action.yml

@@ -24,8 +24,7 @@ inputs:
     required: true
   dot-env-path:
     description: "Path to write the DOT_ENV secret to instead of exporting it via GITHUB_ENV"
-    required: false
+    required: true
-    default: ""
 
 runs:
   using: "composite"
@@ -55,22 +54,21 @@ runs:
             continue
           fi
 
-          echo "🔍 Retrieving secret: $SECRET_ID"
+          echo "🔍 Retrieving secret"
           SECRET_VALUE=$(bw get notes "$SECRET_ID" --session "$BW_SESSION" --raw 2>/dev/null)
 
           if [ -n "$SECRET_VALUE" ]; then
-            if [ "$ENV_VAR" = "DOT_ENV" ] && [ -n "${{ inputs.dot-env-path }}" ]; then
+            if [ "$ENV_VAR" = "DOT_ENV" ]; then
               mkdir -p "$(dirname "${{ inputs.dot-env-path }}")"
               umask 077
               printf '%s\n' "$SECRET_VALUE" > "${{ inputs.dot-env-path }}"
-              echo "Stored $SECRET_ID in $ENV_VAR file"
+              echo "Stored $ENV_VAR file"
             else
-              echo "$ENV_VAR<<EOF" >> $GITHUB_ENV
+              echo "Unsupported ENV_VAR: $ENV_VAR"
-              echo "$SECRET_VALUE" >> $GITHUB_ENV
+              exit 1
-              echo "EOF" >> $GITHUB_ENV
-              echo "Stored $SECRET_ID in $ENV_VAR"
             fi
           else
-            echo "Failed to retrieve secret: $SECRET_ID"
+            echo "Failed to retrieve requested secret"
+            exit 1
           fi
         done