mirror of
https://github.com/hashicorp/vault-action.git
synced 2026-07-26 00:13:16 +03:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Nicholas Farley
|
7b8899915e |
@@ -3,29 +3,21 @@ name: Bug report
|
||||
about: Create a report to help us improve
|
||||
title: "[BUG] "
|
||||
labels: bug
|
||||
assignees: RichiCoder1
|
||||
|
||||
---
|
||||
|
||||
## Vault server version
|
||||
v0.0.0
|
||||
|
||||
## vault-action version
|
||||
v0.0.0
|
||||
|
||||
## Describe the bug
|
||||
**Describe the bug**
|
||||
A clear and concise description of what the bug is.
|
||||
|
||||
## To Reproduce
|
||||
**To Reproduce**
|
||||
The yaml of the `vault-action` step, with any sensitive information masked or removed.
|
||||
|
||||
## Expected behavior
|
||||
**Expected behavior**
|
||||
A clear and concise description of what you expected to happen.
|
||||
|
||||
## Log Output
|
||||
For the most verbose logs, add a secret called
|
||||
[`ACTIONS_STEP_DEBUG`](https://github.com/actions/toolkit/blob/main/docs/action-debugging.md)
|
||||
with the value `true`. Then, re-run the workflow if possible and post the *raw
|
||||
logs* for the step here with any sensitive information masked or removed.
|
||||
**Log Output**
|
||||
For the most verbose logs, [add a secret called `ACTIONS_STEP_DEBUG` with the value `true`](https://github.com/actions/toolkit/blob/main/docs/action-debugging.md). Then, re-run the workflow if possible and post the *raw logs* for the step here with any sensitive information masked or removed.
|
||||
|
||||
## Additional context
|
||||
**Additional context**
|
||||
Add any other context about the problem here.
|
||||
|
||||
@@ -3,17 +3,18 @@ name: Feature request
|
||||
about: Suggest an idea for this project
|
||||
title: "[FEAT] "
|
||||
labels: enhancement
|
||||
assignees: RichiCoder1
|
||||
|
||||
---
|
||||
|
||||
## Is your feature request related to a problem? Please describe.
|
||||
**Is your feature request related to a problem? Please describe.**
|
||||
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
|
||||
|
||||
## Describe the solution you'd like
|
||||
**Describe the solution you'd like**
|
||||
A clear and concise description of what you want to happen.
|
||||
|
||||
## Describe alternatives you've considered
|
||||
**Describe alternatives you've considered**
|
||||
A clear and concise description of any alternative solutions or features you've considered.
|
||||
|
||||
## Additional context
|
||||
**Additional context**
|
||||
Add any other context or screenshots about the feature request here.
|
||||
|
||||
@@ -1,32 +0,0 @@
|
||||
### Description
|
||||
<!--- Description of the change. For example: This PR updates ABC resource so that we can XYZ --->
|
||||
|
||||
|
||||
<!--- If your PR fully resolves and should automatically close the linked issue, use Closes. Otherwise, use Relates --->
|
||||
Relates OR Closes #0000
|
||||
|
||||
|
||||
### Checklist
|
||||
- [ ] Added [CHANGELOG](https://github.com/hashicorp/vault-action/blob/master/CHANGELOG.md) entry (only for user-facing changes)
|
||||
|
||||
|
||||
### Community Note
|
||||
|
||||
* Please vote on this pull request by adding a 👍
|
||||
[reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/)
|
||||
to the original pull request comment to help the community and maintainers
|
||||
prioritize this request
|
||||
* Please do not leave "+1" comments, they generate extra noise for pull request
|
||||
followers and do not help prioritize the request
|
||||
|
||||
## PCI review checklist
|
||||
|
||||
<!-- heimdall_github_prtemplate:grc-pci_dss-2024-01-05 -->
|
||||
|
||||
- [ ] I have documented a clear reason for, and description of, the change I am making.
|
||||
|
||||
- [ ] If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
|
||||
|
||||
- [ ] If applicable, I've documented the impact of any changes to security controls.
|
||||
|
||||
Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.
|
||||
@@ -1,14 +1,11 @@
|
||||
# To get started with Dependabot version updates, you'll need to specify which
|
||||
# package ecosystems to update and where the package manifests are located.
|
||||
# Please see the documentation for all configuration options:
|
||||
# https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates
|
||||
# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
|
||||
|
||||
version: 2
|
||||
updates:
|
||||
- package-ecosystem: "npm"
|
||||
- package-ecosystem: "npm" # See documentation for possible values
|
||||
directory: "/" # Location of package manifests
|
||||
open-pull-requests-limit: 0 # only require security updates and exclude version updates
|
||||
schedule:
|
||||
interval: "weekly"
|
||||
# For got, ignore all updates since it is now native ESM
|
||||
# see https://github.com/hashicorp/vault-action/pull/457#issuecomment-1601445634
|
||||
ignore:
|
||||
- dependency-name: "got"
|
||||
interval: "daily"
|
||||
|
||||
@@ -8,7 +8,7 @@ jobs:
|
||||
actionlint:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
|
||||
- name: "Lint workflow files"
|
||||
uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint:latest
|
||||
with:
|
||||
|
||||
+219
-235
@@ -6,299 +6,283 @@ jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
|
||||
|
||||
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
|
||||
with:
|
||||
node-version: "24.15.0"
|
||||
- uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
|
||||
with:
|
||||
node-version: '16.14.0'
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-node-
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-node-
|
||||
|
||||
- name: NPM Install
|
||||
run: npm ci
|
||||
- name: NPM Install
|
||||
run: npm ci
|
||||
|
||||
- name: NPM Build
|
||||
run: npm run build
|
||||
- name: NPM Build
|
||||
run: npm run build
|
||||
|
||||
- name: NPM Run Test
|
||||
run: npm run test
|
||||
- name: NPM Run Test
|
||||
run: npm run test
|
||||
|
||||
integrationOSS:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
|
||||
|
||||
- name: Run docker compose
|
||||
run: docker compose up -d --wait vault
|
||||
- name: Run docker-compose
|
||||
run: docker-compose up -d vault
|
||||
|
||||
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
|
||||
with:
|
||||
node-version: "24.15.0"
|
||||
- uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
|
||||
with:
|
||||
node-version: '16.14.0'
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-node-
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-node-
|
||||
|
||||
- name: NPM Install
|
||||
run: npm ci
|
||||
- name: NPM Install
|
||||
run: npm ci
|
||||
|
||||
- name: NPM Build
|
||||
run: npm run build
|
||||
- name: NPM Build
|
||||
run: npm run build
|
||||
|
||||
- name: NPM Run test;integration:basic
|
||||
run: npm run test:integration:basic
|
||||
env:
|
||||
VAULT_HOST: 127.0.0.1
|
||||
VAULT_PORT: 8200
|
||||
CI: true
|
||||
- name: NPM Run test;integration:basic
|
||||
run: npm run test:integration:basic
|
||||
env:
|
||||
VAULT_HOST: localhost
|
||||
VAULT_PORT: 8200
|
||||
CI: true
|
||||
|
||||
integrationEnterprise:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
|
||||
|
||||
- name: Run docker compose
|
||||
if: ${{ !env.ACT }}
|
||||
run: docker compose up -d --wait vault-enterprise
|
||||
env:
|
||||
VAULT_LICENSE_CI: ${{ secrets.VAULT_LICENSE_CI }}
|
||||
- name: Run docker-compose
|
||||
run: docker-compose up -d vault-enterprise
|
||||
env:
|
||||
VAULT_LICENSE_CI: ${{ secrets.VAULT_LICENSE_CI }}
|
||||
|
||||
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
|
||||
with:
|
||||
node-version: "24.15.0"
|
||||
- uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
|
||||
with:
|
||||
node-version: '16.14.0'
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-node-
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-node-
|
||||
|
||||
- name: NPM Install
|
||||
run: npm ci
|
||||
- name: NPM Install
|
||||
run: npm ci
|
||||
|
||||
- name: NPM Build
|
||||
run: npm run build
|
||||
- name: NPM Build
|
||||
run: npm run build
|
||||
|
||||
- name: NPM Run test:integration:enterprise
|
||||
run: npm run test:integration:enterprise
|
||||
env:
|
||||
VAULT_HOST: 127.0.0.1
|
||||
VAULT_PORT: 8200
|
||||
CI: true
|
||||
- name: NPM Run test:integration:enterprise
|
||||
run: npm run test:integration:enterprise
|
||||
env:
|
||||
VAULT_HOST: localhost
|
||||
VAULT_PORT: 8200
|
||||
CI: true
|
||||
|
||||
e2e:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
|
||||
|
||||
- name: Run docker compose
|
||||
if: ${{ !env.ACT }}
|
||||
run: docker compose up -d --wait vault
|
||||
- name: Run docker-compose
|
||||
run: docker-compose up -d vault
|
||||
|
||||
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
|
||||
with:
|
||||
node-version: "24.15.0"
|
||||
- uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
|
||||
with:
|
||||
node-version: '16.14.0'
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-node-
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-node-
|
||||
|
||||
- name: NPM Install
|
||||
run: npm ci
|
||||
- name: NPM Install
|
||||
run: npm ci
|
||||
|
||||
- name: NPM Build
|
||||
run: npm run build
|
||||
- name: NPM Build
|
||||
run: npm run build
|
||||
|
||||
- name: Setup Vault
|
||||
run: node ./integrationTests/e2e/setup.js
|
||||
env:
|
||||
VAULT_HOST: localhost
|
||||
VAULT_PORT: 8200
|
||||
- name: Setup Vault
|
||||
run: node ./integrationTests/e2e/setup.js
|
||||
env:
|
||||
VAULT_HOST: localhost
|
||||
VAULT_PORT: 8200
|
||||
|
||||
- name: Test Vault Action (default KV V2)
|
||||
uses: ./
|
||||
id: kv-secrets
|
||||
with:
|
||||
url: http://localhost:8200
|
||||
token: testtoken
|
||||
secrets: |
|
||||
secret/data/test secret ;
|
||||
secret/data/test secret | NAMED_SECRET ;
|
||||
secret/data/nested/test otherSecret ;
|
||||
- name: Test Vault Action (default KV V2)
|
||||
uses: ./
|
||||
id: kv-secrets
|
||||
with:
|
||||
url: http://localhost:8200
|
||||
token: testtoken
|
||||
secrets: |
|
||||
secret/data/test secret ;
|
||||
secret/data/test secret | NAMED_SECRET ;
|
||||
secret/data/nested/test otherSecret ;
|
||||
|
||||
- name: Test Vault Action (default KV V1)
|
||||
uses: ./
|
||||
with:
|
||||
url: http://localhost:8200
|
||||
token: testtoken
|
||||
secrets: |
|
||||
my-secret/test altSecret ;
|
||||
my-secret/test altSecret | NAMED_ALTSECRET ;
|
||||
my-secret/nested/test otherAltSecret ;
|
||||
- name: Test Vault Action (default KV V1)
|
||||
uses: ./
|
||||
with:
|
||||
url: http://localhost:8200
|
||||
token: testtoken
|
||||
secrets: |
|
||||
my-secret/test altSecret ;
|
||||
my-secret/test altSecret | NAMED_ALTSECRET ;
|
||||
my-secret/nested/test otherAltSecret ;
|
||||
|
||||
- name: Test Vault Action (cubbyhole)
|
||||
uses: ./
|
||||
with:
|
||||
url: http://localhost:8200
|
||||
token: testtoken
|
||||
secrets: |
|
||||
/cubbyhole/test foo ;
|
||||
/cubbyhole/test zip | NAMED_CUBBYSECRET ;
|
||||
- name: Test Vault Action (cubbyhole)
|
||||
uses: ./
|
||||
with:
|
||||
url: http://localhost:8200
|
||||
token: testtoken
|
||||
secrets: |
|
||||
/cubbyhole/test foo ;
|
||||
/cubbyhole/test zip | NAMED_CUBBYSECRET ;
|
||||
|
||||
# The ordering of these two Test Vault Action Overwrites Env Vars In Subsequent Action steps matters
|
||||
# They should come before the Verify Vault Action Outputs step
|
||||
- name: Test Vault Action Overwrites Env Vars In Subsequent Action (part 1/2)
|
||||
uses: ./
|
||||
with:
|
||||
url: http://localhost:8200/
|
||||
token: testtoken
|
||||
secrets: |
|
||||
secret/data/test secret | SUBSEQUENT_TEST_SECRET;
|
||||
# The ordering of these two Test Vault Action Overwrites Env Vars In Subsequent Action steps matters
|
||||
# They should come before the Verify Vault Action Outputs step
|
||||
- name: Test Vault Action Overwrites Env Vars In Subsequent Action (part 1/2)
|
||||
uses: ./
|
||||
with:
|
||||
url: http://localhost:8200/
|
||||
token: testtoken
|
||||
secrets: |
|
||||
secret/data/test secret | SUBSEQUENT_TEST_SECRET;
|
||||
|
||||
- name: Test Vault Action Overwrites Env Vars In Subsequent Action (part 2/2)
|
||||
uses: ./
|
||||
with:
|
||||
url: http://localhost:8200/
|
||||
token: testtoken
|
||||
secrets: |
|
||||
secret/data/subsequent-test secret | SUBSEQUENT_TEST_SECRET;
|
||||
- name: Test Vault Action Overwrites Env Vars In Subsequent Action (part 2/2)
|
||||
uses: ./
|
||||
with:
|
||||
url: http://localhost:8200/
|
||||
token: testtoken
|
||||
secrets: |
|
||||
secret/data/subsequent-test secret | SUBSEQUENT_TEST_SECRET;
|
||||
|
||||
- name: Test JSON Secrets
|
||||
uses: ./
|
||||
with:
|
||||
url: http://localhost:8200
|
||||
token: testtoken
|
||||
secrets: |
|
||||
secret/data/test-json-data jsonData;
|
||||
secret/data/test-json-string jsonString;
|
||||
secret/data/test-json-string-multiline jsonStringMultiline;
|
||||
- name: Test JSON Secrets
|
||||
uses: ./
|
||||
with:
|
||||
url: http://localhost:8200
|
||||
token: testtoken
|
||||
secrets: |
|
||||
secret/data/test-json-data jsonData;
|
||||
secret/data/test-json-string jsonString;
|
||||
secret/data/test-json-string-multiline jsonStringMultiline;
|
||||
|
||||
- name: Verify Vault Action Outputs
|
||||
run: npm run test:integration:e2e
|
||||
env:
|
||||
OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
|
||||
|
||||
- name: Verify Vault Action Outputs
|
||||
run: npm run test:integration:e2e
|
||||
env:
|
||||
OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
|
||||
|
||||
e2e-tls:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
|
||||
|
||||
- name: Generate TLS Certificates
|
||||
if: ${{ !env.ACT }}
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
GH_GET_RETRIES: 3
|
||||
run: |
|
||||
# Source the getGH function for authenticated GitHub downloads with retries
|
||||
source ./scripts/.functions
|
||||
getGH https://github.com/cloudflare/cfssl/releases/download/v1.6.5/cfssl_1.6.5_linux_amd64 /usr/local/bin/cfssl
|
||||
getGH https://github.com/cloudflare/cfssl/releases/download/v1.6.5/cfssljson_1.6.5_linux_amd64 /usr/local/bin/cfssljson
|
||||
chmod +x /usr/local/bin/cfssl /usr/local/bin/cfssljson
|
||||
./scripts/gen-tls-certs.sh
|
||||
cat .build/e2e-tls.env >> "$GITHUB_ENV"
|
||||
- name: Run docker-compose
|
||||
run: docker-compose up -d vault-tls
|
||||
|
||||
- name: Run docker compose
|
||||
if: ${{ !env.ACT }}
|
||||
run: docker compose up -d --wait vault-tls
|
||||
- uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
|
||||
with:
|
||||
node-version: '16.14.0'
|
||||
|
||||
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
|
||||
with:
|
||||
node-version: "24.15.0"
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-node-
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-node-
|
||||
- name: NPM Install
|
||||
run: npm ci
|
||||
|
||||
- name: NPM Install
|
||||
run: npm ci
|
||||
- name: NPM Build
|
||||
run: npm run build
|
||||
|
||||
- name: NPM Build
|
||||
run: npm run build
|
||||
- name: Setup Vault
|
||||
run: node ./integrationTests/e2e-tls/setup.js
|
||||
env:
|
||||
VAULT_HOST: localhost
|
||||
VAULT_PORT: 8200
|
||||
VAULTCA: ${{ secrets.VAULTCA }}
|
||||
VAULT_CLIENT_CERT: ${{ secrets.VAULT_CLIENT_CERT }}
|
||||
VAULT_CLIENT_KEY: ${{ secrets.VAULT_CLIENT_KEY }}
|
||||
|
||||
- name: Setup Vault
|
||||
run: node ./integrationTests/e2e-tls/setup.js
|
||||
env:
|
||||
VAULT_HOST: localhost
|
||||
VAULT_PORT: 8200
|
||||
VAULTCA: ${{ env.VAULTCA }}
|
||||
VAULT_CLIENT_CERT: ${{ env.VAULT_CLIENT_CERT }}
|
||||
VAULT_CLIENT_KEY: ${{ env.VAULT_CLIENT_KEY }}
|
||||
- name: Test Vault Action (default KV V2)
|
||||
uses: ./
|
||||
id: kv-secrets-tls
|
||||
with:
|
||||
url: https://localhost:8200
|
||||
token: ${{ env.VAULT_TOKEN }}
|
||||
caCertificate: ${{ secrets.VAULTCA }}
|
||||
clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
|
||||
clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
|
||||
secrets: |
|
||||
secret/data/test secret ;
|
||||
secret/data/test secret | NAMED_SECRET ;
|
||||
secret/data/nested/test otherSecret ;
|
||||
|
||||
- name: Test Vault Action (default KV V2)
|
||||
uses: ./
|
||||
id: kv-secrets-tls
|
||||
with:
|
||||
url: https://localhost:8200
|
||||
token: ${{ env.VAULT_TOKEN }}
|
||||
caCertificate: ${{ env.VAULTCA }}
|
||||
clientCertificate: ${{ env.VAULT_CLIENT_CERT }}
|
||||
clientKey: ${{ env.VAULT_CLIENT_KEY }}
|
||||
secrets: |
|
||||
secret/data/test secret ;
|
||||
secret/data/test secret | NAMED_SECRET ;
|
||||
secret/data/nested/test otherSecret ;
|
||||
- name: Test Vault Action (tlsSkipVerify)
|
||||
uses: ./
|
||||
with:
|
||||
url: https://localhost:8200
|
||||
token: ${{ env.VAULT_TOKEN }}
|
||||
tlsSkipVerify: true
|
||||
clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
|
||||
clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
|
||||
secrets: |
|
||||
secret/data/tlsSkipVerify skip ;
|
||||
|
||||
- name: Test Vault Action (tlsSkipVerify)
|
||||
uses: ./
|
||||
with:
|
||||
url: https://localhost:8200
|
||||
token: ${{ env.VAULT_TOKEN }}
|
||||
tlsSkipVerify: true
|
||||
clientCertificate: ${{ env.VAULT_CLIENT_CERT }}
|
||||
clientKey: ${{ env.VAULT_CLIENT_KEY }}
|
||||
secrets: |
|
||||
secret/data/tlsSkipVerify skip ;
|
||||
- name: Test Vault Action (default KV V1)
|
||||
uses: ./
|
||||
with:
|
||||
url: https://localhost:8200
|
||||
token: ${{ env.VAULT_TOKEN }}
|
||||
caCertificate: ${{ secrets.VAULTCA }}
|
||||
clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
|
||||
clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
|
||||
secrets: |
|
||||
my-secret/test altSecret ;
|
||||
my-secret/test altSecret | NAMED_ALTSECRET ;
|
||||
my-secret/nested/test otherAltSecret ;
|
||||
|
||||
- name: Test Vault Action (default KV V1)
|
||||
uses: ./
|
||||
with:
|
||||
url: https://localhost:8200
|
||||
token: ${{ env.VAULT_TOKEN }}
|
||||
caCertificate: ${{ env.VAULTCA }}
|
||||
clientCertificate: ${{ env.VAULT_CLIENT_CERT }}
|
||||
clientKey: ${{ env.VAULT_CLIENT_KEY }}
|
||||
secrets: |
|
||||
my-secret/test altSecret ;
|
||||
my-secret/test altSecret | NAMED_ALTSECRET ;
|
||||
my-secret/nested/test otherAltSecret ;
|
||||
- name: Test Vault Action (cubbyhole)
|
||||
uses: ./
|
||||
with:
|
||||
url: https://localhost:8200
|
||||
token: ${{ env.VAULT_TOKEN }}
|
||||
secrets: |
|
||||
/cubbyhole/test foo ;
|
||||
/cubbyhole/test zip | NAMED_CUBBYSECRET ;
|
||||
caCertificate: ${{ secrets.VAULTCA }}
|
||||
clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
|
||||
clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
|
||||
|
||||
- name: Test Vault Action (cubbyhole)
|
||||
uses: ./
|
||||
with:
|
||||
url: https://localhost:8200
|
||||
token: ${{ env.VAULT_TOKEN }}
|
||||
secrets: |
|
||||
/cubbyhole/test foo ;
|
||||
/cubbyhole/test zip | NAMED_CUBBYSECRET ;
|
||||
caCertificate: ${{ env.VAULTCA }}
|
||||
clientCertificate: ${{ env.VAULT_CLIENT_CERT }}
|
||||
clientKey: ${{ env.VAULT_CLIENT_KEY }}
|
||||
|
||||
- name: Verify Vault Action Outputs
|
||||
run: npm run test:integration:e2e-tls
|
||||
env:
|
||||
OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets-tls.outputs.otherSecret }}
|
||||
- name: Verify Vault Action Outputs
|
||||
run: npm run test:integration:e2e-tls
|
||||
env:
|
||||
OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets-tls.outputs.otherSecret }}
|
||||
|
||||
@@ -18,11 +18,11 @@ jobs:
|
||||
name: local-test
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
|
||||
|
||||
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
|
||||
- uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
|
||||
with:
|
||||
node-version: '24.15.0'
|
||||
node-version: '16.14.0'
|
||||
|
||||
- name: NPM Install
|
||||
run: npm ci
|
||||
@@ -33,7 +33,7 @@ jobs:
|
||||
- name: Setup Vault
|
||||
run: node ./integrationTests/e2e/setup.js
|
||||
env:
|
||||
VAULT_HOST: 127.0.0.1
|
||||
VAULT_HOST: localhost
|
||||
VAULT_PORT: 8200
|
||||
|
||||
- name: Import Secrets
|
||||
@@ -43,31 +43,19 @@ jobs:
|
||||
# run against a specific version of vault-action
|
||||
# uses: hashicorp/vault-action@v2.1.2
|
||||
with:
|
||||
url: http://127.0.0.1:8200
|
||||
url: http://localhost:8200
|
||||
method: token
|
||||
token: testtoken
|
||||
secrets: |
|
||||
secret/data/test-json-string jsonString;
|
||||
secret/data/test-json-data jsonData;
|
||||
|
||||
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
|
||||
with:
|
||||
github-token: "foobar"
|
||||
script: |
|
||||
const { JSONSTRING, JSONDATA } = process.env
|
||||
- name: Check Secrets
|
||||
run: |
|
||||
touch secrets.json
|
||||
echo "${{ steps.import-secrets.outputs.jsonString }}" >> secrets.json
|
||||
|
||||
console.log(`string ${JSONSTRING}`)
|
||||
console.log(`data ${JSONDATA}`)
|
||||
const str = JSONDATA
|
||||
|
||||
let valid = true
|
||||
try {
|
||||
JSON.parse(str)
|
||||
} catch (e) {
|
||||
valid = false
|
||||
}
|
||||
if (valid) {
|
||||
console.log("valid json")
|
||||
} else {
|
||||
console.log("not valid json")
|
||||
}
|
||||
- name: Check json file format
|
||||
run: |
|
||||
echo
|
||||
cat secrets.json
|
||||
jq -c . < secrets.json
|
||||
|
||||
@@ -5,9 +5,6 @@ npm-debug.log*
|
||||
yarn-debug.log*
|
||||
yarn-error.log*
|
||||
|
||||
# Build artifacts
|
||||
.build/
|
||||
|
||||
# Runtime data
|
||||
pids
|
||||
*.pid
|
||||
|
||||
+2
-86
@@ -1,90 +1,6 @@
|
||||
## 4.0.0 (May 12, 2026)
|
||||
## Unreleased
|
||||
|
||||
Improvements:
|
||||
|
||||
* Bump node runtime from node20 to node24 [GH-604](https://github.com/hashicorp/vault-action/pull/604)
|
||||
* Fix leading slash in secret paths causing HTTP 400 errors (e.g. `/cubbyhole/test` → `v1/cubbyhole/test` instead of `v1//cubbyhole/test`)
|
||||
* bump jsrsasign from 11.1.0 to 11.1.3
|
||||
* bump body-parser from 1.20.3 to 1.20.5
|
||||
* bump qs from 6.13.0 to 6.15.1
|
||||
* bump http-errors from 2.0.0 to 2.0.1
|
||||
* bump minimatch from 3.1.2 to 3.1.5
|
||||
* bump underscore from 1.13.4 to 1.13.8
|
||||
|
||||
## 3.4.0 (June 13, 2025)
|
||||
|
||||
Bugs:
|
||||
|
||||
* replace all dot chars during normalization (https://github.com/hashicorp/vault-action/pull/580)
|
||||
|
||||
Improvements:
|
||||
|
||||
* Prevent possible DoS via polynomial regex (https://github.com/hashicorp/vault-action/pull/583)
|
||||
|
||||
## 3.3.0 (March 3, 2025)
|
||||
|
||||
Features:
|
||||
* Wildcard secret imports can use `**` to retain case of exported env keys [GH-545](https://github.com/hashicorp/vault-action/pull/545)
|
||||
|
||||
## 3.2.0 (March 3, 2025)
|
||||
|
||||
Improvements:
|
||||
|
||||
* Add retry for jwt auth login to fix intermittent login failures [GH-574](https://github.com/hashicorp/vault-action/pull/574)
|
||||
|
||||
## 3.1.0 (January 9, 2025)
|
||||
|
||||
Improvements:
|
||||
|
||||
* fix wildcard handling when field contains dot [GH-542](https://github.com/hashicorp/vault-action/pull/542)
|
||||
* bump body-parser from 1.20.0 to 1.20.3
|
||||
* bump braces from 3.0.2 to 3.0.3
|
||||
* bump cross-spawn from 7.0.3 to 7.0.6
|
||||
* bump micromatch from 4.0.5 to 4.0.8
|
||||
|
||||
Features:
|
||||
|
||||
* `secretId` is no longer required for approle to support advanced use cases like machine login when `bind_secret_id` is false. [GH-522](https://github.com/hashicorp/vault-action/pull/522)
|
||||
* Use `pki` configuration to generate certificates from Vault [GH-564](https://github.com/hashicorp/vault-action/pull/564)
|
||||
|
||||
## 3.0.0 (February 15, 2024)
|
||||
|
||||
Improvements:
|
||||
|
||||
* Bump node runtime from node16 to node20 [GH-529](https://github.com/hashicorp/vault-action/pull/529)
|
||||
|
||||
## 2.8.1 (February 15, 2024)
|
||||
|
||||
Bugs:
|
||||
|
||||
* Revert [GH-509](https://github.com/hashicorp/vault-action/pull/509) which made a backwards incompatible bump of the node runtime from node16 to node20 [GH-527](https://github.com/hashicorp/vault-action/pull/527)
|
||||
|
||||
## 2.8.0 (February 1, 2024)
|
||||
|
||||
Features:
|
||||
|
||||
* Add `ignoreNotFound` input (default: false) to prevent the action from failing when a secret does not exist [GH-518](https://github.com/hashicorp/vault-action/pull/518)
|
||||
|
||||
Improvements:
|
||||
|
||||
* bump jsrsasign from 10.8.6 to 11.0.0 [GH-513](https://github.com/hashicorp/vault-action/pull/513)
|
||||
* bump @actions/core from 1.10.0 to 1.10.1 [GH-489](https://github.com/hashicorp/vault-action/pull/489)
|
||||
* bump jest-when from 3.5.2 to 3.6.0 [GH-484](https://github.com/hashicorp/vault-action/pull/484)
|
||||
* bump jest from 29.5.0 to 29.7.0 [GH-490](https://github.com/hashicorp/vault-action/pull/490)
|
||||
* bump @vercel/ncc from 0.36.1 to 0.38.1 [GH-503](https://github.com/hashicorp/vault-action/pull/503)
|
||||
|
||||
## 2.7.5 (January 30, 2024)
|
||||
|
||||
Improvements:
|
||||
|
||||
* Bump node runtime from node16 to node20 [GH-509](https://github.com/hashicorp/vault-action/pull/509)
|
||||
* Bump got from 11.8.5 to 11.8.6 [GH-492](https://github.com/hashicorp/vault-action/pull/492)
|
||||
|
||||
## 2.7.4 (October 26, 2023)
|
||||
|
||||
Features:
|
||||
|
||||
* Add ability to specify a wildcard for the key name to get all keys in the path [GH-488](https://github.com/hashicorp/vault-action/pull/488)
|
||||
* Add changes here
|
||||
|
||||
## 2.7.3 (July 13, 2023)
|
||||
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
* @hashicorp/vault-ecosystem @hashicorp/team-vault-consumption
|
||||
@@ -1,40 +1,3 @@
|
||||
.PHONY: clean
|
||||
clean:
|
||||
rm -rf .build
|
||||
|
||||
.PHONY: local-test
|
||||
local-test: clean
|
||||
docker compose down --volumes; docker compose up --wait vault && \
|
||||
act workflow_dispatch --job local-test --workflows .github/workflows/local-test.yaml
|
||||
|
||||
.PHONY: test-npm
|
||||
test-npm:
|
||||
npm ci && npm run build && npm run test
|
||||
|
||||
.PHONY: test-basic
|
||||
test-basic: clean
|
||||
docker compose down --volumes; docker compose up --wait vault && \
|
||||
npm run test:integration:basic
|
||||
|
||||
.PHONY: test-e2e
|
||||
test-e2e: clean
|
||||
docker compose down --volumes; docker compose up --wait vault && \
|
||||
act workflow_dispatch --job e2e --workflows .github/workflows/build.yml
|
||||
|
||||
.PHONY: test-e2e-tls
|
||||
test-e2e-tls: clean
|
||||
./scripts/gen-tls-certs.sh
|
||||
docker compose down --volumes; docker compose up --wait vault-tls && \
|
||||
act workflow_dispatch --job e2e-tls --workflows .github/workflows/build.yml --env-file .build/e2e-tls.env
|
||||
|
||||
.PHONY: test-enterprise
|
||||
test-enterprise: clean
|
||||
@if [ -z "$(VAULT_LICENSE_CI)" ]; then \
|
||||
echo "Skipping enterprise tests: VAULT_LICENSE_CI not set"; \
|
||||
else \
|
||||
docker compose down --volumes; docker compose up --wait vault-enterprise && \
|
||||
act workflow_dispatch --job integrationEnterprise --workflows .github/workflows/build.yml; \
|
||||
fi
|
||||
|
||||
.PHONY: test-all
|
||||
test-all: clean test-npm test-basic test-e2e test-e2e-tls test-enterprise
|
||||
local-test:
|
||||
docker compose down; docker-compose up -d vault && act workflow_dispatch -j local-test
|
||||
|
||||
@@ -8,9 +8,6 @@
|
||||
|
||||
A helper action for easily pulling secrets from HashiCorp Vault™.
|
||||
|
||||
Note: The Vault Github Action is a read-only action, and in general
|
||||
is not meant to modify Vault’s state.
|
||||
|
||||
<!-- TOC -->
|
||||
|
||||
- [Vault GitHub Action](#vault-github-action)
|
||||
@@ -25,12 +22,10 @@ is not meant to modify Vault’s state.
|
||||
- [Userpass](#userpass)
|
||||
- [Ldap](#ldap)
|
||||
- [Other Auth Methods](#other-auth-methods)
|
||||
- [Custom Path](#custom-path-name)
|
||||
- [Key Syntax](#key-syntax)
|
||||
- [Simple Key](#simple-key)
|
||||
- [Set Output Variable Name](#set-output-variable-name)
|
||||
- [Multiple Secrets](#multiple-secrets)
|
||||
- [KV secrets engine version 2](#kv-secrets-engine-version-2)
|
||||
- [Other Secret Engines](#other-secret-engines)
|
||||
- [Adding Extra Headers](#adding-extra-headers)
|
||||
- [HashiCorp Cloud Platform or Vault Enterprise](#hashicorp-cloud-platform-or-vault-enterprise)
|
||||
@@ -46,51 +41,46 @@ is not meant to modify Vault’s state.
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
build:
|
||||
# ...
|
||||
steps:
|
||||
# ...
|
||||
- name: Import Secrets
|
||||
id: import-secrets
|
||||
uses: hashicorp/vault-action@v2
|
||||
with:
|
||||
url: https://vault.mycompany.com:8200
|
||||
token: ${{ secrets.VAULT_TOKEN }}
|
||||
caCertificate: ${{ secrets.VAULT_CA_CERT }}
|
||||
secrets: |
|
||||
secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
|
||||
secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
|
||||
secret/data/ci npm_token
|
||||
# ...
|
||||
build:
|
||||
# ...
|
||||
steps:
|
||||
# ...
|
||||
- name: Import Secrets
|
||||
id: import-secrets
|
||||
uses: hashicorp/vault-action@v2
|
||||
with:
|
||||
url: https://vault.mycompany.com:8200
|
||||
token: ${{ secrets.VAULT_TOKEN }}
|
||||
caCertificate: ${{ secrets.VAULT_CA_CERT }}
|
||||
secrets: |
|
||||
secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
|
||||
secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
|
||||
secret/data/ci npm_token
|
||||
# ...
|
||||
```
|
||||
|
||||
Retrieved secrets are available as environment variables or outputs for subsequent steps:
|
||||
|
||||
```yaml
|
||||
#...
|
||||
- name: Step following 'Import Secrets'
|
||||
run: |
|
||||
ACCESS_KEY_ID = "${{ env.AWS_ACCESS_KEY_ID }}"
|
||||
SECRET_ACCESS_KEY = "${{ steps.import-secrets.outputs.AWS_SECRET_ACCESS_KEY }}"
|
||||
|
||||
# ...
|
||||
- name: Step following 'Import Secrets'
|
||||
run: |
|
||||
ACCESS_KEY_ID = "${{ env.AWS_ACCESS_KEY_ID }}"
|
||||
SECRET_ACCESS_KEY = "${{ steps.import-secrets.outputs.AWS_SECRET_ACCESS_KEY }}"
|
||||
# ...
|
||||
```
|
||||
|
||||
If your project needs a format other than env vars and step outputs, you can use additional steps to transform them into the desired format.
|
||||
If your project needs a format other than env vars and step outputs, you can use additional steps to transform them into the desired format.
|
||||
For example, a common pattern is to save all the secrets in a JSON file:
|
||||
|
||||
```yaml
|
||||
#...
|
||||
- name: Step following 'Import Secrets'
|
||||
run: |
|
||||
touch secrets.json
|
||||
echo '${{ toJson(steps.import-secrets.outputs) }}' >> secrets.json
|
||||
|
||||
# ...
|
||||
- name: Step following 'Import Secrets'
|
||||
run: |
|
||||
touch secrets.json
|
||||
echo '${{ toJson(steps.import-secrets.outputs) }}' >> secrets.json
|
||||
# ...
|
||||
```
|
||||
|
||||
Which with our example would yield a file containing:
|
||||
|
||||
```json
|
||||
{
|
||||
"ACCESS_KEY_ID": "MY_KEY_ID",
|
||||
@@ -101,6 +91,7 @@ Which with our example would yield a file containing:
|
||||
|
||||
Note that all secrets are masked so programs need to read the file themselves otherwise all values will be replaced with a `***` placeholder.
|
||||
|
||||
|
||||
## Authentication Methods
|
||||
|
||||
Consider using a [Vault authentication method](https://www.vaultproject.io/docs/auth) such as the JWT auth method with
|
||||
@@ -114,7 +105,7 @@ and Vault using the
|
||||
Each GitHub Actions workflow receives an auto-generated OIDC token with claims
|
||||
to establish the identity of the workflow.
|
||||
|
||||
**Vault Configuration**
|
||||
__Vault Configuration__
|
||||
|
||||
<details>
|
||||
<summary>Click to toggle instructions for configuring Vault.</summary>
|
||||
@@ -125,6 +116,7 @@ Pass the following parameters to your auth method configuration:
|
||||
- `oidc_discovery_url`: `https://token.actions.githubusercontent.com`
|
||||
- `bound_issuer`: `https://token.actions.githubusercontent.com`
|
||||
|
||||
|
||||
Configure a [Vault role](https://www.vaultproject.io/api/auth/jwt#create-role) for the auth method.
|
||||
|
||||
- `role_type`: `jwt`
|
||||
@@ -140,12 +132,12 @@ Configure a [Vault role](https://www.vaultproject.io/api/auth/jwt#create-role) f
|
||||
|
||||
- For wildcard (non-exact) matches, use `bound_claims`.
|
||||
|
||||
- `bound_claims_type`: `glob`
|
||||
- `bound_claims_type`: `glob`
|
||||
|
||||
- `bound_claims`: JSON object. Maps one or more claim names to corresponding wildcard values.
|
||||
```json
|
||||
{ "sub": "repo:<orgName>/*" }
|
||||
```
|
||||
- `bound_claims`: JSON object. Maps one or more claim names to corresponding wildcard values.
|
||||
```json
|
||||
{"sub": "repo:<orgName>/*"}
|
||||
```
|
||||
|
||||
- For exact matches, use `bound_subject`.
|
||||
|
||||
@@ -158,17 +150,17 @@ Configure a [Vault role](https://www.vaultproject.io/api/auth/jwt#create-role) f
|
||||
|
||||
</details>
|
||||
|
||||
**GitHub Actions Workflow**
|
||||
__GitHub Actions Workflow__
|
||||
|
||||
In the GitHub Actions workflow, the workflow needs permissions to read contents
|
||||
and write the ID token.
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
retrieve-secret:
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write
|
||||
retrieve-secret:
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write
|
||||
```
|
||||
|
||||
In the action, provide the name of the Vault role you created to the `role` parameter.
|
||||
@@ -305,25 +297,11 @@ with:
|
||||
If any other method is specified and you provide an `authPayload`, the action will
|
||||
attempt to `POST` to `auth/${method}/login` with the provided payload and parse out the client token.
|
||||
|
||||
### Custom Path Name
|
||||
|
||||
Auth methods at custom path names can be configured using the [`path`](#path) parameter
|
||||
|
||||
```yaml
|
||||
with:
|
||||
url: https://vault.mycompany.com:8200
|
||||
caCertificate: ${{ secrets.VAULT_CA_CERT }}
|
||||
path: my-custom-path
|
||||
method: userpass
|
||||
username: ${{ secrets.VAULT_USERNAME }}
|
||||
password: ${{ secrets.VAULT_PASSWORD }}
|
||||
```
|
||||
|
||||
## Key Syntax
|
||||
|
||||
The `secrets` parameter is a set of multiple secret requests separated by the `;` character.
|
||||
|
||||
Each secret request consists of the `path` and the `key` of the desired secret, and optionally the desired Env Var output name.
|
||||
Each secret request consists of the `path` and the `key` of the desired secret, and optionally the desired Env Var output name.
|
||||
Note that the selector is using [JSONata](https://docs.jsonata.org/overview.html) and certain characters in keys may need to be escaped.
|
||||
|
||||
```raw
|
||||
@@ -336,7 +314,7 @@ To retrieve a key `npmToken` from path `secret/data/ci` that has value `somelong
|
||||
|
||||
```yaml
|
||||
with:
|
||||
secrets: secret/data/ci npmToken
|
||||
secrets: secret/data/ci npmToken
|
||||
```
|
||||
|
||||
`vault-action` will automatically normalize the given secret selector key, and set the follow as environment variables for the following steps in the current job:
|
||||
@@ -349,12 +327,12 @@ You can also access the secret via outputs:
|
||||
|
||||
```yaml
|
||||
steps:
|
||||
# ...
|
||||
- name: Import Secrets
|
||||
id: secrets
|
||||
# Import config...
|
||||
- name: Sensitive Operation
|
||||
run: "my-cli --token '${{ steps.secrets.outputs.npmToken }}'"
|
||||
# ...
|
||||
- name: Import Secrets
|
||||
id: secrets
|
||||
# Import config...
|
||||
- name: Sensitive Operation
|
||||
run: "my-cli --token '${{ steps.secrets.outputs.npmToken }}'"
|
||||
```
|
||||
|
||||
_**Note:** If you'd like to only use outputs and disable automatic environment variables, you can set the `exportEnv` option to `false`._
|
||||
@@ -365,7 +343,7 @@ However, if you want to set it to a specific name, say `NPM_TOKEN`, you could do
|
||||
|
||||
```yaml
|
||||
with:
|
||||
secrets: secret/data/ci npmToken | NPM_TOKEN
|
||||
secrets: secret/data/ci npmToken | NPM_TOKEN
|
||||
```
|
||||
|
||||
With that, `vault-action` will now use your requested name and output:
|
||||
@@ -382,6 +360,7 @@ steps:
|
||||
# Import config...
|
||||
- name: Sensitive Operation
|
||||
run: "my-cli --token '${{ steps.secrets.outputs.NPM_TOKEN }}'"
|
||||
|
||||
```
|
||||
|
||||
### Multiple Secrets
|
||||
@@ -390,81 +369,32 @@ This action can take multi-line input, so say you had your AWS keys stored in a
|
||||
|
||||
```yaml
|
||||
with:
|
||||
secrets: |
|
||||
secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
|
||||
secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY
|
||||
secrets: |
|
||||
secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
|
||||
secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY
|
||||
```
|
||||
|
||||
You can specify a wildcard \* for the key name to get all keys in the path. If you provide an output name with the wildcard, the name will be prepended to the key name:
|
||||
|
||||
```yaml
|
||||
with:
|
||||
secrets: |
|
||||
secret/data/ci/aws * | MYAPP_ ;
|
||||
```
|
||||
|
||||
When using the `exportEnv` option all exported keys will be normalized to uppercase. For example, the key `SecretKey` would be exported as `MYAPP_SECRETKEY`.
|
||||
You can disable uppercase normalization by specifying double asterisks `**` in the selector path:
|
||||
You can specify a wildcard * for the key name to get all keys in the path. If you provide an output name with the wildcard, the name will be prepended to the key name:
|
||||
|
||||
```yaml
|
||||
with:
|
||||
secrets: |
|
||||
secret/data/ci/aws ** | MYAPP_ ;
|
||||
secret/data/ci/aws * | MYAPP_ ;
|
||||
```
|
||||
|
||||
### KV secrets engine version 2
|
||||
|
||||
When accessing secrets from the KV secrets engine version 2, Vault Action
|
||||
requires the full path to the secret. This is the same path that would be used
|
||||
in a Vault policy for the secret. You can find the full path to your secret by
|
||||
performing a `kv get` command like the following:
|
||||
|
||||
```bash
|
||||
$ vault kv get secret/test
|
||||
== Secret Path ==
|
||||
secret/data/test
|
||||
|
||||
...
|
||||
```
|
||||
|
||||
Note that the full path is not `secret/test`, but `secret/data/test`.
|
||||
|
||||
## PKI Certificate Requests
|
||||
|
||||
You can use the `pki` option to generate a certificate and private key for a given role.
|
||||
|
||||
````yaml
|
||||
with:
|
||||
pki: |
|
||||
pki/issue/rolename {"common_name": "role.mydomain.com", "ttl": "1h"} ;
|
||||
pki/issue/otherrole {"common_name": "otherrole.mydomain.com", "ttl": "1h"} ;
|
||||
```
|
||||
|
||||
Resulting in:
|
||||
|
||||
```bash
|
||||
ROLENAME_CA=-----BEGIN CERTIFICATE-----...
|
||||
ROLENAME_CERT=-----BEGIN CERTIFICATE-----...
|
||||
ROLENAME_KEY=-----BEGIN RSA PRIVATE KEY-----...
|
||||
ROLENAME_CA_CHAIN=-----BEGIN CERTIFICATE-----...
|
||||
OTHERROLE_CA=-----BEGIN CERTIFICATE-----...
|
||||
OTHERROLE_CERT=-----BEGIN CERTIFICATE-----...
|
||||
OTHERROLE_KEY=-----BEGIN RSA PRIVATE KEY-----...
|
||||
OTHERROLE_CA_CHAIN=-----BEGIN CERTIFICATE-----...
|
||||
````
|
||||
|
||||
## Other Secret Engines
|
||||
|
||||
Vault Action currently supports retrieving secrets from any engine where secrets
|
||||
are retrieved via `GET` requests, except for the PKI engine as noted above.
|
||||
are retrieved via `GET` requests. This means secret engines such as PKI are currently
|
||||
not supported due to their requirement of sending parameters along with the request
|
||||
(such as `common_name`).
|
||||
|
||||
For example, to request a secret from the `cubbyhole` secret engine:
|
||||
|
||||
```yaml
|
||||
with:
|
||||
secrets: |
|
||||
/cubbyhole/foo foo ;
|
||||
/cubbyhole/foo zip | MY_KEY ;
|
||||
secrets: |
|
||||
/cubbyhole/foo foo ;
|
||||
/cubbyhole/foo zip | MY_KEY ;
|
||||
```
|
||||
|
||||
Resulting in:
|
||||
@@ -492,12 +422,12 @@ If you ever need to add extra headers to the vault request, say if you need to a
|
||||
|
||||
```yaml
|
||||
with:
|
||||
secrets: |
|
||||
secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
|
||||
secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY
|
||||
extraHeaders: |
|
||||
X-Secure-Id: ${{ secrets.SECURE_ID }}
|
||||
X-Secure-Secret: ${{ secrets.SECURE_SECRET }}
|
||||
secrets: |
|
||||
secret/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
|
||||
secret/ci/aws secretKey | AWS_SECRET_ACCESS_KEY
|
||||
extraHeaders: |
|
||||
X-Secure-Id: ${{ secrets.SECURE_ID }}
|
||||
X-Secure-Secret: ${{ secrets.SECURE_SECRET }}
|
||||
```
|
||||
|
||||
This will automatically add the `x-secure-id` and `x-secure-secret` headers to every request to Vault.
|
||||
@@ -515,215 +445,53 @@ parameter specifying the namespace. In HCP Vault, the namespace defaults to `adm
|
||||
|
||||
```yaml
|
||||
steps:
|
||||
# ...
|
||||
- name: Import Secrets
|
||||
uses: hashicorp/vault-action
|
||||
with:
|
||||
url: https://vault-enterprise.mycompany.com:8200
|
||||
method: token
|
||||
token: ${{ secrets.VAULT_TOKEN }}
|
||||
namespace: admin
|
||||
secrets: |
|
||||
secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
|
||||
secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
|
||||
secret/data/ci npm_token
|
||||
```
|
||||
|
||||
Alternatively, you may need to authenticate to the root namespace and retrieve
|
||||
a secret from a different namespace. To do this, do not set the `namespace`
|
||||
parameter. Instead set the namespace in the secret path. For example, `<NAMESPACE>/secret/data/app`:
|
||||
|
||||
```yaml
|
||||
steps:
|
||||
# ...
|
||||
- name: Import Secrets
|
||||
uses: hashicorp/vault-action
|
||||
with:
|
||||
url: https://vault-enterprise.mycompany.com:8200
|
||||
method: token
|
||||
token: ${{ secrets.VAULT_TOKEN }}
|
||||
secrets: |
|
||||
namespace-1/secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
|
||||
namespace-1/secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
|
||||
namespace-1/secret/data/ci npm_token
|
||||
# ...
|
||||
- name: Import Secrets
|
||||
uses: hashicorp/vault-action
|
||||
with:
|
||||
url: https://vault-enterprise.mycompany.com:8200
|
||||
caCertificate: ${{ secrets.VAULT_CA_CERT }}
|
||||
method: token
|
||||
token: ${{ secrets.VAULT_TOKEN }}
|
||||
namespace: admin
|
||||
secrets: |
|
||||
secret/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
|
||||
secret/ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
|
||||
secret/ci npm_token
|
||||
```
|
||||
|
||||
## Reference
|
||||
|
||||
Here are all the inputs available through `with`:
|
||||
|
||||
### `url`
|
||||
|
||||
**Type: `string`**\
|
||||
**Required**
|
||||
|
||||
The URL for the Vault endpoint.
|
||||
|
||||
### `secrets`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
A semicolon-separated list of secrets to retrieve. These will automatically be
|
||||
converted to environmental variable keys. See [Key Syntax](#key-syntax) for
|
||||
more details.
|
||||
|
||||
### `namespace`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The Vault namespace from which to query secrets. Vault Enterprise only, unset by default.
|
||||
|
||||
### `method`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `token`**
|
||||
|
||||
The method to use to authenticate with Vault.
|
||||
|
||||
### `role`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Vault role for the specified auth method.
|
||||
|
||||
### `path`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The Vault path for the auth method.
|
||||
|
||||
### `token`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The Vault token to be used to authenticate with Vault.
|
||||
|
||||
### `roleId`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The role ID for App Role authentication.
|
||||
|
||||
### `secretId`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The secret ID for App Role authentication.
|
||||
|
||||
### `githubToken`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The Github Token to be used to authenticate with Vault.
|
||||
|
||||
### `jwtPrivateKey`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Base64 encoded private key to sign the JWT.
|
||||
|
||||
### `jwtKeyPassword`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Password for key stored in `jwtPrivateKey` (if needed).
|
||||
|
||||
### `jwtGithubAudience`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Identifies the recipient ("aud" claim) that the JWT is intended for.
|
||||
|
||||
### `jwtTtl`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `3600`**
|
||||
|
||||
Time in seconds, after which token expires.
|
||||
|
||||
### `kubernetesTokenPath`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `/var/run/secrets/kubernetes.io/serviceaccount/token`**
|
||||
|
||||
The path to the service-account secret with the jwt token for kubernetes based authentication.
|
||||
|
||||
### `username`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The username of the user to log in to Vault as. Available to both Userpass and LDAP auth methods.
|
||||
|
||||
### `password`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The password of the user to log in to Vault as. Available to both Userpass and LDAP auth methods.
|
||||
|
||||
### `authPayload`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The JSON payload to be sent to Vault when using a custom authentication method.
|
||||
|
||||
### `extraHeaders`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
A string of newline separated extra headers to include on every request.
|
||||
|
||||
### `exportEnv`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `true`**
|
||||
|
||||
Whether or not to export secrets as environment variables.
|
||||
|
||||
### `exportToken`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `false`**
|
||||
|
||||
Whether or not export Vault token as environment variables (i.e VAULT_TOKEN).
|
||||
|
||||
### `outputToken`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `false`**
|
||||
|
||||
Whether or not to set the `vault_token` output to contain the Vault token after authentication.
|
||||
|
||||
### `caCertificate`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Base64 encoded CA certificate the server certificate was signed with. Defaults to CAs provided by Mozilla.
|
||||
|
||||
### `clientCertificate`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Base64 encoded client certificate the action uses to authenticate with Vault when mTLS is enabled.
|
||||
|
||||
### `clientKey`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Base64 encoded client key the action uses to authenticate with Vault when mTLS is enabled.
|
||||
|
||||
### `tlsSkipVerify`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `false`**
|
||||
|
||||
When set to true, disables verification of server certificates when testing the action.
|
||||
|
||||
### `ignoreNotFound`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `false`**
|
||||
|
||||
When set to true, prevents the action from failing when a secret does not exist.
|
||||
| Input | Description | Default | Required |
|
||||
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | -------- |
|
||||
| `url` | The URL for the vault endpoint | | ✔ |
|
||||
| `secrets` | A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details | | |
|
||||
| `namespace` | The Vault namespace from which to query secrets. Vault Enterprise only, unset by default | | |
|
||||
| `method` | The method to use to authenticate with Vault. | `token` | |
|
||||
| `role` | Vault role for specified auth method | | |
|
||||
| `path` | Custom vault path, if the auth method was enabled at a different path | | |
|
||||
| `token` | The Vault Token to be used to authenticate with Vault | | |
|
||||
| `roleId` | The Role Id for App Role authentication | | |
|
||||
| `secretId` | The Secret Id for App Role authentication | | |
|
||||
| `githubToken` | The Github Token to be used to authenticate with Vault | | |
|
||||
| `jwtPrivateKey` | Base64 encoded Private key to sign JWT | | |
|
||||
| `jwtKeyPassword` | Password for key stored in jwtPrivateKey (if needed) | | |
|
||||
| `jwtGithubAudience` | Identifies the recipient ("aud" claim) that the JWT is intended for |`sigstore`| |
|
||||
| `jwtTtl` | Time in seconds, after which token expires | | 3600 |
|
||||
| `kubernetesTokenPath` | The path to the service-account secret with the jwt token for kubernetes based authentication |`/var/run/secrets/kubernetes.io/serviceaccount/token` | |
|
||||
| `username` | The username of the user to log in to Vault as. Available to both Userpass and LDAP auth methods | | |
|
||||
| `password` | The password of the user to log in to Vault as. Available to both Userpass and LDAP auth methods | | |
|
||||
| `authPayload` | The JSON payload to be sent to Vault when using a custom authentication method. | | |
|
||||
| `extraHeaders` | A string of newline separated extra headers to include on every request. | | |
|
||||
| `exportEnv` | Whether or not export secrets as environment variables. | `true` | |
|
||||
| `exportToken` | Whether or not export Vault token as environment variables (i.e VAULT_TOKEN). | `false` | |
|
||||
| `outputToken` | Whether or not to set the `vault_token` output to contain the Vault token after authentication. | `false` | |
|
||||
| `caCertificate` | Base64 encoded CA certificate the server certificate was signed with. | | |
|
||||
| `clientCertificate` | Base64 encoded client certificate the action uses to authenticate with Vault when mTLS is enabled. | | |
|
||||
| `clientKey` | Base64 encoded client key the action uses to authenticate with Vault when mTLS is enabled. | | |
|
||||
| `tlsSkipVerify` | When set to true, disables verification of server certificates when testing the action. | `false` | |
|
||||
|
||||
## Masking - Hiding Secrets from Logs
|
||||
|
||||
@@ -737,10 +505,9 @@ To make it simpler to consume certain secrets as env vars, if no Env/Output Var
|
||||
## Contributing
|
||||
|
||||
If you wish to contribute to this project, the following dependencies are recommended for local development:
|
||||
|
||||
- [npm](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm) to install dependencies, build project and run tests
|
||||
- [docker](https://docs.docker.com/get-docker/) to run the pre-configured vault containers for acceptance tests
|
||||
- [docker compose](https://docs.docker.com/compose/) to spin up the pre-configured vault containers for acceptance tests
|
||||
- [docker-compose](https://docs.docker.com/compose/) to spin up the pre-configured vault containers for acceptance tests
|
||||
- [act](https://github.com/nektos/act) to run the vault-action locally
|
||||
|
||||
### Build
|
||||
@@ -753,11 +520,11 @@ $ npm install && npm run build
|
||||
|
||||
### Vault test instance
|
||||
|
||||
The Github Action needs access to a working Vault instance to function.
|
||||
The Github Action needs access to a working Vault instance to function.
|
||||
Multiple docker configurations are available via the docker-compose.yml file to run containers compatible with the various acceptance test suites.
|
||||
|
||||
```sh
|
||||
$ docker compose up -d vault # Choose one of: vault, vault-enterprise, vault-tls depending on which tests you would like to run
|
||||
$ docker-compose up -d vault # Choose one of: vault, vault-enterprise, vault-tls depending on which tests you would like to run
|
||||
```
|
||||
|
||||
Instead of using one of the dockerized instance, you can also use your own local or remote Vault instance by exporting these environment variables:
|
||||
|
||||
+7
-17
@@ -1,7 +1,4 @@
|
||||
# Copyright IBM Corp. 2019, 2026
|
||||
# SPDX-License-Identifier: MIT
|
||||
|
||||
name: 'HashiCorp Vault'
|
||||
name: 'Vault Secrets'
|
||||
description: 'A Github Action that allows you to consume HashiCorp Vault™ secrets as secure environment variables'
|
||||
inputs:
|
||||
url:
|
||||
@@ -10,9 +7,6 @@ inputs:
|
||||
secrets:
|
||||
description: 'A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details'
|
||||
required: false
|
||||
pki:
|
||||
description: 'A semicolon-separated list of certificates to generate. These will automatically be converted to environment variable keys. Cannot be used with "secrets". See README for more details'
|
||||
required: false
|
||||
namespace:
|
||||
description: 'The Vault namespace from which to query secrets. Vault Enterprise only, unset by default'
|
||||
required: false
|
||||
@@ -24,16 +18,16 @@ inputs:
|
||||
description: 'Vault role for specified auth method'
|
||||
required: false
|
||||
path:
|
||||
description: 'The Vault path for the auth method.'
|
||||
description: 'Custom Vault path, if the auth method was mounted at a different path'
|
||||
required: false
|
||||
token:
|
||||
description: 'The Vault token to be used to authenticate with Vault'
|
||||
description: 'The Vault Token to be used to authenticate with Vault'
|
||||
required: false
|
||||
roleId:
|
||||
description: 'The role ID for App Role authentication'
|
||||
description: 'The Role Id for App Role authentication'
|
||||
required: false
|
||||
secretId:
|
||||
description: 'The secret ID for App Role authentication'
|
||||
description: 'The Secret Id for App Role authentication'
|
||||
required: false
|
||||
githubToken:
|
||||
description: 'The Github Token to be used to authenticate with Vault'
|
||||
@@ -67,7 +61,7 @@ inputs:
|
||||
default: 'false'
|
||||
required: false
|
||||
caCertificate:
|
||||
description: 'Base64 encoded CA certificate the server certificate was signed with. Defaults to CAs provided by Mozilla.'
|
||||
description: 'Base64 encoded CA certificate to verify the Vault server certificate.'
|
||||
required: false
|
||||
clientCertificate:
|
||||
description: 'Base64 encoded client certificate for mTLS communication with the Vault server.'
|
||||
@@ -95,12 +89,8 @@ inputs:
|
||||
secretEncodingType:
|
||||
description: 'The encoding type of the secret to decode. If not specified, the secret will not be decoded. Supported values: base64, hex, utf8'
|
||||
required: false
|
||||
ignoreNotFound:
|
||||
description: 'Whether or not the action should exit successfully if some requested secrets were not found.'
|
||||
required: false
|
||||
default: 'false'
|
||||
runs:
|
||||
using: 'node24'
|
||||
using: 'node16'
|
||||
main: 'dist/index.js'
|
||||
branding:
|
||||
icon: 'unlock'
|
||||
|
||||
Vendored
+55
-296
File diff suppressed because one or more lines are too long
+8
-38
@@ -1,63 +1,33 @@
|
||||
# Copyright IBM Corp. 2019, 2026
|
||||
# SPDX-License-Identifier: MIT
|
||||
|
||||
# Start vault server locally for the purposes of integration tests.
|
||||
version: "3.0"
|
||||
services:
|
||||
vault:
|
||||
image: hashicorp/vault:2.0.0
|
||||
image: hashicorp/vault:latest
|
||||
environment:
|
||||
VAULT_DEV_ROOT_TOKEN_ID: testtoken
|
||||
SKIP_SETCAP: "true"
|
||||
VAULT_LOCAL_CONFIG: '{"disable_mlock": true}'
|
||||
ports:
|
||||
- 8200:8200
|
||||
privileged: true
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "VAULT_ADDR=http://127.0.0.1:8200 vault status"]
|
||||
interval: 1s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
vault-enterprise:
|
||||
image: hashicorp/vault-enterprise:2.0-ent
|
||||
image: hashicorp/vault-enterprise:latest
|
||||
environment:
|
||||
VAULT_DEV_ROOT_TOKEN_ID: testtoken
|
||||
VAULT_LICENSE: ${VAULT_LICENSE_CI}
|
||||
SKIP_SETCAP: "true"
|
||||
VAULT_LOCAL_CONFIG: '{"disable_mlock": true}'
|
||||
ports:
|
||||
- 8200:8200
|
||||
privileged: true
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "VAULT_ADDR=http://127.0.0.1:8200 vault status"]
|
||||
interval: 1s
|
||||
timeout: 5s
|
||||
retries: 30
|
||||
vault-tls:
|
||||
image: hashicorp/vault:2.0.0
|
||||
image: hashicorp/vault:latest
|
||||
hostname: vault-tls
|
||||
environment:
|
||||
# Used by the vault CLI in the healthcheck to trust the CA
|
||||
VAULT_CAPATH: /etc/vault/ca.crt
|
||||
SKIP_SETCAP: "true"
|
||||
VAULT_LOCAL_CONFIG: '{"disable_mlock": true}'
|
||||
ports:
|
||||
- 8200:8200
|
||||
privileged: true
|
||||
healthcheck:
|
||||
# Exit 2 means sealed-but-running, which is acceptable during startup
|
||||
test:
|
||||
- CMD-SHELL
|
||||
- |
|
||||
export VAULT_ADDR=https://127.0.0.1:8200 VAULT_CACERT=/etc/vault/ca.crt VAULT_CLIENT_CERT=/etc/vault/client.crt VAULT_CLIENT_KEY=/etc/vault/client.key
|
||||
vault status; s=$$?; [ $$s -eq 0 ] || [ $$s -eq 2 ]
|
||||
interval: 1s
|
||||
timeout: 5s
|
||||
retries: 30
|
||||
volumes:
|
||||
# Certs generated by scripts/gen-tls-certs.sh into .build/certs/
|
||||
- ${PWD}/.build/certs:/etc/vault
|
||||
# tmpfs gives the non-root vault user write access without chown tricks;
|
||||
# ephemeral storage is fine since tests always reinitialize vault from scratch
|
||||
tmpfs: /var/lib/vault
|
||||
- ${PWD}/integrationTests/e2e-tls/configs:/etc/vault
|
||||
- vault-data:/var/lib/vault:rw
|
||||
entrypoint: vault server -config=/etc/vault/config.hcl
|
||||
|
||||
volumes:
|
||||
vault-data:
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
const core = require('@actions/core');
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
const core = require('@actions/core');
|
||||
@@ -36,22 +31,6 @@ describe('integration', () => {
|
||||
},
|
||||
});
|
||||
|
||||
await got(`${vaultUrl}/v1/secret/data/test-with-dot-char`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
body: `{"data":{"secret.foo":"SUPERSECRET"}}`
|
||||
});
|
||||
|
||||
await got(`${vaultUrl}/v1/secret/data/test-with-multi-dot-chars`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
body: `{"data":{"secret.foo.bar":"SUPERSECRET"}}`
|
||||
});
|
||||
|
||||
await got(`${vaultUrl}/v1/secret/data/nested/test`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
@@ -125,69 +104,6 @@ describe('integration', () => {
|
||||
"other-Secret-dash": 'OTHERCUSTOMSECRET',
|
||||
},
|
||||
});
|
||||
|
||||
// Enable pki engine
|
||||
try {
|
||||
await got(`${vaultUrl}/v1/sys/mounts/pki`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
json: {
|
||||
type: 'pki'
|
||||
}
|
||||
});
|
||||
} catch (error) {
|
||||
const {response} = error;
|
||||
if (response.statusCode === 400 && response.body.includes("path is already in use")) {
|
||||
// Engine might already be enabled from previous test runs
|
||||
} else {
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
// Configure Root CA
|
||||
try {
|
||||
await got(`${vaultUrl}/v1/pki/root/generate/internal`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
json: {
|
||||
common_name: 'test',
|
||||
ttl: '24h',
|
||||
},
|
||||
});
|
||||
} catch (error) {
|
||||
const {response} = error;
|
||||
if (response.statusCode === 400 && response.body.includes("already exists")) {
|
||||
// Root CA might already be configured from previous test runs
|
||||
} else {
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
// Configure PKI Role
|
||||
try {
|
||||
await got(`${vaultUrl}/v1/pki/roles/Test`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
json: {
|
||||
allowed_domains: ['test'],
|
||||
allow_bare_domains: true,
|
||||
max_ttl: '1h',
|
||||
},
|
||||
});
|
||||
} catch (error) {
|
||||
const {response} = error;
|
||||
if (response.statusCode === 400 && response.body.includes("already exists")) {
|
||||
// Role might already be configured from previous test runs
|
||||
} else {
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
@@ -208,55 +124,14 @@ describe('integration', () => {
|
||||
.mockReturnValueOnce(secrets);
|
||||
}
|
||||
|
||||
function mockPkiInput(pki) {
|
||||
when(core.getInput)
|
||||
.calledWith('pki', expect.anything())
|
||||
.mockReturnValueOnce(pki);
|
||||
}
|
||||
|
||||
function mockIgnoreNotFound(shouldIgnore) {
|
||||
when(core.getInput)
|
||||
.calledWith('ignoreNotFound', expect.anything())
|
||||
.mockReturnValueOnce(shouldIgnore);
|
||||
}
|
||||
|
||||
|
||||
it('prints a nice error message when secret not found', async () => {
|
||||
mockInput(`secret/data/test secret ;
|
||||
secret/data/test secret | NAMED_SECRET ;
|
||||
secret/data/notFound kehe | NO_SIR ;`);
|
||||
|
||||
await expect(exportSecrets()).rejects.toEqual(Error(`Unable to retrieve result for "secret/data/notFound" because it was not found: {"errors":[]}`));
|
||||
expect(exportSecrets()).rejects.toEqual(Error(`Unable to retrieve result for "secret/data/notFound" because it was not found: {"errors":[]}`));
|
||||
})
|
||||
|
||||
it('does not error when secret not found and ignoreNotFound is true', async () => {
|
||||
mockInput(`secret/data/test secret ;
|
||||
secret/data/test secret | NAMED_SECRET ;
|
||||
secret/data/notFound kehe | NO_SIR ;`);
|
||||
|
||||
mockIgnoreNotFound("true");
|
||||
|
||||
await exportSecrets();
|
||||
|
||||
expect(core.exportVariable).toBeCalledTimes(2);
|
||||
|
||||
expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
|
||||
expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET');
|
||||
})
|
||||
|
||||
it('gets a pki certificate', async () => {
|
||||
mockPkiInput('pki/issue/Test {"common_name":"test","ttl":"1h"}');
|
||||
|
||||
await exportSecrets();
|
||||
|
||||
expect(core.exportVariable).toBeCalledTimes(4);
|
||||
|
||||
expect(core.exportVariable).toBeCalledWith('TEST_KEY', expect.anything());
|
||||
expect(core.exportVariable).toBeCalledWith('TEST_CERT', expect.anything());
|
||||
expect(core.exportVariable).toBeCalledWith('TEST_CA', expect.anything());
|
||||
expect(core.exportVariable).toBeCalledWith('TEST_CA_CHAIN', expect.anything());
|
||||
});
|
||||
|
||||
it('get simple secret', async () => {
|
||||
mockInput('secret/data/test secret');
|
||||
|
||||
@@ -296,26 +171,6 @@ describe('integration', () => {
|
||||
expect(core.exportVariable).toBeCalledWith('OTHERSECRETDASH', 'OTHERSUPERSECRET');
|
||||
});
|
||||
|
||||
it('get wildcard secrets with dot char', async () => {
|
||||
mockInput(`secret/data/test-with-dot-char * ;`);
|
||||
|
||||
await exportSecrets();
|
||||
|
||||
expect(core.exportVariable).toBeCalledTimes(1);
|
||||
|
||||
expect(core.exportVariable).toBeCalledWith('SECRET__FOO', 'SUPERSECRET');
|
||||
});
|
||||
|
||||
it('get secrets with multiple dot chars', async () => {
|
||||
mockInput(`secret/data/test-with-multi-dot-chars * ;`);
|
||||
|
||||
await exportSecrets();
|
||||
|
||||
expect(core.exportVariable).toBeCalledTimes(1);
|
||||
|
||||
expect(core.exportVariable).toBeCalledWith('SECRET__FOO__BAR', 'SUPERSECRET');
|
||||
});
|
||||
|
||||
it('get wildcard secrets', async () => {
|
||||
mockInput(`secret/data/test * ;`);
|
||||
|
||||
@@ -418,7 +273,7 @@ describe('integration', () => {
|
||||
expect(core.exportVariable).toBeCalledWith('FOO', 'bar');
|
||||
});
|
||||
|
||||
it('wildcard supports cubbyhole with uppercase transform', async () => {
|
||||
it('wildcard supports cubbyhole', async () => {
|
||||
mockInput('/cubbyhole/test *');
|
||||
|
||||
await exportSecrets();
|
||||
@@ -428,32 +283,6 @@ describe('integration', () => {
|
||||
expect(core.exportVariable).toBeCalledWith('FOO', 'bar');
|
||||
expect(core.exportVariable).toBeCalledWith('ZIP', 'zap');
|
||||
});
|
||||
|
||||
it('wildcard supports cubbyhole with no change in case', async () => {
|
||||
mockInput('/cubbyhole/test **');
|
||||
|
||||
await exportSecrets();
|
||||
|
||||
expect(core.exportVariable).toBeCalledTimes(2);
|
||||
|
||||
expect(core.exportVariable).toBeCalledWith('foo', 'bar');
|
||||
expect(core.exportVariable).toBeCalledWith('zip', 'zap');
|
||||
});
|
||||
|
||||
it('wildcard supports cubbyhole with mixed case change', async () => {
|
||||
mockInput(`
|
||||
/cubbyhole/test * ;
|
||||
/cubbyhole/test **`);
|
||||
|
||||
await exportSecrets();
|
||||
|
||||
expect(core.exportVariable).toBeCalledTimes(4);
|
||||
|
||||
expect(core.exportVariable).toBeCalledWith('FOO', 'bar');
|
||||
expect(core.exportVariable).toBeCalledWith('ZIP', 'zap');
|
||||
expect(core.exportVariable).toBeCalledWith('foo', 'bar');
|
||||
expect(core.exportVariable).toBeCalledWith('zip', 'zap');
|
||||
});
|
||||
|
||||
it('caches responses', async () => {
|
||||
mockInput(`
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
module.exports = {
|
||||
verbose: true
|
||||
};
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
const core = require('@actions/core');
|
||||
@@ -102,8 +97,6 @@ describe('jwt auth', () => {
|
||||
}
|
||||
});
|
||||
|
||||
// write the jwt config, the jwt role will be written on a per-test
|
||||
// basis since the audience may vary
|
||||
await got(`${vaultUrl}/v1/auth/jwt/config`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
@@ -115,6 +108,22 @@ describe('jwt auth', () => {
|
||||
}
|
||||
});
|
||||
|
||||
await got(`${vaultUrl}/v1/auth/jwt/role/default`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
json: {
|
||||
role_type: 'jwt',
|
||||
bound_audiences: null,
|
||||
bound_claims: {
|
||||
iss: 'vault-action'
|
||||
},
|
||||
user_claim: 'iss',
|
||||
policies: ['reader']
|
||||
}
|
||||
});
|
||||
|
||||
await got(`${vaultUrl}/v1/secret/data/test`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
@@ -129,24 +138,6 @@ describe('jwt auth', () => {
|
||||
});
|
||||
|
||||
describe('authenticate with private key', () => {
|
||||
beforeAll(async () => {
|
||||
await got(`${vaultUrl}/v1/auth/jwt/role/default`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
json: {
|
||||
role_type: 'jwt',
|
||||
bound_audiences: null,
|
||||
bound_claims: {
|
||||
iss: 'vault-action'
|
||||
},
|
||||
user_claim: 'iss',
|
||||
policies: ['reader']
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
jest.resetAllMocks();
|
||||
|
||||
@@ -179,22 +170,6 @@ describe('jwt auth', () => {
|
||||
|
||||
describe('authenticate with Github OIDC', () => {
|
||||
beforeAll(async () => {
|
||||
await got(`${vaultUrl}/v1/auth/jwt/role/default`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
json: {
|
||||
role_type: 'jwt',
|
||||
bound_audiences: 'https://github.com/hashicorp/vault-action',
|
||||
bound_claims: {
|
||||
iss: 'vault-action'
|
||||
},
|
||||
user_claim: 'iss',
|
||||
policies: ['reader']
|
||||
}
|
||||
});
|
||||
|
||||
await got(`${vaultUrl}/v1/auth/jwt/role/default-sigstore`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
@@ -202,7 +177,7 @@ describe('jwt auth', () => {
|
||||
},
|
||||
json: {
|
||||
role_type: 'jwt',
|
||||
bound_audiences: 'sigstore',
|
||||
bound_audiences: null,
|
||||
bound_claims: {
|
||||
iss: 'vault-action',
|
||||
aud: 'sigstore',
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
const privateRsaKey = `
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEArcch89X6VuWj/CQtVfaCXUl0Pcv8IJRgICN8X+3zFNrbiTdh
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
const core = require('@actions/core');
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEFjCCAv6gAwIBAgIUe0i7/HGZKvbDb30L9mC99KXFwj8wDQYJKoZIhvcNAQEL
|
||||
BQAwgaIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
|
||||
Ew1TYW4gRnJhbmNpc2NvMRIwEAYDVQQKEwlIYXNoaUNvcnAxIzAhBgNVBAsTGlRl
|
||||
c3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MS0wKwYDVQQDEyRQcm90b3R5cGUgVGVz
|
||||
dCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMjAwODA1MTg1MjAwWhcNMjUwODA0
|
||||
MTg1MjAwWjCBojELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAU
|
||||
BgNVBAcTDVNhbiBGcmFuY2lzY28xEjAQBgNVBAoTCUhhc2hpQ29ycDEjMCEGA1UE
|
||||
CxMaVGVzdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxLTArBgNVBAMTJFByb3RvdHlw
|
||||
ZSBUZXN0IENlcnRpZmljYXRlIEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEBBQAD
|
||||
ggEPADCCAQoCggEBAMrRXuu2+zhBs0pLYEdXIaPc4KoWO3xm2RJdbzy3hfjFybQ8
|
||||
H/Y6Hi7txjGGSb45xSfXT/RF2srNfs235I+sfB8rrEizNpzkXqOgGa8LKvh2tgBT
|
||||
BK/jDWsEdDhxmkpFhE69wEW+D5ub7QGnx9jrqLKfwCmUA0utlzcFBk2nRNhRtsrp
|
||||
CI5YL1VN4coLpgXdvbodzbynPzGHe9R/o9K0Uiz2hgHooyKwhkVYwo0BIAQamLFz
|
||||
TS7lyeLf0thDOxV31NX8SpSucqRf50WHNk8T/YtKZ9EhlBDT4ybZwwvcC/ocxxcg
|
||||
1LvB0YweZNjSeO78S4CMh1TFGXnF/xOtGABlIbcCAwEAAaNCMEAwDgYDVR0PAQH/
|
||||
BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFABD/NxvYLpo5zVNeD01
|
||||
r8IIFYlBMA0GCSqGSIb3DQEBCwUAA4IBAQB7TfpIx53gf/oI3mgR6Ciz287WBzFR
|
||||
OzhJXwHk5J3mx8VC1W8tDRXih2lCLd/f9qDy6LyL/hZcoonev6w9oReuOMBiH6l4
|
||||
Pf3yq2aDXX0AoGgm75c1m34kY669JLMsHq5+xuUDeeFUMd60w9zVtZfBSumy/sgN
|
||||
PdjtvThh8sSByocYULs3tuxZDGyQ6GyQcn/xlMrGtmcD5IuX5IXqcKRVlZttykNx
|
||||
S2ltcR00fekw8WZyPSzMJaP+/Kcq3T2viN02MS6qEycQZoYfEAMdj+A0kjbsZG9D
|
||||
6J92z78b2DuLAUvZVpynNk/UbpDeqIDy40V3JDmtvrfGUMkMhMqgK/+J
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,25 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIENTCCAx2gAwIBAgIUMu5h1ysA5DlM6lzZFliT2C2n4lEwDQYJKoZIhvcNAQEL
|
||||
BQAwgaIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
|
||||
Ew1TYW4gRnJhbmNpc2NvMRIwEAYDVQQKEwlIYXNoaUNvcnAxIzAhBgNVBAsTGlRl
|
||||
c3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MS0wKwYDVQQDEyRQcm90b3R5cGUgVGVz
|
||||
dCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwIBcNMjAwODA1MTg1MjAwWhgPMjEyMDA3
|
||||
MTIxODUyMDBaMIGMMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEW
|
||||
MBQGA1UEBxMNU2FuIEZyYW5jaXNjbzESMBAGA1UEChMJSGFzaGlDb3JwMSMwIQYD
|
||||
VQQLExpUZXN0IENlcnRpZmljYXRlIEF1dGhvcml0eTEXMBUGA1UEAxMOaGFzaGlj
|
||||
b3JwLnRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC/zYDKdDGo
|
||||
+Qy7eJUNjOe6jpeGvK1lMu5T1Xka+h2ay6WH5gLyrPw5pi582iYpJdHVbplKMywx
|
||||
LxZv7mAbKNxqdp8UZKy0A3bCuHQqRF8ssXXHufQ8EGxNkLMLJP0e2q39OnrxXekS
|
||||
8Ct3aJm3V8qkcV3CpVdPNgJh4TSuneCXIxVWjFYSiyHi0/5TRd2D+aQPz12szg5F
|
||||
mBW4dLzYKHEMlWcjWG8mxtbLyt+jSR1+tSehQx7KndufdfniOWEDBdbeR3yDnZdn
|
||||
p8DnRWK4oaEI3Sl8tKlDd1Yp+R96aqOEn1tPW6Jy6Vdvk3fCefclbWZ6B9kiJ/1r
|
||||
gxq7AN7iKmHNAgMBAAGjdTBzMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggr
|
||||
BgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRn2mwyk+MPChnLg0iWy1r9
|
||||
b3JvwTAfBgNVHSMEGDAWgBQAQ/zcb2C6aOc1TXg9Na/CCBWJQTANBgkqhkiG9w0B
|
||||
AQsFAAOCAQEAOpCy0vHp1Kxgv0VBRrbrwSQLBGP8a1ubVWoeoZQ+EvX9ozqDrHxm
|
||||
gM4XPYUJlUOOEu0ZRgCW60YK33E1zNKnA1F0/3/rmqMkKnm0BBs/5WzMWtsIBPcU
|
||||
e0CeJmaRIXnERQMH/svD+RrFo1dcF8rUDIlWez7+xGqoIGBg7v4jEmkZ3HdckcE+
|
||||
/xvC61YSG8NsJwR/CEcQ8YCyVfgvuS0ukWs4dN15aVDL3Oe61h3bRcGAywOJBrdq
|
||||
9xaq7ezZp/+lUSkYnatWJBuC/aviH9g9s+gMT0I3fWHh8BB0Ne2txwJ15K/qz5he
|
||||
TjxFsumrh50aFqjSiEHndtY5UWuGAFLiSw==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEAv82AynQxqPkMu3iVDYznuo6XhrytZTLuU9V5Gvodmsulh+YC
|
||||
8qz8OaYufNomKSXR1W6ZSjMsMS8Wb+5gGyjcanafFGSstAN2wrh0KkRfLLF1x7n0
|
||||
PBBsTZCzCyT9Htqt/Tp68V3pEvArd2iZt1fKpHFdwqVXTzYCYeE0rp3glyMVVoxW
|
||||
Eosh4tP+U0Xdg/mkD89drM4ORZgVuHS82ChxDJVnI1hvJsbWy8rfo0kdfrUnoUMe
|
||||
yp3bn3X54jlhAwXW3kd8g52XZ6fA50ViuKGhCN0pfLSpQ3dWKfkfemqjhJ9bT1ui
|
||||
culXb5N3wnn3JW1megfZIif9a4MauwDe4iphzQIDAQABAoIBAQCYHJuidAoaTwGZ
|
||||
ACV9rJzuqD1lvubpFj5KwEcebPPjmtQ5deIqoaQa+D9wBvYyteq3ENKDNRg8HXL2
|
||||
7B7OC1bbHB5HZxxMW17pSK3gA39Ti52z+zbGF+Q8k6BbG0efG6DW7nUoTOkWeuCN
|
||||
/6fA7uAoEDxirQwUJuo2xAsq3MyMLwcs95rke9Bly8ABFNaV1oMZq8YT/w8oSc2b
|
||||
/7WtxXmChHlVYXTcMqzVPqNFqPRixZRWQ+BSHoXmEDviuGd51L4s9D7iXp32TvUx
|
||||
DMHeS1DFA2en7ZF1uc9VXZeplkkDtVhUe4d6qOqCcUwDFEvMonnyVSa6/FkR5jYZ
|
||||
2yujTdfhAoGBAM0hGOnmnDnCjADUt4mZlr+Mf0XmdKzEV+hid4CQUvBoTXgjYMvv
|
||||
c397eNePce7SwSUE1/APERInGUPhRLVFW5q6/34WRtGBbQkT8ByeJANXes4UFZe3
|
||||
wdNLczWUlSl0G3jTf+Kh3+K5/PtmyxSrAS/9GIk+ibs1mlJOPyVnWqUJAoGBAO9e
|
||||
WlP9/ruXluvkQyM5ZlnAnZYMsFGzzPx4tkazUjurtqxQoyZ0z+pPItGQ7lOl+pDA
|
||||
EWiTun66g+Da9uBiBCJUeXiC1ge2p6bT6N194BrYyrWML9hcIL4mqVojUEUmhnSh
|
||||
6b9h1pC7vFmw5ZFMIIkS60cfBMgQMZxMJN8NuaulAoGBAJM5hwURg90c2ZkbEyPK
|
||||
PVz7fLlxnxoEzcc3LOf0LeLoKXnpgma8VJwRxXiJNs+fKgrkwAtG9QyfTU3f1412
|
||||
2zlhr1ASsv9ZMiXKzpHrmpNfbP+NgLXkqFN7mpPBMZGQCMuemPHTFrpGnODfNTB/
|
||||
T5newIZ4gSgBX+Jk0IOK+47pAoGAeKo6pK6ck9pV5TIbOg18b/AuQG7DD1yxD/CW
|
||||
CkvpP1VPb8vygrdN/FLKPZRu39IC3qdD31DhKXNCeb5Hx1MBvICS/1INLLRCDVIz
|
||||
yDvlFgOFJEG3+LxwcQqyQlMc6s8B5pecarKaZDmPODN5dmZG3HKiEicr1OJ878pe
|
||||
p+aWW1UCgYBmGFbCc1qqlqp+srYGsv3rIgNs5HSfrAjbgY8xh9foMgrYCRAm57gv
|
||||
01yVxMXWmKA6ReVEu8OTVy9fkuOL/vw2o+C6W4IPZYdvSQoPwd5Lf+AqxEQvFF1m
|
||||
tT3SZAM3EhQ7tIXdIQHY27SJ1KlUJMrvUq1CiRWiG/MOKf/87JXPog==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -1,6 +1,3 @@
|
||||
# Copyright IBM Corp. 2019, 2026
|
||||
# SPDX-License-Identifier: MIT
|
||||
|
||||
ui = false
|
||||
disable_mlock = true
|
||||
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEXjCCA0agAwIBAgIUAswquazrfsyDRvXZwn5718DUhU4wDQYJKoZIhvcNAQEL
|
||||
BQAwgaIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
|
||||
Ew1TYW4gRnJhbmNpc2NvMRIwEAYDVQQKEwlIYXNoaUNvcnAxIzAhBgNVBAsTGlRl
|
||||
c3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MS0wKwYDVQQDEyRQcm90b3R5cGUgVGVz
|
||||
dCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwIBcNMjAwODA1MTg1MjAwWhgPMjEyMDA3
|
||||
MTIxODUyMDBaMIGMMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEW
|
||||
MBQGA1UEBxMNU2FuIEZyYW5jaXNjbzESMBAGA1UEChMJSGFzaGlDb3JwMSMwIQYD
|
||||
VQQLExpUZXN0IENlcnRpZmljYXRlIEF1dGhvcml0eTEXMBUGA1UEAxMOaGFzaGlj
|
||||
b3JwLnRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0azdZsrPC
|
||||
5Rv8nRxVJnLi+oZgCJYgzhCDiEbYqt1QK1gqNXp0ml5ck6ycj0drwzHzrrX+xcPV
|
||||
5FcNKH3RFyon9XkzjwaXkMv6IkgvH6/jQ1dDW9kWBf3Io3Y59wnD/YaIzNK0CYJS
|
||||
fRNdsZb4InH8gh+RL33+FeysgJwXG1TVA4tTUj7DQxDE0cDd9UD+C9Yx7OWiUjC1
|
||||
IjqdFPusX1nziKYjeI5/UiCmOUGqJJRoMPonuzuGIj9GdmBKmga64OfeZFqn4f6a
|
||||
ay61VnGCwZ24VniUwYElsFbcF2Nv9WqnrOeQlHOsYN68VMqHzaYPqE6SPa6mO5mI
|
||||
/tmpXrDG3Y+RAgMBAAGjgZ0wgZowDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoG
|
||||
CCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFE03/UTs2ZmJpWHSmstt
|
||||
hDngW6F3MB8GA1UdIwQYMBaAFABD/NxvYLpo5zVNeD01r8IIFYlBMCUGA1UdEQQe
|
||||
MByCCWxvY2FsaG9zdIIJdmF1bHQtdGxzhwR/AAABMA0GCSqGSIb3DQEBCwUAA4IB
|
||||
AQCzarBGJium5oZDSSP5GqxpS13QP2onEen6I1k2eRdcOqtbfNdQ20RJrb4dfNkE
|
||||
Dc09KWVlZAn+hYge2KKTXJ+4ltIC9V1LvquyWipNczOT1ve0H9gt3Wm88LdESqI5
|
||||
HOx43pIaa3cWXBlbzrFmT1SASYm1V5Oo1mXzpUukGokHLLmAz36VVuJGbD0BxYke
|
||||
5MefG4tNT1SsMsIqVvGxI9NiVs7YTdJu81MctSYK5snsEKnYdi9N7CHOk3bdDpeC
|
||||
v2Vo7XBk3s4sBMGmnJO+1JOcRFJioooEFkqNyQmg3atfInysVbreKS5KtWNTaCPm
|
||||
yI55plW8ga5ucja2VX3WbwAO
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEAtGs3WbKzwuUb/J0cVSZy4vqGYAiWIM4Qg4hG2KrdUCtYKjV6
|
||||
dJpeXJOsnI9Ha8Mx8661/sXD1eRXDSh90RcqJ/V5M48Gl5DL+iJILx+v40NXQ1vZ
|
||||
FgX9yKN2OfcJw/2GiMzStAmCUn0TXbGW+CJx/IIfkS99/hXsrICcFxtU1QOLU1I+
|
||||
w0MQxNHA3fVA/gvWMezlolIwtSI6nRT7rF9Z84imI3iOf1IgpjlBqiSUaDD6J7s7
|
||||
hiI/RnZgSpoGuuDn3mRap+H+mmsutVZxgsGduFZ4lMGBJbBW3Bdjb/Vqp6znkJRz
|
||||
rGDevFTKh82mD6hOkj2upjuZiP7ZqV6wxt2PkQIDAQABAoIBAQCvK0HsVvLtkSCh
|
||||
HbF6gwAcnHyHFQ8d/rRN4KxYhVynD85j/NRODer8G20F/J6tZDFFlSWinUTMkQxr
|
||||
/BpcPg9yCIWKp50Q30cMLujCyBMvphw9jBmzplGG0h5hnRbgMXDDtYoFvw3HJST+
|
||||
XQRlGpxtO7GGdwPvBD5sJdpnHOQ6g7qIYKmlHM99kHU8vr0VghqZAYxEh8RpnYez
|
||||
NLra+7ep+Zp1pFIniU6B8ohyL3OArbQ65qYrZYriAEI5HeEk0RhjewcPsV56LwbS
|
||||
CncTVS/dNYgk1zRIvytmbDVD3v/4lLvnpIWeKVdk7p1aGJeCdpLeWNvDLX0Ws67r
|
||||
QeZQizwhAoGBAMwAIA6+HPsx+8dhNbN3ydX8YU6uUfSeshhshIFZPIYL2vrKyAHU
|
||||
/GAYVzYJH/cU0IvlLJlLdQuiZkOXEX87tgdfmM/o4Qdl12RR0BvU0Cae0txtzNrP
|
||||
yTdfZqDhTz/V8jOAXUNA5oQA45Y3rI7JES8hBd1F9WFOH2WINp344GzlAoGBAOJo
|
||||
SgmRE24VcnfUMqrBpwZBdBrTxDQyTagvd+MuGomIQfcE2Y4rr1eIuJJ0HF5/eYxc
|
||||
DZRO/LVP9tQ8ozXi2tdmgUdKC79O2edmdOCWW5of464R/TLcM5B4SmS36RtdE3qJ
|
||||
ig4fcUmsJ15MAGpkXLMh5YSD/N3TmcnURtx06Fk9AoGATi+mGcBnnybzFuF9EYHR
|
||||
y7/lE6DgLF8+ZvoAdwralY2pqgFaUslsyO/LTRyGMc66d0OoqkAvZfwiMbmOrTMX
|
||||
ew/6o4Tf6lPwD7UDjAcul/67VlyG7T5CIoTf8r0oAJFhOLf0BrizINiuYX6JFlid
|
||||
y3BerQYJG/gzNFjWhglDCrkCgYA+3wUISRAjNrN10ShMwL/3/b8XIA1RDVMBTEU3
|
||||
gfr+jCb9SIx9bWYgoafXi4TBPRbswjdHIvQMCWuankgYU6m/vQhTWp2Of4AFQS9d
|
||||
moNPdmGMWhR8xidPjAfklimWXq9lDMKYj2SvN64rAmHvKXWQjO4mcVyL4RHIuTkA
|
||||
STqoZQKBgQDKHd8F6tjZHEFolmjS5l682g7zVTpBhozezJ/RqYvhJh5ew1pXoD/O
|
||||
Zu9iMfHoDjR4ZUXq6aeLUj/oIt1AsjwaGChOLLAvFbvePgS9XkYkwIlaxS4efAya
|
||||
+CQE/JmY/a1/c2MDLNMCEXvUqX68pv6iDF8pfn+i4tn0omYqgfUlCA==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
describe('e2e-tls', () => {
|
||||
it('verify', () => {
|
||||
expect(process.env.SECRET).toBe("SUPERSECRET");
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
module.exports = {
|
||||
verbose: true
|
||||
};
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
const got = require('got');
|
||||
const core = require('@actions/core');
|
||||
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
describe('e2e', () => {
|
||||
it('verify', () => {
|
||||
expect(process.env.SECRET).toBe("SUPERSECRET");
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
module.exports = {
|
||||
verbose: true
|
||||
};
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
const got = require('got');
|
||||
|
||||
const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
const core = require('@actions/core');
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
module.exports = {
|
||||
verbose: true
|
||||
};
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
module.exports = {
|
||||
testPathIgnorePatterns: ['/node_modules/', '<rootDir>/integrationTests/'],
|
||||
};
|
||||
|
||||
Generated
+1714
-2005
File diff suppressed because it is too large
Load Diff
+5
-5
@@ -36,16 +36,16 @@
|
||||
"dependencies": {
|
||||
"got": "^11.8.6",
|
||||
"jsonata": "^2.0.3",
|
||||
"jsrsasign": "^11.1.0"
|
||||
"jsrsasign": "^10.8.6"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"@actions/core": ">=1 <2"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@actions/core": "^1.10.1",
|
||||
"@vercel/ncc": "^0.38.1",
|
||||
"jest": "^29.7.0",
|
||||
"jest-when": "^3.6.0",
|
||||
"@actions/core": "^1.10.0",
|
||||
"@vercel/ncc": "^0.36.1",
|
||||
"jest": "^29.5.0",
|
||||
"jest-when": "^3.5.2",
|
||||
"mock-http-server": "^1.4.5"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,35 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Copyright IBM Corp. 2019, 2025
|
||||
# SPDX-License-Identifier: MIT
|
||||
|
||||
# Adapted from: https://github.com/hashicorp/vault-secrets-operator/blob/main/hack/.functions
|
||||
|
||||
# getGH downloads files from GitHub with optional authentication
|
||||
# Usage: getGH <url> [dest_file] [num_retries]
|
||||
function getGH() {
|
||||
local url="$1"
|
||||
local dest="$2"
|
||||
local num_retries="${3:-${GH_GET_RETRIES}}"
|
||||
|
||||
headers=(
|
||||
'--header' "Accept: application/vnd.github+json"
|
||||
'--header' "X-GitHub-Api-Version: 2022-11-28"
|
||||
)
|
||||
if [ -n "${GITHUB_TOKEN}" ]; then
|
||||
headers+=(
|
||||
'--header' "Authorization: Bearer ${GITHUB_TOKEN}"
|
||||
)
|
||||
fi
|
||||
cmd=curl
|
||||
opts=('-sfSL')
|
||||
echo "Fetching ${url}"
|
||||
if [ -z "${dest}" ]; then
|
||||
opts+=('-O')
|
||||
else
|
||||
opts+=('-o' "${dest}")
|
||||
fi
|
||||
if [ -n "${num_retries}" ]; then
|
||||
opts+=('--retry' "${num_retries}")
|
||||
fi
|
||||
${cmd} "${opts[@]}" "${headers[@]}" "${url}"
|
||||
}
|
||||
@@ -1,112 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Copyright IBM Corp. 2019, 2025
|
||||
# SPDX-License-Identifier: MIT
|
||||
#
|
||||
# Generates a PKI chain (CA, server cert, client cert) using cfssl.
|
||||
# Outputs certs to .build/certs/ and writes .build/e2e-tls.env for local
|
||||
# act usage (act --env-file .build/e2e-tls.env).
|
||||
#
|
||||
# Usage: ./scripts/gen-tls-certs.sh
|
||||
# Requires: cfssl, cfssljson (brew install cfssl)
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
pushd "$(git rev-parse --show-toplevel || echo .)" > /dev/null
|
||||
|
||||
OUTDIR=".build/certs"
|
||||
ENVFILE=".build/e2e-tls.env"
|
||||
|
||||
if ! command -v cfssl &>/dev/null || ! command -v cfssljson &>/dev/null; then
|
||||
echo "error: cfssl and cfssljson are required." >&2
|
||||
popd > /dev/null
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p "$OUTDIR"
|
||||
pushd "$OUTDIR" > /dev/null
|
||||
|
||||
# ── cfssl signing config ──────────────────────────────────────────────────────
|
||||
cat > cfssl-config.json <<'EOF'
|
||||
{
|
||||
"signing": {
|
||||
"default": { "expiry": "8760h" },
|
||||
"profiles": {
|
||||
"server": {
|
||||
"usages": ["signing", "key encipherment", "server auth"],
|
||||
"expiry": "8760h"
|
||||
},
|
||||
"client": {
|
||||
"usages": ["signing", "key encipherment", "client auth"],
|
||||
"expiry": "8760h"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# ── CA ────────────────────────────────────────────────────────────────────────
|
||||
echo "Generating CA..."
|
||||
cfssl gencert -initca - <<'EOF' | cfssljson -bare ca
|
||||
{
|
||||
"CN": "Vault Test CA",
|
||||
"key": { "algo": "rsa", "size": 2048 },
|
||||
"ca": { "expiry": "87600h" }
|
||||
}
|
||||
EOF
|
||||
|
||||
# ── Server cert ───────────────────────────────────────────────────────────────
|
||||
echo "Generating server certificate..."
|
||||
cfssl gencert \
|
||||
-ca=ca.pem \
|
||||
-ca-key=ca-key.pem \
|
||||
-config=cfssl-config.json \
|
||||
-profile=server - <<'EOF' | cfssljson -bare server
|
||||
{
|
||||
"CN": "vault-tls",
|
||||
"hosts": ["localhost", "127.0.0.1", "vault-tls"],
|
||||
"key": { "algo": "rsa", "size": 2048 }
|
||||
}
|
||||
EOF
|
||||
|
||||
# ── Client cert ───────────────────────────────────────────────────────────────
|
||||
echo "Generating client certificate..."
|
||||
cfssl gencert \
|
||||
-ca=ca.pem \
|
||||
-ca-key=ca-key.pem \
|
||||
-config=cfssl-config.json \
|
||||
-profile=client - <<'EOF' | cfssljson -bare client
|
||||
{
|
||||
"CN": "vault-client",
|
||||
"key": { "algo": "rsa", "size": 2048 }
|
||||
}
|
||||
EOF
|
||||
|
||||
# ── Rename to names expected by vault config ──────────────────────────────────
|
||||
mv ca.pem ca.crt
|
||||
mv server.pem server.crt
|
||||
mv server-key.pem server.key
|
||||
mv client.pem client.crt
|
||||
mv client-key.pem client.key
|
||||
|
||||
# ── Remove intermediates not needed at runtime ────────────────────────────────
|
||||
rm -f ca.csr server.csr client.csr ca-key.pem cfssl-config.json
|
||||
|
||||
# Ensure files are readable by the vault container user
|
||||
chmod 644 ./*.crt ./*.key
|
||||
|
||||
popd > /dev/null
|
||||
|
||||
# ── Copy vault server config ──────────────────────────────────────────────────
|
||||
cp "integrationTests/e2e-tls/configs/config.hcl" "$OUTDIR/config.hcl"
|
||||
|
||||
# ── Write env file for local act usage ───────────────────────────────────────
|
||||
{
|
||||
printf 'VAULTCA=%s\n' "$(base64 < "$OUTDIR/ca.crt" | tr -d '\n')"
|
||||
printf 'VAULT_CLIENT_CERT=%s\n' "$(base64 < "$OUTDIR/client.crt" | tr -d '\n')"
|
||||
printf 'VAULT_CLIENT_KEY=%s\n' "$(base64 < "$OUTDIR/client.key" | tr -d '\n')"
|
||||
} > "$ENVFILE"
|
||||
|
||||
echo "Certs generated in $OUTDIR"
|
||||
echo "Env file written to $ENVFILE"
|
||||
|
||||
popd > /dev/null
|
||||
+9
-61
@@ -1,17 +1,12 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
// @ts-check
|
||||
const core = require('@actions/core');
|
||||
const command = require('@actions/core/lib/command');
|
||||
const got = require('got').default;
|
||||
const jsonata = require('jsonata');
|
||||
const { normalizeOutputKey } = require('./utils');
|
||||
const { WILDCARD, WILDCARD_UPPERCASE } = require('./constants');
|
||||
const { WILDCARD } = require('./constants');
|
||||
|
||||
const { auth: { retrieveToken }, secrets: { getSecrets }, pki: { getCertificates } } = require('./index');
|
||||
const { auth: { retrieveToken }, secrets: { getSecrets } } = require('./index');
|
||||
|
||||
const AUTH_METHODS = ['approle', 'token', 'github', 'jwt', 'kubernetes', 'ldap', 'userpass'];
|
||||
const ENCODING_TYPES = ['base64', 'hex', 'utf8'];
|
||||
@@ -27,16 +22,6 @@ async function exportSecrets() {
|
||||
const secretsInput = core.getInput('secrets', { required: false });
|
||||
const secretRequests = parseSecretsInput(secretsInput);
|
||||
|
||||
const pkiInput = core.getInput('pki', { required: false });
|
||||
let pkiRequests = [];
|
||||
if (pkiInput) {
|
||||
if (secretsInput) {
|
||||
throw Error('You cannot provide both "secrets" and "pki" inputs.');
|
||||
}
|
||||
|
||||
pkiRequests = parsePkiInput(pkiInput);
|
||||
}
|
||||
|
||||
const secretEncodingType = core.getInput('secretEncodingType', { required: false });
|
||||
|
||||
const vaultMethod = (core.getInput('method', { required: false }) || 'token').toLowerCase();
|
||||
@@ -99,12 +84,12 @@ async function exportSecrets() {
|
||||
core.exportVariable('VAULT_TOKEN', `${vaultToken}`);
|
||||
}
|
||||
|
||||
let results = [];
|
||||
if (pkiRequests.length > 0) {
|
||||
results = await getCertificates(pkiRequests, client);
|
||||
} else {
|
||||
results = await getSecrets(secretRequests, client);
|
||||
}
|
||||
const requests = secretRequests.map(request => {
|
||||
const { path, selector } = request;
|
||||
return request;
|
||||
});
|
||||
|
||||
const results = await getSecrets(requests, client);
|
||||
|
||||
|
||||
for (const result of results) {
|
||||
@@ -143,43 +128,6 @@ async function exportSecrets() {
|
||||
* @property {string} selector
|
||||
*/
|
||||
|
||||
/**
|
||||
* Parses a pki input string into key paths and the request parameters.
|
||||
* @param {string} pkiInput
|
||||
*/
|
||||
function parsePkiInput(pkiInput) {
|
||||
if (!pkiInput) {
|
||||
return []
|
||||
}
|
||||
|
||||
const secrets = pkiInput
|
||||
.split(';')
|
||||
.filter(key => !!key)
|
||||
.map(key => key.trim())
|
||||
.filter(key => key.length !== 0);
|
||||
|
||||
return secrets.map(secret => {
|
||||
const path = secret.substring(0, secret.indexOf(' '));
|
||||
const parameters = secret.substring(secret.indexOf(' ') + 1);
|
||||
|
||||
core.debug(`ℹ Parsing PKI: ${path} with parameters: ${parameters}`);
|
||||
|
||||
if (!path || !parameters) {
|
||||
throw Error(`You must provide a valid path and parameters. Input: "${secret}"`);
|
||||
}
|
||||
|
||||
let outputVarName = path.split('/').pop();
|
||||
let envVarName = normalizeOutputKey(outputVarName);
|
||||
|
||||
return {
|
||||
path,
|
||||
envVarName,
|
||||
outputVarName,
|
||||
parameters: JSON.parse(parameters),
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Parses a secrets input string into key paths and their resulting environment variable name.
|
||||
* @param {string} secretsInput
|
||||
@@ -226,7 +174,7 @@ function parseSecretsInput(secretsInput) {
|
||||
const selectorAst = jsonata(selectorQuoted).ast();
|
||||
const selector = selectorQuoted.replace(new RegExp('"', 'g'), '');
|
||||
|
||||
if (selector !== WILDCARD && selector !== WILDCARD_UPPERCASE && (selectorAst.type !== "path" || selectorAst.steps[0].stages) && selectorAst.type !== "string" && !outputVarName) {
|
||||
if (selector !== WILDCARD && (selectorAst.type !== "path" || selectorAst.steps[0].stages) && selectorAst.type !== "string" && !outputVarName) {
|
||||
throw Error(`You must provide a name for the output key when using json selectors. Input: "${secret}"`);
|
||||
}
|
||||
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
jest.mock('got');
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
|
||||
+2
-36
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
// @ts-check
|
||||
const core = require('@actions/core');
|
||||
const rsasign = require('jsrsasign');
|
||||
@@ -10,8 +5,6 @@ const fs = require('fs');
|
||||
const { default: got } = require('got');
|
||||
|
||||
const defaultKubernetesTokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token'
|
||||
const retries = 5
|
||||
const retries_delay = 3000
|
||||
/***
|
||||
* Authenticate with Vault and retrieve a Vault token that can be used for requests.
|
||||
* @param {string} method
|
||||
@@ -24,7 +17,7 @@ async function retrieveToken(method, client) {
|
||||
switch (method) {
|
||||
case 'approle': {
|
||||
const vaultRoleId = core.getInput('roleId', { required: true });
|
||||
const vaultSecretId = core.getInput('secretId', { required: false });
|
||||
const vaultSecretId = core.getInput('secretId', { required: true });
|
||||
return await getClientToken(client, method, path, { role_id: vaultRoleId, secret_id: vaultSecretId });
|
||||
}
|
||||
case 'github': {
|
||||
@@ -42,10 +35,7 @@ async function retrieveToken(method, client) {
|
||||
const githubAudience = core.getInput('jwtGithubAudience', { required: false });
|
||||
|
||||
if (!privateKey) {
|
||||
jwt = await retryAsyncFunction(retries, retries_delay, core.getIDToken, githubAudience)
|
||||
.then((result) => {
|
||||
return result;
|
||||
});
|
||||
jwt = await core.getIDToken(githubAudience)
|
||||
} else {
|
||||
jwt = generateJwt(privateKey, keyPassword, Number(tokenTtl));
|
||||
}
|
||||
@@ -152,30 +142,6 @@ async function getClientToken(client, method, path, payload) {
|
||||
}
|
||||
}
|
||||
|
||||
/***
|
||||
* Generic function for retrying an async function
|
||||
* @param {number} retries
|
||||
* @param {number} delay
|
||||
* @param {Function} func
|
||||
* @param {any[]} args
|
||||
*/
|
||||
async function retryAsyncFunction(retries, delay, func, ...args) {
|
||||
let attempt = 0;
|
||||
while (attempt < retries) {
|
||||
try {
|
||||
const result = await func(...args);
|
||||
return result;
|
||||
} catch (error) {
|
||||
attempt++;
|
||||
if (attempt < retries) {
|
||||
await new Promise(resolve => setTimeout(resolve, delay));
|
||||
} else {
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/***
|
||||
* @typedef {Object} VaultLoginResponse
|
||||
* @property {{
|
||||
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
jest.mock('got');
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
@@ -90,23 +85,4 @@ describe("test retrival for token", () => {
|
||||
const url = got.post.mock.calls[0][0]
|
||||
expect(url).toContain('differentK8sPath')
|
||||
})
|
||||
|
||||
it("test retrieval with jwt", async () => {
|
||||
const method = "jwt"
|
||||
const jwtToken = "someTestToken"
|
||||
const testRole = "testRole"
|
||||
const privateKeyRaw = ""
|
||||
|
||||
mockApiResponse()
|
||||
mockInput("role", testRole)
|
||||
mockInput("jwtPrivateKey", privateKeyRaw)
|
||||
core.getIDToken = jest.fn()
|
||||
core.getIDToken.mockReturnValueOnce(jwtToken)
|
||||
const token = await retrieveToken(method, got)
|
||||
expect(token).toEqual(testToken)
|
||||
const payload = got.post.mock.calls[0][1].json
|
||||
expect(payload).toEqual({ jwt: jwtToken, role: testRole })
|
||||
const url = got.post.mock.calls[0][0]
|
||||
expect(url).toContain('jwt')
|
||||
})
|
||||
})
|
||||
|
||||
+3
-10
@@ -1,12 +1,5 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
const WILDCARD_UPPERCASE = '*';
|
||||
const WILDCARD = '**';
|
||||
const WILDCARD = '*';
|
||||
|
||||
module.exports = {
|
||||
WILDCARD,
|
||||
WILDCARD_UPPERCASE,
|
||||
};
|
||||
WILDCARD
|
||||
};
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
const core = require('@actions/core');
|
||||
const { exportSecrets } = require('./action');
|
||||
|
||||
|
||||
+1
-8
@@ -1,14 +1,7 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
const auth = require('./auth');
|
||||
const secrets = require('./secrets');
|
||||
const pki = require('./pki');
|
||||
|
||||
module.exports = {
|
||||
auth,
|
||||
secrets,
|
||||
pki
|
||||
secrets
|
||||
};
|
||||
-81
@@ -1,81 +0,0 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
const { normalizeOutputKey } = require('./utils');
|
||||
const core = require('@actions/core');
|
||||
|
||||
/** A map of postfix values mapped to the key in the certificate response and a transformer function */
|
||||
const outputMap = {
|
||||
cert: { key: 'certificate', tx: (v) => v },
|
||||
key: { key: 'private_key', tx: (v) => v },
|
||||
ca: { key: 'issuing_ca', tx: (v) => v },
|
||||
ca_chain: { key: 'ca_chain', tx: (v) => v.join('\n') },
|
||||
};
|
||||
|
||||
/**
|
||||
* @typedef PkiRequest
|
||||
* @type {object}
|
||||
* @property {string} path - The path to the PKI endpoint
|
||||
* @property {Record<string, any>} parameters - The parameters to send to the PKI endpoint
|
||||
* @property {string} envVarName - The name of the environment variable to set
|
||||
* @property {string} outputVarName - The name of the output variable to set
|
||||
*/
|
||||
|
||||
/**
|
||||
* @typedef {Object} PkiResponse
|
||||
* @property {PkiRequest} request
|
||||
* @property {string} value
|
||||
* @property {boolean} cachedResponse
|
||||
*/
|
||||
|
||||
/**
|
||||
* Generate and return the certificates from the PKI engine
|
||||
* @param {Array<PkiRequest>} pkiRequests
|
||||
* @param {import('got').Got} client
|
||||
* @return {Promise<Array<PkiResponse>>}
|
||||
*/
|
||||
async function getCertificates(pkiRequests, client) {
|
||||
/** @type Array<PkiResponse> */
|
||||
let results = [];
|
||||
|
||||
for (const pkiRequest of pkiRequests) {
|
||||
const { path, parameters } = pkiRequest;
|
||||
|
||||
const requestPath = `v1/${path}`;
|
||||
let body;
|
||||
try {
|
||||
const result = await client.post(requestPath, {
|
||||
body: JSON.stringify(parameters),
|
||||
});
|
||||
body = result.body;
|
||||
} catch (error) {
|
||||
core.error(`✘ ${error.response?.body ?? error.message}`);
|
||||
throw error;
|
||||
}
|
||||
|
||||
body = JSON.parse(body);
|
||||
|
||||
core.info(`✔ Successfully generated certificate (serial number ${body.data.serial_number})`);
|
||||
|
||||
Object.entries(outputMap).forEach(([key, value]) => {
|
||||
const val = value.tx(body.data[value.key]);
|
||||
results.push({
|
||||
request: {
|
||||
...pkiRequest,
|
||||
envVarName: normalizeOutputKey(`${pkiRequest.envVarName}_${key}`, true),
|
||||
outputVarName: normalizeOutputKey(`${pkiRequest.outputVarName}_${key}`),
|
||||
},
|
||||
value: val,
|
||||
cachedResponse: false,
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
return results;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
getCertificates,
|
||||
};
|
||||
@@ -1,8 +1,3 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
jest.mock('@actions/core');
|
||||
|
||||
const core = require('@actions/core');
|
||||
|
||||
+18
-42
@@ -1,13 +1,6 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
const jsonata = require("jsonata");
|
||||
const { WILDCARD, WILDCARD_UPPERCASE} = require("./constants");
|
||||
const { WILDCARD } = require("./constants");
|
||||
const { normalizeOutputKey } = require("./utils");
|
||||
const core = require('@actions/core');
|
||||
|
||||
/**
|
||||
* @typedef {Object} SecretRequest
|
||||
* @property {string} path
|
||||
@@ -28,17 +21,14 @@ const core = require('@actions/core');
|
||||
* @param {import('got').Got} client
|
||||
* @return {Promise<SecretResponse<TRequest>[]>}
|
||||
*/
|
||||
async function getSecrets(secretRequests, client, ignoreNotFound) {
|
||||
async function getSecrets(secretRequests, client) {
|
||||
const responseCache = new Map();
|
||||
let results = [];
|
||||
let upperCaseEnv = false;
|
||||
|
||||
for (const secretRequest of secretRequests) {
|
||||
let { path, selector } = secretRequest;
|
||||
|
||||
// Strip leading slashes to avoid double-slash in the request path
|
||||
// (e.g. /cubbyhole/test → v1/cubbyhole/test)
|
||||
const requestPath = `v1/${path.replace(/^\/+/, '')}`;
|
||||
const requestPath = `v1/${path}`;
|
||||
let body;
|
||||
let cachedResponse = false;
|
||||
if (responseCache.has(requestPath)) {
|
||||
@@ -52,14 +42,7 @@ async function getSecrets(secretRequests, client, ignoreNotFound) {
|
||||
} catch (error) {
|
||||
const {response} = error;
|
||||
if (response?.statusCode === 404) {
|
||||
notFoundMsg = `Unable to retrieve result for "${path}" because it was not found: ${response.body.trim()}`;
|
||||
const ignoreNotFound = (core.getInput('ignoreNotFound', { required: false }) || 'false').toLowerCase() != 'false';
|
||||
if (ignoreNotFound) {
|
||||
core.error(`✘ ${notFoundMsg}`);
|
||||
continue;
|
||||
} else {
|
||||
throw Error(notFoundMsg)
|
||||
}
|
||||
throw Error(`Unable to retrieve result for "${path}" because it was not found: ${response.body.trim()}`)
|
||||
}
|
||||
throw error
|
||||
}
|
||||
@@ -67,8 +50,7 @@ async function getSecrets(secretRequests, client, ignoreNotFound) {
|
||||
|
||||
body = JSON.parse(body);
|
||||
|
||||
if (selector === WILDCARD || selector === WILDCARD_UPPERCASE) {
|
||||
upperCaseEnv = selector === WILDCARD_UPPERCASE;
|
||||
if (selector == WILDCARD) {
|
||||
let keys = body.data;
|
||||
if (body.data["data"] != undefined) {
|
||||
keys = keys.data;
|
||||
@@ -76,26 +58,20 @@ async function getSecrets(secretRequests, client, ignoreNotFound) {
|
||||
|
||||
for (let key in keys) {
|
||||
let newRequest = Object.assign({},secretRequest);
|
||||
newRequest.selector = key;
|
||||
|
||||
newRequest.selector = key;
|
||||
|
||||
if (secretRequest.selector === secretRequest.outputVarName) {
|
||||
newRequest.outputVarName = key;
|
||||
newRequest.envVarName = key;
|
||||
} else {
|
||||
newRequest.envVarName = key;
|
||||
}
|
||||
else {
|
||||
newRequest.outputVarName = secretRequest.outputVarName+key;
|
||||
newRequest.envVarName = secretRequest.envVarName+key;
|
||||
newRequest.envVarName = secretRequest.envVarName+key;
|
||||
}
|
||||
|
||||
newRequest.outputVarName = normalizeOutputKey(newRequest.outputVarName);
|
||||
newRequest.envVarName = normalizeOutputKey(newRequest.envVarName, upperCaseEnv);
|
||||
newRequest.envVarName = normalizeOutputKey(newRequest.envVarName,true);
|
||||
|
||||
// JSONata field references containing reserved tokens should
|
||||
// be enclosed in backticks
|
||||
// https://docs.jsonata.org/simple#examples
|
||||
if (key.includes(".")) {
|
||||
const backtick = '`';
|
||||
key = backtick.concat(key, backtick);
|
||||
}
|
||||
selector = key;
|
||||
|
||||
results = await selectAndAppendResults(
|
||||
@@ -109,13 +85,13 @@ async function getSecrets(secretRequests, client, ignoreNotFound) {
|
||||
}
|
||||
else {
|
||||
results = await selectAndAppendResults(
|
||||
selector,
|
||||
body,
|
||||
cachedResponse,
|
||||
secretRequest,
|
||||
selector,
|
||||
body,
|
||||
cachedResponse,
|
||||
secretRequest,
|
||||
results
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return results;
|
||||
@@ -160,7 +136,7 @@ const selectAndAppendResults = async (
|
||||
secretRequest,
|
||||
results
|
||||
) => {
|
||||
if (!selector.includes(".")) {
|
||||
if (!selector.match(/.*[\.].*/)) {
|
||||
selector = '"' + selector + '"';
|
||||
}
|
||||
selector = "data." + selector;
|
||||
|
||||
+3
-8
@@ -1,19 +1,14 @@
|
||||
/**
|
||||
* Copyright IBM Corp. 2019, 2026
|
||||
* SPDX-License-Identifier: MIT
|
||||
*/
|
||||
|
||||
/**
|
||||
* Replaces any dot chars to __ and removes non-ascii charts
|
||||
* @param {string} dataKey
|
||||
* @param {boolean=} isEnvVar
|
||||
*/
|
||||
function normalizeOutputKey(dataKey, upperCase = false) {
|
||||
function normalizeOutputKey(dataKey, isEnvVar = false) {
|
||||
let outputKey = dataKey
|
||||
.replaceAll(".", "__")
|
||||
.replace(".", "__")
|
||||
.replace(new RegExp("-", "g"), "")
|
||||
.replace(/[^\p{L}\p{N}_-]/gu, "");
|
||||
if (upperCase) {
|
||||
if (isEnvVar) {
|
||||
outputKey = outputKey.toUpperCase();
|
||||
}
|
||||
return outputKey;
|
||||
|
||||
Reference in New Issue
Block a user