Add readme

README.md

@@ -10,7 +10,7 @@ Auth Warden provides a secure way to authenticate with a Bitwarden server and dy
 
 ```yaml
 - name: Retrieve secrets from Bitwarden
-  uses: https://git.qlic.nl/actions/warden@v1
+  uses: ./path/to/auth-warden
   with:
     password: ${{ secrets.BITWARDEN_PASSWORD }}
     server: https://your-bitwarden-server.com
@@ -59,7 +59,10 @@ secrets: |
 
 ## Security Considerations
 
-- Store all sensitive inputs (password, client-id, client-secret) as Gitea repository secrets
+- Store all sensitive inputs (email, password, client-id, client-secret) as Gitea repository secrets
+- Use organization or repository variables for the server URL if it's not sensitive
+- The action automatically handles session management and cleanup
+- Retrieved secrets are securely added to the Gitea Actions environment
 
 ## Example Workflow
 

action.yml

@@ -19,9 +19,6 @@ inputs:
   secrets:
     description: "List of secret IDs and corresponding environment variable names (format: 'SECRET_ID > ENV_VAR')"
     required: true
-  dot-env-path:
-    description: "Path to write the DOT_ENV secret to instead of exporting it via GITHUB_ENV"
-    required: true
 
 runs:
   using: "composite"
@@ -30,15 +27,19 @@ runs:
       shell: sh
       run: bw config server "${{ inputs.server }}"
 
-    - name: Unlock vault and retrieve secrets
+    - name: Unlock Vault
       shell: sh
+      run: |
+         bw login --apikey
+         BW_SESSION=$(bw unlock '${{ inputs.password }}' --raw)
+         echo "BW_SESSION=$BW_SESSION" >> $GITHUB_ENV
       env:
         BW_CLIENTID: "${{ inputs.client-id }}"
         BW_CLIENTSECRET: "${{ inputs.client-secret }}"
-      run: |
-        bw login --apikey
-        BW_SESSION=$(bw unlock '${{ inputs.password }}' --raw)
 
+    - name: Retrieve Secrets
+      shell: sh
+      run: |
         echo "${{ inputs.secrets }}" | while IFS='>' read SECRET_ID ENV_VAR; do
           SECRET_ID=$(echo "$SECRET_ID" | sed 's/^ *//;s/ *$//')
           ENV_VAR=$(echo "$ENV_VAR" | sed 's/^ *//;s/ *$//')
@@ -51,17 +52,11 @@ runs:
           SECRET_VALUE=$(bw get notes "$SECRET_ID" --session "$BW_SESSION" --raw 2>/dev/null)
 
           if [ -n "$SECRET_VALUE" ]; then
-            if [ "$ENV_VAR" = "DOT_ENV" ]; then
+            echo "$ENV_VAR<<EOF" >> $GITHUB_ENV
-              mkdir -p "$(dirname "${{ inputs.dot-env-path }}")"
+            echo "$SECRET_VALUE" >> $GITHUB_ENV
-              umask 077
+            echo "EOF" >> $GITHUB_ENV
-              printf '%s\n' "$SECRET_VALUE" > "${{ inputs.dot-env-path }}"
+            echo "Stored $SECRET_ID in $ENV_VAR"
-              echo "Stored $ENV_VAR file"
-            else
-              echo "Unsupported ENV_VAR: $ENV_VAR"
-              exit 1
-            fi
           else
-            echo "Failed to retrieve requested secret"
+            echo "Failed to retrieve secret: $SECRET_ID"
-            exit 1
           fi
         done