Merge branch 'main' into fix/changes-env-file-handling

Reviewed-on: #2

README.md

@@ -1 +1,91 @@
-# Warden
+# Auth Warden
+
+A Gitea Action for authenticating with Bitwarden and retrieving dynamic secrets for use in CI/CD workflows.
+
+## Overview
+
+Auth Warden provides a secure way to authenticate with a Bitwarden server and dynamically retrieve secrets stored as secure notes, making them available as environment variables in your Gitea Actions workflow.
+
+## Usage
+
+```yaml
+- name: Retrieve secrets from Bitwarden
+  uses: https://git.qlic.nl/actions/warden@v1
+  with:
+    password: ${{ secrets.BITWARDEN_PASSWORD }}
+    server: https://your-bitwarden-server.com
+    client-id: ${{ secrets.BITWARDEN_CLIENT_ID }}
+    client-secret: ${{ secrets.BITWARDEN_CLIENT_SECRET }}
+    secrets: |
+      secret-id-1 > DATABASE_URL
+      secret-id-2 > API_KEY
+      secret-id-3 > WEBHOOK_SECRET
+```
+
+## Inputs
+
+| Input           | Description                                             | Required | Default                  |
+|-----------------|---------------------------------------------------------|----------|--------------------------|
+| `password`      | Bitwarden account password                              | Yes      | -                        |
+| `server`        | Bitwarden server URL                                    | No       | `${{ vars.WARDEN_URL }}` |
+| `client-id`     | Bitwarden API client ID                                 | Yes      | -                        |
+| `client-secret` | Bitwarden API client secret                             | Yes      | -                        |
+| `secrets`       | List of secret mappings (format: `SECRET_ID > ENV_VAR`) | Yes      | -                        |
+
+## Secret Mapping Format
+
+The `secrets` input expects a multiline string where each line contains a mapping in the format:
+
+```
+SECRET_ID > ENVIRONMENT_VARIABLE_NAME
+```
+
+- `SECRET_ID`: The ID of the secure note in Bitwarden
+- `ENVIRONMENT_VARIABLE_NAME`: The name of the environment variable to create
+
+Example:
+```yaml
+secrets: |
+  db-connection-string > DATABASE_URL
+  stripe-api-key > STRIPE_API_KEY
+  jwt-secret > JWT_SECRET
+```
+
+## Prerequisites
+
+- Bitwarden CLI must be available in the runner environment
+- Valid Bitwarden account with API access configured
+- Secrets must be stored as secure notes in Bitwarden
+
+## Security Considerations
+
+- Store all sensitive inputs (password, client-id, client-secret) as Gitea repository secrets
+
+## Example Workflow
+
+```yaml
+name: Deploy Application
+on: [push]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Retrieve secrets
+        uses: https://git.qlic.nl/actions/warden@v1
+        with:
+          password: ${{ secrets.BITWARDEN_PASSWORD }}
+          client-id: ${{ secrets.BITWARDEN_CLIENT_ID }}
+          client-secret: ${{ secrets.BITWARDEN_CLIENT_SECRET }}
+          secrets: |
+            database-url > DATABASE_URL
+            api-key > API_KEY
+      
+      - name: Deploy
+        run: |
+          echo "Database URL is available as: $DATABASE_URL"
+          echo "API Key is available as: $API_KEY"
+          # Your deployment commands here
+```

action.yml

@@ -3,9 +3,6 @@ description: Authenticate with Bitwarden and retrieve dynamic secrets
 author: Jamie Schouten
 
 inputs:
-  email:
-    description: "Bitwarden email"
-    required: true
   password:
     description: "Bitwarden password"
     required: true
@@ -22,6 +19,9 @@ inputs:
   secrets:
     description: "List of secret IDs and corresponding environment variable names (format: 'SECRET_ID > ENV_VAR')"
     required: true
+  dot-env-path:
+    description: "Path to write the DOT_ENV secret to instead of exporting it via GITHUB_ENV"
+    required: true
 
 runs:
   using: "composite"
@@ -30,19 +30,15 @@ runs:
       shell: sh
       run: bw config server "${{ inputs.server }}"
 
-    - name: Unlock Vault
+    - name: Unlock vault and retrieve secrets
       shell: sh
-      run: |
-         bw login --apikey
-         BW_SESSION=$(bw unlock '${{ inputs.password }}' --raw)
-         echo "BW_SESSION=$BW_SESSION" >> $GITHUB_ENV
       env:
         BW_CLIENTID: "${{ inputs.client-id }}"
         BW_CLIENTSECRET: "${{ inputs.client-secret }}"
-
-    - name: Retrieve Secrets
-      shell: sh
       run: |
+        bw login --apikey
+        BW_SESSION=$(bw unlock '${{ inputs.password }}' --raw)
+
         echo "${{ inputs.secrets }}" | while IFS='>' read SECRET_ID ENV_VAR; do
           SECRET_ID=$(echo "$SECRET_ID" | sed 's/^ *//;s/ *$//')
           ENV_VAR=$(echo "$ENV_VAR" | sed 's/^ *//;s/ *$//')
@@ -55,11 +51,17 @@ runs:
           SECRET_VALUE=$(bw get notes "$SECRET_ID" --session "$BW_SESSION" --raw 2>/dev/null)
 
           if [ -n "$SECRET_VALUE" ]; then
-            echo "$ENV_VAR<<EOF" >> $GITHUB_ENV
-            echo "$SECRET_VALUE" >> $GITHUB_ENV
-            echo "EOF" >> $GITHUB_ENV
-            echo "Stored $SECRET_ID in $ENV_VAR"
+            if [ "$ENV_VAR" = "DOT_ENV" ]; then
+              mkdir -p "$(dirname "${{ inputs.dot-env-path }}")"
+              umask 077
+              printf '%s\n' "$SECRET_VALUE" > "${{ inputs.dot-env-path }}"
+              echo "Stored $ENV_VAR file"
             else
-            echo "Failed to retrieve secret: $SECRET_ID"
+              echo "Unsupported ENV_VAR: $ENV_VAR"
+              exit 1
+            fi
+          else
+            echo "Failed to retrieve requested secret"
+            exit 1
           fi
         done