add secrets #1
1
.gitignore
vendored
1
.gitignore
vendored
@ -1 +0,0 @@
|
||||
/node_modules
|
||||
49
action.yml
49
action.yml
@ -33,32 +33,33 @@ runs:
|
||||
- name: Unlock Vault
|
||||
shell: sh
|
||||
run: |
|
||||
# Ensure Bitwarden is logged in
|
||||
if ! bw login --check; then
|
||||
bw login --apikey
|
||||
fi
|
||||
|
||||
# Unlock the vault and store the session key
|
||||
BW_SESSION=$(bw unlock "${{ inputs.password }}" --raw)
|
||||
|
||||
# Verify if BW_SESSION is set correctly
|
||||
if [ -n "$BW_SESSION" ]; then
|
||||
echo "BW_SESSION=$BW_SESSION" >> "$GITHUB_ENV"
|
||||
export BW_SESSION
|
||||
echo "✅ Vault unlocked successfully!"
|
||||
else
|
||||
echo "❌ Failed to unlock Bitwarden vault"
|
||||
exit 1
|
||||
fi
|
||||
bw login --apikey
|
||||
echo "BW_SESSION=$(bw unlock '${{ inputs.password }}' --raw)" >> $GITHUB_ENV
|
||||
env:
|
||||
BW_CLIENTID: ${{ inputs.client-id }}
|
||||
BW_CLIENTSECRET: ${{ inputs.client-secret }}
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: '20'
|
||||
|
||||
- name: Retrieve Requested Secrets
|
||||
shell: sh
|
||||
run: node retrieveSecrets.js
|
||||
shell: bash
|
||||
run: |
|
||||
IFS=$'\n' read -d '' -r -a secret_pairs <<< "${{ inputs.secrets }}"
|
||||
|
||||
for pair in "${secret_pairs[@]}"; do
|
||||
SECRET_ID=$(echo "$pair" | cut -d'>' -f1 | xargs)
|
||||
ENV_VAR=$(echo "$pair" | cut -d'>' -f2 | xargs)
|
||||
|
||||
if [[ -z "$SECRET_ID" || -z "$ENV_VAR" ]]; then
|
||||
echo "❌ Invalid secret pair format: $pair"
|
||||
continue
|
||||
fi
|
||||
|
||||
echo "🔍 Retrieving secret: $SECRET_ID..."
|
||||
SECRET_VALUE=$(bw get notes "$SECRET_ID" --session "$BW_SESSION" 2>/dev/null)
|
||||
|
||||
if [[ -n "$SECRET_VALUE" ]]; then
|
||||
echo "$ENV_VAR=$SECRET_VALUE" >> "$GITHUB_ENV"
|
||||
echo "✅ Stored $SECRET_ID in $ENV_VAR"
|
||||
else
|
||||
echo "❌ Failed to retrieve secret: $SECRET_ID"
|
||||
fi
|
||||
done
|
||||
70
package-lock.json
generated
70
package-lock.json
generated
@ -1,70 +0,0 @@
|
||||
{
|
||||
"name": "warden",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"dependencies": {
|
||||
"@actions/core": "^1.11.1"
|
||||
}
|
||||
},
|
||||
"node_modules/@actions/core": {
|
||||
"version": "1.11.1",
|
||||
"resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
|
||||
"integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
|
||||
"dependencies": {
|
||||
"@actions/exec": "^1.1.1",
|
||||
"@actions/http-client": "^2.0.1"
|
||||
}
|
||||
},
|
||||
"node_modules/@actions/exec": {
|
||||
"version": "1.1.1",
|
||||
"resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
|
||||
"integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
|
||||
"dependencies": {
|
||||
"@actions/io": "^1.0.1"
|
||||
}
|
||||
},
|
||||
"node_modules/@actions/http-client": {
|
||||
"version": "2.2.3",
|
||||
"resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
|
||||
"integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
|
||||
"dependencies": {
|
||||
"tunnel": "^0.0.6",
|
||||
"undici": "^5.25.4"
|
||||
}
|
||||
},
|
||||
"node_modules/@actions/io": {
|
||||
"version": "1.1.3",
|
||||
"resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
|
||||
"integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="
|
||||
},
|
||||
"node_modules/@fastify/busboy": {
|
||||
"version": "2.1.1",
|
||||
"resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
|
||||
"integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
|
||||
"engines": {
|
||||
"node": ">=14"
|
||||
}
|
||||
},
|
||||
"node_modules/tunnel": {
|
||||
"version": "0.0.6",
|
||||
"resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
|
||||
"integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==",
|
||||
"engines": {
|
||||
"node": ">=0.6.11 <=0.7.0 || >=0.7.3"
|
||||
}
|
||||
},
|
||||
"node_modules/undici": {
|
||||
"version": "5.28.5",
|
||||
"resolved": "https://registry.npmjs.org/undici/-/undici-5.28.5.tgz",
|
||||
"integrity": "sha512-zICwjrDrcrUE0pyyJc1I2QzBkLM8FINsgOrt6WjA+BgajVq9Nxu2PbFFXUrAggLfDXlZGZBVZYw7WNV5KiBiBA==",
|
||||
"dependencies": {
|
||||
"@fastify/busboy": "^2.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=14.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,5 +0,0 @@
|
||||
{
|
||||
"dependencies": {
|
||||
"@actions/core": "^1.11.1"
|
||||
}
|
||||
}
|
||||
@ -1,53 +0,0 @@
|
||||
import * as core from "@actions/core";
|
||||
import { execSync } from "child_process";
|
||||
|
||||
function getSecrets() {
|
||||
try {
|
||||
const secretsRaw = core.getInput("secrets", { required: true });
|
||||
const sessionKey = process.env.BW_SESSION;
|
||||
|
||||
if (!sessionKey) {
|
||||
throw new Error("BW_SESSION is not set. Make sure Bitwarden is unlocked.");
|
||||
}
|
||||
|
||||
// Secrets parsen naar een array van { id, name }
|
||||
const secrets = secretsRaw
|
||||
.split("\n")
|
||||
.map((s) => s.trim())
|
||||
.filter((s) => s.includes(">"))
|
||||
.map((s) => {
|
||||
const [id, name] = s.split(">").map((part) => part.trim());
|
||||
return { id, name };
|
||||
});
|
||||
|
||||
if (secrets.length === 0) {
|
||||
throw new Error("No valid secrets provided.");
|
||||
}
|
||||
|
||||
core.info(`🔍 Retrieving ${secrets.length} secrets from Bitwarden...`);
|
||||
|
||||
secrets.forEach(({ id, name }) => {
|
||||
try {
|
||||
const value = execSync(`bw get notes ${id} --session ${sessionKey}`, {
|
||||
encoding: "utf-8",
|
||||
}).trim();
|
||||
|
||||
if (value) {
|
||||
core.exportVariable(name, value);
|
||||
core.setSecret(value); // Verberg secret in logs
|
||||
core.info(`✅ Stored secret ${id} as ${name}`);
|
||||
} else {
|
||||
core.warning(`⚠️ No value found for secret: ${id}`);
|
||||
}
|
||||
} catch (error) {
|
||||
core.warning(`❌ Failed to retrieve secret: ${id} - ${error.message}`);
|
||||
}
|
||||
});
|
||||
|
||||
core.info("✅ All secrets retrieved successfully!");
|
||||
} catch (error) {
|
||||
core.setFailed(`❌ Error retrieving secrets: ${error.message}`);
|
||||
}
|
||||
}
|
||||
|
||||
getSecrets();
|
||||
Loading…
x
Reference in New Issue
Block a user