79 lines
2.2 KiB
YAML
79 lines
2.2 KiB
YAML
name: Auth Warden
|
|
description: Authenticate with Bitwarden and retrieve dynamic secrets
|
|
author: Jamie Schouten
|
|
|
|
inputs:
|
|
email:
|
|
description: 'Bitwarden email'
|
|
required: true
|
|
password:
|
|
description: 'Bitwarden password'
|
|
required: true
|
|
server:
|
|
description: 'Bitwarden server'
|
|
required: false
|
|
default: ${{ vars.WARDEN_URL }}
|
|
client-id:
|
|
description: 'Bitwarden client id'
|
|
required: true
|
|
client-secret:
|
|
description: 'Bitwarden client secret'
|
|
required: true
|
|
secrets:
|
|
description: "One or more secret Ids to retrieve and the corresponding Gitea environment variable name to set"
|
|
required: true
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: Configure Bitwarden Server
|
|
shell: sh
|
|
run: bw config server ${{ inputs.server }}
|
|
|
|
- name: Unlock Vault
|
|
shell: sh
|
|
run: |
|
|
# Ensure Bitwarden is logged in
|
|
if ! bw login --check; then
|
|
bw login --apikey
|
|
fi
|
|
|
|
# Unlock the vault and store the session key
|
|
BW_SESSION=$(bw unlock "${{ inputs.password }}" --raw)
|
|
|
|
# Verify if BW_SESSION is set correctly
|
|
if [ -n "$BW_SESSION" ]; then
|
|
echo "BW_SESSION=$BW_SESSION" >> "$GITHUB_ENV"
|
|
export BW_SESSION
|
|
echo "✅ Vault unlocked successfully!"
|
|
else
|
|
echo "❌ Failed to unlock Bitwarden vault"
|
|
exit 1
|
|
fi
|
|
env:
|
|
BW_CLIENTID: ${{ inputs.client-id }}
|
|
BW_CLIENTSECRET: ${{ inputs.client-secret }}
|
|
|
|
- name: Retrieve Requested Secrets
|
|
shell: sh
|
|
run: |
|
|
OLDIFS=$IFS
|
|
IFS=','
|
|
set -- ${{ inputs.secrets }}
|
|
IFS=$OLDIFS
|
|
|
|
for pair in "$@"; do
|
|
SECRET_ID=$(echo "$pair" | cut -d'=' -f1)
|
|
ENV_VAR=$(echo "$pair" | cut -d'=' -f2)
|
|
|
|
echo "Retrieving secret: $SECRET_ID..."
|
|
SECRET_VALUE=$(bw get notes "$SECRET_ID" --session "$BW_SESSION")
|
|
|
|
if [ -n "$SECRET_VALUE" ]; then
|
|
echo "$ENV_VAR=$SECRET_VALUE" >> "$GITHUB_ENV"
|
|
echo "✅ Stored $SECRET_ID in $ENV_VAR"
|
|
else
|
|
echo "❌ Failed to retrieve secret: $SECRET_ID"
|
|
fi
|
|
done
|