com/security).
|
||||
|
||||
## Getting help
|
||||
|
||||
If you find yourself stuck, visit our [**Support Page**](https://support.1password.com/) for help.
|
||||
|
||||
@@ -12,5 +12,5 @@ inputs:
|
||||
description: Export the secrets as environment variables
|
||||
default: "true"
|
||||
runs:
|
||||
using: "node20"
|
||||
using: "node16"
|
||||
main: "dist/index.js"
|
||||
|
||||
@@ -11,16 +11,7 @@ const jestConfig = {
|
||||
testEnvironment: "node",
|
||||
testRegex: "(/__tests__/.*|(\\.|/)test)\\.ts",
|
||||
transform: {
|
||||
".ts": [
|
||||
"ts-jest",
|
||||
{
|
||||
// Note: We shouldn't need to include `isolatedModules` here because it's a deprecated config option in TS 5,
|
||||
// but setting it to `true` fixes the `ESM syntax is not allowed in a CommonJS module when
|
||||
// 'verbatimModuleSyntax' is enabled` error that we're seeing when running our Jest tests.
|
||||
isolatedModules: true,
|
||||
useESM: true,
|
||||
},
|
||||
],
|
||||
".ts": ["ts-jest"],
|
||||
},
|
||||
verbose: true,
|
||||
};
|
||||
|
||||
26441
dist/index.js
vendored
26441
dist/index.js
vendored
File diff suppressed because one or more lines are too long
146
entrypoint.sh
Executable file
146
entrypoint.sh
Executable file
@@ -0,0 +1,146 @@
|
||||
#!/bin/bash
|
||||
# shellcheck disable=SC2046,SC2001,SC2086
|
||||
set -e
|
||||
|
||||
# Pass User-Agent Inforomation to the 1Password CLI
|
||||
export OP_INTEGRATION_NAME="1Password GitHub Action"
|
||||
export OP_INTEGRATION_ID="GHA"
|
||||
export OP_INTEGRATION_BUILDNUMBER="1010001"
|
||||
|
||||
readonly CONNECT="CONNECT"
|
||||
readonly SERVICE_ACCOUNT="SERVICE_ACCOUNT"
|
||||
|
||||
auth_type=$CONNECT
|
||||
managed_variables_var="OP_MANAGED_VARIABLES"
|
||||
IFS=','
|
||||
|
||||
if [[ "$OP_CONNECT_HOST" != "http://"* ]] && [[ "$OP_CONNECT_HOST" != "https://"* ]]; then
|
||||
export OP_CONNECT_HOST="http://"$OP_CONNECT_HOST
|
||||
fi
|
||||
|
||||
# Unset all secrets managed by 1Password if `unset-previous` is set.
|
||||
unset_prev_secrets() {
|
||||
if [ "$INPUT_UNSET_PREVIOUS" == "true" ]; then
|
||||
echo "Unsetting previous values..."
|
||||
|
||||
# Find environment variables that are managed by 1Password.
|
||||
for env_var in "${managed_variables[@]}"; do
|
||||
echo "Unsetting $env_var"
|
||||
unset $env_var
|
||||
|
||||
echo "$env_var=" >> $GITHUB_ENV
|
||||
|
||||
# Keep the masks, just in case.
|
||||
done
|
||||
|
||||
managed_variables=()
|
||||
fi
|
||||
}
|
||||
|
||||
# Install op-cli
|
||||
install_op_cli() {
|
||||
OP_INSTALL_DIR="$(mktemp -d)"
|
||||
if [[ ! -d "$OP_INSTALL_DIR" ]]; then
|
||||
echo "Install dir $OP_INSTALL_DIR not found"
|
||||
exit 1
|
||||
fi
|
||||
export OP_INSTALL_DIR
|
||||
echo "::debug::OP_INSTALL_DIR: ${OP_INSTALL_DIR}"
|
||||
if [[ "$OSTYPE" == "linux-gnu"* ]]; then
|
||||
curl -sSfLo op.zip "https://cache.agilebits.com/dist/1P/op2/pkg/v2.10.0-beta.02/op_linux_amd64_v2.10.0-beta.02.zip"
|
||||
unzip -od "$OP_INSTALL_DIR" op.zip && rm op.zip
|
||||
elif [[ "$OSTYPE" == "darwin"* ]]; then
|
||||
curl -sSfLo op.pkg "https://cache.agilebits.com/dist/1P/op2/pkg/v2.10.0-beta.02/op_apple_universal_v2.10.0-beta.02.pkg"
|
||||
pkgutil --expand op.pkg temp-pkg
|
||||
tar -xvf temp-pkg/op.pkg/Payload -C "$OP_INSTALL_DIR"
|
||||
rm -rf temp-pkg && rm op.pkg
|
||||
fi
|
||||
}
|
||||
|
||||
# Uninstall op-cli
|
||||
uninstall_op_cli() {
|
||||
if [[ -d "$OP_INSTALL_DIR" ]]; then
|
||||
rm -fr "$OP_INSTALL_DIR"
|
||||
fi
|
||||
}
|
||||
|
||||
populating_secret() {
|
||||
ref=$(printenv $1)
|
||||
|
||||
echo "Populating variable: $1"
|
||||
secret_value=$("${OP_INSTALL_DIR}/op" read "$ref")
|
||||
|
||||
if [ -z "$secret_value" ]; then
|
||||
echo "Could not find or access secret $ref"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Register a mask for the secret to prevent accidental log exposure.
|
||||
# To support multiline secrets, escape percent signs and add a mask per line.
|
||||
escaped_mask_value=$(echo "$secret_value" | sed -e 's/%/%25/g')
|
||||
IFS=$'\n'
|
||||
for line in $escaped_mask_value; do
|
||||
if [ "${#line}" -lt 3 ]; then
|
||||
# To avoid false positives and unreadable logs, omit mask for lines that are too short.
|
||||
continue
|
||||
fi
|
||||
echo "::add-mask::$line"
|
||||
done
|
||||
unset IFS
|
||||
|
||||
if [ "$INPUT_EXPORT_ENV" == "true" ]; then
|
||||
# To support multiline secrets, we'll use the heredoc syntax to populate the environment variables.
|
||||
# As the heredoc identifier, we'll use a randomly generated 64-character string,
|
||||
# so that collisions are practically impossible.
|
||||
random_heredoc_identifier=$(openssl rand -hex 32)
|
||||
|
||||
{
|
||||
# Populate env var, using heredoc syntax with generated identifier
|
||||
echo "$env_var<<${random_heredoc_identifier}"
|
||||
echo "$secret_value"
|
||||
echo "${random_heredoc_identifier}"
|
||||
} >> $GITHUB_ENV
|
||||
echo "GITHUB_ENV: $(cat $GITHUB_ENV)"
|
||||
|
||||
else
|
||||
# Prepare the secret_value to be outputed properly (especially multiline secrets)
|
||||
secret_value=$(echo "$secret_value" | awk -v ORS='%0A' '1')
|
||||
|
||||
echo "::set-output name=$env_var::$secret_value"
|
||||
fi
|
||||
|
||||
managed_variables+=("$env_var")
|
||||
}
|
||||
|
||||
# Load environment variables using op cli. Iterate over them to find 1Password references, load the secret values,
|
||||
# and make them available as environment variables in the next steps.
|
||||
extract_secrets() {
|
||||
IFS=$'\n'
|
||||
for env_var in $("${OP_INSTALL_DIR}/op" env ls); do
|
||||
populating_secret $env_var
|
||||
done
|
||||
}
|
||||
|
||||
read -r -a managed_variables <<< "$(printenv $managed_variables_var)"
|
||||
|
||||
if [ -z "$OP_CONNECT_TOKEN" ] || [ -z "$OP_CONNECT_HOST" ]; then
|
||||
if [ -z "$OP_SERVICE_ACCOUNT_TOKEN" ]; then
|
||||
echo "(\$OP_CONNECT_TOKEN and \$OP_CONNECT_HOST) or \$OP_SERVICE_ACCOUNT_TOKEN must be set"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
auth_type=$SERVICE_ACCOUNT
|
||||
fi
|
||||
|
||||
printf "Authenticated with %s \n" $auth_type
|
||||
|
||||
unset_prev_secrets
|
||||
install_op_cli
|
||||
extract_secrets
|
||||
uninstall_op_cli
|
||||
|
||||
unset IFS
|
||||
# Add extra env var that lists which secrets are managed by 1Password so that in a later step
|
||||
# these can be unset again.
|
||||
managed_variables_str=$(IFS=','; echo "${managed_variables[*]}")
|
||||
echo "$managed_variables_var=$managed_variables_str" >> $GITHUB_ENV
|
||||
@@ -1,46 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Install op-cli
|
||||
install_op_cli() {
|
||||
# Create a temporary directory where the CLI is installed
|
||||
OP_INSTALL_DIR="$(mktemp -d)"
|
||||
if [[ ! -d "$OP_INSTALL_DIR" ]]; then
|
||||
echo "Install dir $OP_INSTALL_DIR not found"
|
||||
exit 1
|
||||
fi
|
||||
echo "::debug::OP_INSTALL_DIR: ${OP_INSTALL_DIR}"
|
||||
|
||||
# Get the latest stable version of the CLI
|
||||
CLI_VERSION="v$(curl https://app-updates.agilebits.com/check/1/0/CLI2/en/2.0.0/N -s | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+')"
|
||||
|
||||
if [[ "$OSTYPE" == "linux-gnu"* ]]; then
|
||||
# Get runner's architecture
|
||||
ARCH=$(uname -m)
|
||||
if [[ "$(getconf LONG_BIT)" = 32 ]]; then
|
||||
ARCH="386"
|
||||
elif [[ "$ARCH" == "x86_64" ]]; then
|
||||
ARCH="amd64"
|
||||
elif [[ "$ARCH" == "aarch64" ]]; then
|
||||
ARCH="arm64"
|
||||
fi
|
||||
|
||||
if [[ "$ARCH" != "386" ]] && [[ "$ARCH" != "amd64" ]] && [[ "$ARCH" != "arm" ]] && [[ "$ARCH" != "arm64" ]]; then
|
||||
echo "Unsupported architecture for the 1Password CLI: $ARCH."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
curl -sSfLo op.zip "https://cache.agilebits.com/dist/1P/op2/pkg/${CLI_VERSION}/op_linux_${ARCH}_${CLI_VERSION}.zip"
|
||||
unzip -od "$OP_INSTALL_DIR" op.zip && rm op.zip
|
||||
elif [[ "$OSTYPE" == "darwin"* ]]; then
|
||||
curl -sSfLo op.pkg "https://cache.agilebits.com/dist/1P/op2/pkg/${CLI_VERSION}/op_apple_universal_${CLI_VERSION}.pkg"
|
||||
pkgutil --expand op.pkg temp-pkg
|
||||
tar -xvf temp-pkg/op.pkg/Payload -C "$OP_INSTALL_DIR"
|
||||
rm -rf temp-pkg && rm op.pkg
|
||||
else
|
||||
echo "Operating system not supported yet for this GitHub Action: $OSTYPE."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
install_op_cli
|
||||
9597
package-lock.json
generated
9597
package-lock.json
generated
File diff suppressed because it is too large
Load Diff
21
package.json
21
package.json
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "load-secrets-action",
|
||||
"version": "2.0.0",
|
||||
"version": "1.2.0",
|
||||
"description": "Load Secrets from 1Password",
|
||||
"type": "module",
|
||||
"main": "dist/index.js",
|
||||
@@ -39,20 +39,19 @@
|
||||
},
|
||||
"homepage": "https://github.com/1Password/load-secrets-action#readme",
|
||||
"dependencies": {
|
||||
"@1password/op-js": "^0.1.11",
|
||||
"@actions/core": "^1.10.1",
|
||||
"@actions/core": "^1.10.0",
|
||||
"@actions/exec": "^1.1.1"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@1password/front-end-style": "^6.0.1",
|
||||
"@types/jest": "^29.5.12",
|
||||
"@types/node": "^20.11.30",
|
||||
"@vercel/ncc": "^0.38.1",
|
||||
"husky": "^9.0.11",
|
||||
"jest": "^29.7.0",
|
||||
"lint-staged": "^15.2.2",
|
||||
"ts-jest": "^29.1.2",
|
||||
"typescript": "^5.4.2"
|
||||
"@types/jest": "^29.5.0",
|
||||
"@types/node": "^18.15.10",
|
||||
"@vercel/ncc": "^0.36.1",
|
||||
"husky": "^8.0.3",
|
||||
"jest": "^29.5.0",
|
||||
"lint-staged": "^13.2.0",
|
||||
"ts-jest": "^29.0.5",
|
||||
"typescript": "^4.9.5"
|
||||
},
|
||||
"eslintConfig": {
|
||||
"extends": "./node_modules/@1password/front-end-style/eslintrc.yml",
|
||||
|
||||
@@ -1,6 +0,0 @@
|
||||
export const envConnectHost = "OP_CONNECT_HOST";
|
||||
export const envConnectToken = "OP_CONNECT_TOKEN";
|
||||
export const envServiceAccountToken = "OP_SERVICE_ACCOUNT_TOKEN";
|
||||
export const envManagedVariables = "OP_MANAGED_VARIABLES";
|
||||
|
||||
export const authErr = `Authentication error with environment variables: you must set either 1) ${envServiceAccountToken}, or 2) both ${envConnectHost} and ${envConnectToken}.`;
|
||||
55
src/index.ts
55
src/index.ts
@@ -2,28 +2,19 @@ import path from "path";
|
||||
import url from "url";
|
||||
import * as core from "@actions/core";
|
||||
import * as exec from "@actions/exec";
|
||||
import { validateCli } from "@1password/op-js";
|
||||
import { loadSecrets, unsetPrevious, validateAuth } from "./utils";
|
||||
|
||||
const loadSecretsAction = async () => {
|
||||
const run = async () => {
|
||||
try {
|
||||
const currentFile = url.fileURLToPath(import.meta.url);
|
||||
const currentDir = path.dirname(currentFile);
|
||||
const parentDir = path.resolve(currentDir, "..");
|
||||
|
||||
// Get action inputs
|
||||
const shouldUnsetPrevious = core.getBooleanInput("unset-previous");
|
||||
const shouldExportEnv = core.getBooleanInput("export-env");
|
||||
process.env.INPUT_UNSET_PREVIOUS = core.getInput("unset-previous");
|
||||
process.env.INPUT_EXPORT_ENV = core.getInput("export-env");
|
||||
|
||||
// Unset all secrets managed by 1Password if `unset-previous` is set.
|
||||
if (shouldUnsetPrevious) {
|
||||
unsetPrevious();
|
||||
}
|
||||
|
||||
// Validate that a proper authentication configuration is set for the CLI
|
||||
validateAuth();
|
||||
|
||||
// Download and install the CLI
|
||||
await installCLI();
|
||||
|
||||
// Load secrets
|
||||
await loadSecrets(shouldExportEnv);
|
||||
// Execute bash script
|
||||
await exec.exec(`sh -c "` + parentDir + `/entrypoint.sh"`);
|
||||
} catch (error) {
|
||||
// It's possible for the Error constructor to be modified to be anything
|
||||
// in JavaScript, so the following code accounts for this possibility.
|
||||
@@ -38,30 +29,4 @@ const loadSecretsAction = async () => {
|
||||
}
|
||||
};
|
||||
|
||||
// This function's name is an exception from the naming convention
|
||||
// since we refer to the 1Password CLI here.
|
||||
// eslint-disable-next-line @typescript-eslint/naming-convention
|
||||
const installCLI = async (): Promise<void> => {
|
||||
// validateCli checks if there's an existing 1Password CLI installed on the runner.
|
||||
// If there's no CLI installed, then validateCli will throw an error, which we will use
|
||||
// as an indicator that we need to execute the installation script.
|
||||
await validateCli().catch(async () => {
|
||||
const currentFile = url.fileURLToPath(import.meta.url);
|
||||
const currentDir = path.dirname(currentFile);
|
||||
const parentDir = path.resolve(currentDir, "..");
|
||||
|
||||
// Execute bash script
|
||||
const cmdOut = await exec.getExecOutput(
|
||||
`sh -c "` + parentDir + `/install_cli.sh"`,
|
||||
);
|
||||
|
||||
// Add path to 1Password CLI to $PATH
|
||||
const outArr = cmdOut.stdout.split("\n");
|
||||
if (outArr[0] && process.env.PATH) {
|
||||
const cliPath = outArr[0]?.replace(/^(::debug::OP_INSTALL_DIR: )/, "");
|
||||
core.addPath(cliPath);
|
||||
}
|
||||
});
|
||||
};
|
||||
|
||||
void loadSecretsAction();
|
||||
void run();
|
||||
|
||||
@@ -1,164 +0,0 @@
|
||||
import * as core from "@actions/core";
|
||||
import * as exec from "@actions/exec";
|
||||
import { read, setClientInfo } from "@1password/op-js";
|
||||
import {
|
||||
extractSecret,
|
||||
loadSecrets,
|
||||
unsetPrevious,
|
||||
validateAuth,
|
||||
} from "./utils";
|
||||
import {
|
||||
authErr,
|
||||
envConnectHost,
|
||||
envConnectToken,
|
||||
envManagedVariables,
|
||||
envServiceAccountToken,
|
||||
} from "./constants";
|
||||
|
||||
jest.mock("@actions/core");
|
||||
jest.mock("@actions/exec", () => ({
|
||||
getExecOutput: jest.fn(() => ({
|
||||
stdout: "MOCK_SECRET",
|
||||
})),
|
||||
}));
|
||||
jest.mock("@1password/op-js");
|
||||
|
||||
beforeEach(() => {
|
||||
jest.clearAllMocks();
|
||||
});
|
||||
|
||||
describe("validateAuth", () => {
|
||||
const testConnectHost = "https://localhost:8000";
|
||||
const testConnectToken = "token";
|
||||
const testServiceAccountToken = "ops_token";
|
||||
|
||||
beforeEach(() => {
|
||||
process.env[envConnectHost] = "";
|
||||
process.env[envConnectToken] = "";
|
||||
process.env[envServiceAccountToken] = "";
|
||||
});
|
||||
|
||||
it("should throw an error when no config is provided", () => {
|
||||
expect(validateAuth).toThrowError(authErr);
|
||||
});
|
||||
|
||||
it("should throw an error when partial Connect config is provided", () => {
|
||||
process.env[envConnectHost] = testConnectHost;
|
||||
expect(validateAuth).toThrowError(authErr);
|
||||
});
|
||||
|
||||
it("should be authenticated as a Connect client", () => {
|
||||
process.env[envConnectHost] = testConnectHost;
|
||||
process.env[envConnectToken] = testConnectToken;
|
||||
expect(validateAuth).not.toThrowError(authErr);
|
||||
expect(core.info).toHaveBeenCalledWith("Authenticated with Connect.");
|
||||
});
|
||||
|
||||
it("should be authenticated as a service account", () => {
|
||||
process.env[envServiceAccountToken] = testServiceAccountToken;
|
||||
expect(validateAuth).not.toThrowError(authErr);
|
||||
expect(core.info).toHaveBeenCalledWith(
|
||||
"Authenticated with Service account.",
|
||||
);
|
||||
});
|
||||
|
||||
it("should prioritize Connect over service account if both are configured", () => {
|
||||
process.env[envServiceAccountToken] = testServiceAccountToken;
|
||||
process.env[envConnectHost] = testConnectHost;
|
||||
process.env[envConnectToken] = testConnectToken;
|
||||
expect(validateAuth).not.toThrowError(authErr);
|
||||
expect(core.warning).toHaveBeenCalled();
|
||||
expect(core.info).toHaveBeenCalledWith("Authenticated with Connect.");
|
||||
});
|
||||
});
|
||||
|
||||
describe("extractSecret", () => {
|
||||
const envTestSecretEnv = "TEST_SECRET";
|
||||
const testSecretRef = "op://vault/item/secret";
|
||||
const testSecretValue = "Secret1@3$";
|
||||
|
||||
read.parse = jest.fn().mockReturnValue(testSecretValue);
|
||||
|
||||
process.env[envTestSecretEnv] = testSecretRef;
|
||||
|
||||
it("should set secret as step output", () => {
|
||||
extractSecret(envTestSecretEnv, false);
|
||||
expect(core.exportVariable).not.toHaveBeenCalledWith(
|
||||
envTestSecretEnv,
|
||||
testSecretValue,
|
||||
);
|
||||
expect(core.setOutput).toHaveBeenCalledWith(
|
||||
envTestSecretEnv,
|
||||
testSecretValue,
|
||||
);
|
||||
expect(core.setSecret).toHaveBeenCalledWith(testSecretValue);
|
||||
});
|
||||
|
||||
it("should set secret as environment variable", () => {
|
||||
extractSecret(envTestSecretEnv, true);
|
||||
expect(core.exportVariable).toHaveBeenCalledWith(
|
||||
envTestSecretEnv,
|
||||
testSecretValue,
|
||||
);
|
||||
expect(core.setOutput).not.toHaveBeenCalledWith(
|
||||
envTestSecretEnv,
|
||||
testSecretValue,
|
||||
);
|
||||
expect(core.setSecret).toHaveBeenCalledWith(testSecretValue);
|
||||
});
|
||||
});
|
||||
|
||||
describe("loadSecrets", () => {
|
||||
it("sets the client info and gets the executed output", async () => {
|
||||
await loadSecrets(true);
|
||||
|
||||
expect(setClientInfo).toHaveBeenCalledWith({
|
||||
name: "1Password GitHub Action",
|
||||
id: "GHA",
|
||||
});
|
||||
expect(exec.getExecOutput).toHaveBeenCalledWith('sh -c "op env ls"');
|
||||
expect(core.exportVariable).toHaveBeenCalledWith(
|
||||
"OP_MANAGED_VARIABLES",
|
||||
"MOCK_SECRET",
|
||||
);
|
||||
});
|
||||
|
||||
it("return early if no env vars with secrets found", async () => {
|
||||
(exec.getExecOutput as jest.Mock).mockReturnValueOnce({ stdout: "" });
|
||||
await loadSecrets(true);
|
||||
|
||||
expect(exec.getExecOutput).toHaveBeenCalledWith('sh -c "op env ls"');
|
||||
expect(core.exportVariable).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
describe("core.exportVariable", () => {
|
||||
it("is called when shouldExportEnv is true", async () => {
|
||||
await loadSecrets(true);
|
||||
|
||||
expect(core.exportVariable).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("is not called when shouldExportEnv is false", async () => {
|
||||
await loadSecrets(false);
|
||||
|
||||
expect(core.exportVariable).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe("unsetPrevious", () => {
|
||||
const testManagedEnv = "TEST_SECRET";
|
||||
const testSecretValue = "MyS3cr#T";
|
||||
|
||||
beforeEach(() => {
|
||||
process.env[testManagedEnv] = testSecretValue;
|
||||
process.env[envManagedVariables] = testManagedEnv;
|
||||
});
|
||||
|
||||
it("should unset the environment variable if user wants it", () => {
|
||||
unsetPrevious();
|
||||
expect(core.info).toHaveBeenCalledWith("Unsetting previous values ...");
|
||||
expect(core.info).toHaveBeenCalledWith("Unsetting TEST_SECRET");
|
||||
expect(core.exportVariable).toHaveBeenCalledWith("TEST_SECRET", "");
|
||||
});
|
||||
});
|
||||
91
src/utils.ts
91
src/utils.ts
@@ -1,91 +0,0 @@
|
||||
import * as core from "@actions/core";
|
||||
import * as exec from "@actions/exec";
|
||||
import { read, setClientInfo, semverToInt } from "@1password/op-js";
|
||||
import { version } from "../package.json";
|
||||
import {
|
||||
authErr,
|
||||
envConnectHost,
|
||||
envConnectToken,
|
||||
envServiceAccountToken,
|
||||
envManagedVariables,
|
||||
} from "./constants";
|
||||
|
||||
export const validateAuth = (): void => {
|
||||
const isConnect = process.env[envConnectHost] && process.env[envConnectToken];
|
||||
const isServiceAccount = process.env[envServiceAccountToken];
|
||||
|
||||
if (isConnect && isServiceAccount) {
|
||||
core.warning(
|
||||
"WARNING: Both service account and Connect credentials are provided. Connect credentials will take priority.",
|
||||
);
|
||||
}
|
||||
|
||||
if (!isConnect && !isServiceAccount) {
|
||||
throw new Error(authErr);
|
||||
}
|
||||
|
||||
const authType = isConnect ? "Connect" : "Service account";
|
||||
|
||||
core.info(`Authenticated with ${authType}.`);
|
||||
};
|
||||
|
||||
export const extractSecret = (
|
||||
envName: string,
|
||||
shouldExportEnv: boolean,
|
||||
): void => {
|
||||
core.info(`Populating variable: ${envName}`);
|
||||
|
||||
const ref = process.env[envName];
|
||||
if (!ref) {
|
||||
return;
|
||||
}
|
||||
|
||||
const secretValue = read.parse(ref);
|
||||
if (!secretValue) {
|
||||
return;
|
||||
}
|
||||
|
||||
if (shouldExportEnv) {
|
||||
core.exportVariable(envName, secretValue);
|
||||
} else {
|
||||
core.setOutput(envName, secretValue);
|
||||
}
|
||||
core.setSecret(secretValue);
|
||||
};
|
||||
|
||||
export const loadSecrets = async (shouldExportEnv: boolean): Promise<void> => {
|
||||
// Pass User-Agent Information to the 1Password CLI
|
||||
setClientInfo({
|
||||
name: "1Password GitHub Action",
|
||||
id: "GHA",
|
||||
build: semverToInt(version),
|
||||
});
|
||||
|
||||
// Load secrets from environment variables using 1Password CLI.
|
||||
// Iterate over them to find 1Password references, extract the secret values,
|
||||
// and make them available in the next steps either as step outputs or as environment variables.
|
||||
const res = await exec.getExecOutput(`sh -c "op env ls"`);
|
||||
|
||||
if (res.stdout === "") {
|
||||
return;
|
||||
}
|
||||
|
||||
const envs = res.stdout.replace(/\n+$/g, "").split(/\r?\n/);
|
||||
for (const envName of envs) {
|
||||
extractSecret(envName, shouldExportEnv);
|
||||
}
|
||||
if (shouldExportEnv) {
|
||||
core.exportVariable(envManagedVariables, envs.join());
|
||||
}
|
||||
};
|
||||
|
||||
export const unsetPrevious = (): void => {
|
||||
if (process.env[envManagedVariables]) {
|
||||
core.info("Unsetting previous values ...");
|
||||
const managedEnvs = process.env[envManagedVariables].split(",");
|
||||
for (const envName of managedEnvs) {
|
||||
core.info(`Unsetting ${envName}`);
|
||||
core.exportVariable(envName, "");
|
||||
}
|
||||
}
|
||||
};
|
||||
@@ -6,6 +6,8 @@
|
||||
"esModuleInterop": true,
|
||||
"exactOptionalPropertyTypes": true,
|
||||
"forceConsistentCasingInFileNames": true,
|
||||
"importsNotUsedAsValues": "error",
|
||||
"isolatedModules": true,
|
||||
"module": "esnext",
|
||||
"moduleResolution": "node",
|
||||
"noEmit": true,
|
||||
@@ -15,9 +17,9 @@
|
||||
"noUncheckedIndexedAccess": true,
|
||||
"noUnusedLocals": true,
|
||||
"noUnusedParameters": true,
|
||||
"resolveJsonModule": true,
|
||||
"outDir": "./dist/",
|
||||
"rootDir": "./src/",
|
||||
"strict": true,
|
||||
"target": "es2022",
|
||||
"verbatimModuleSyntax": true
|
||||
"target": "es2022"
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user