mirror of
https://github.com/hashicorp/vault-action.git
synced 2026-07-26 00:13:16 +03:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Nicholas Farley
|
7b8899915e |
@@ -3,29 +3,21 @@ name: Bug report
|
||||
about: Create a report to help us improve
|
||||
title: "[BUG] "
|
||||
labels: bug
|
||||
assignees: RichiCoder1
|
||||
|
||||
---
|
||||
|
||||
## Vault server version
|
||||
v0.0.0
|
||||
|
||||
## vault-action version
|
||||
v0.0.0
|
||||
|
||||
## Describe the bug
|
||||
**Describe the bug**
|
||||
A clear and concise description of what the bug is.
|
||||
|
||||
## To Reproduce
|
||||
**To Reproduce**
|
||||
The yaml of the `vault-action` step, with any sensitive information masked or removed.
|
||||
|
||||
## Expected behavior
|
||||
**Expected behavior**
|
||||
A clear and concise description of what you expected to happen.
|
||||
|
||||
## Log Output
|
||||
For the most verbose logs, add a secret called
|
||||
[`ACTIONS_STEP_DEBUG`](https://github.com/actions/toolkit/blob/main/docs/action-debugging.md)
|
||||
with the value `true`. Then, re-run the workflow if possible and post the *raw
|
||||
logs* for the step here with any sensitive information masked or removed.
|
||||
**Log Output**
|
||||
For the most verbose logs, [add a secret called `ACTIONS_STEP_DEBUG` with the value `true`](https://github.com/actions/toolkit/blob/main/docs/action-debugging.md). Then, re-run the workflow if possible and post the *raw logs* for the step here with any sensitive information masked or removed.
|
||||
|
||||
## Additional context
|
||||
**Additional context**
|
||||
Add any other context about the problem here.
|
||||
|
||||
@@ -3,17 +3,18 @@ name: Feature request
|
||||
about: Suggest an idea for this project
|
||||
title: "[FEAT] "
|
||||
labels: enhancement
|
||||
assignees: RichiCoder1
|
||||
|
||||
---
|
||||
|
||||
## Is your feature request related to a problem? Please describe.
|
||||
**Is your feature request related to a problem? Please describe.**
|
||||
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
|
||||
|
||||
## Describe the solution you'd like
|
||||
**Describe the solution you'd like**
|
||||
A clear and concise description of what you want to happen.
|
||||
|
||||
## Describe alternatives you've considered
|
||||
**Describe alternatives you've considered**
|
||||
A clear and concise description of any alternative solutions or features you've considered.
|
||||
|
||||
## Additional context
|
||||
**Additional context**
|
||||
Add any other context or screenshots about the feature request here.
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
### Description
|
||||
<!--- Description of the change. For example: This PR updates ABC resource so that we can XYZ --->
|
||||
|
||||
|
||||
<!--- If your PR fully resolves and should automatically close the linked issue, use Closes. Otherwise, use Relates --->
|
||||
Relates OR Closes #0000
|
||||
|
||||
|
||||
### Checklist
|
||||
- [ ] Added [CHANGELOG](https://github.com/hashicorp/vault-action/blob/master/CHANGELOG.md) entry (only for user-facing changes)
|
||||
|
||||
|
||||
### Community Note
|
||||
|
||||
* Please vote on this pull request by adding a 👍
|
||||
[reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/)
|
||||
to the original pull request comment to help the community and maintainers
|
||||
prioritize this request
|
||||
* Please do not leave "+1" comments, they generate extra noise for pull request
|
||||
followers and do not help prioritize the request
|
||||
@@ -10,7 +10,7 @@ jobs:
|
||||
|
||||
- uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
|
||||
with:
|
||||
node-version: '20.9.0'
|
||||
node-version: '16.14.0'
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
|
||||
@@ -40,7 +40,7 @@ jobs:
|
||||
|
||||
- uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
|
||||
with:
|
||||
node-version: '20.9.0'
|
||||
node-version: '16.14.0'
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
|
||||
@@ -76,7 +76,7 @@ jobs:
|
||||
|
||||
- uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
|
||||
with:
|
||||
node-version: '20.9.0'
|
||||
node-version: '16.14.0'
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
|
||||
@@ -110,7 +110,7 @@ jobs:
|
||||
|
||||
- uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
|
||||
with:
|
||||
node-version: '20.9.0'
|
||||
node-version: '16.14.0'
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
|
||||
@@ -207,7 +207,7 @@ jobs:
|
||||
|
||||
- uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
|
||||
with:
|
||||
node-version: '20.9.0'
|
||||
node-version: '16.14.0'
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
|
||||
|
||||
@@ -22,7 +22,7 @@ jobs:
|
||||
|
||||
- uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
|
||||
with:
|
||||
node-version: '20.9.0'
|
||||
node-version: '16.14.0'
|
||||
|
||||
- name: NPM Install
|
||||
run: npm ci
|
||||
@@ -48,26 +48,14 @@ jobs:
|
||||
token: testtoken
|
||||
secrets: |
|
||||
secret/data/test-json-string jsonString;
|
||||
secret/data/test-json-data jsonData;
|
||||
|
||||
- uses: actions/github-script@v7
|
||||
with:
|
||||
github-token: "foobar"
|
||||
script: |
|
||||
const { JSONSTRING, JSONDATA } = process.env
|
||||
- name: Check Secrets
|
||||
run: |
|
||||
touch secrets.json
|
||||
echo "${{ steps.import-secrets.outputs.jsonString }}" >> secrets.json
|
||||
|
||||
console.log(`string ${JSONSTRING}`)
|
||||
console.log(`data ${JSONDATA}`)
|
||||
const str = JSONDATA
|
||||
|
||||
let valid = true
|
||||
try {
|
||||
JSON.parse(str)
|
||||
} catch (e) {
|
||||
valid = false
|
||||
}
|
||||
if (valid) {
|
||||
console.log("valid json")
|
||||
} else {
|
||||
console.log("not valid json")
|
||||
}
|
||||
- name: Check json file format
|
||||
run: |
|
||||
echo
|
||||
cat secrets.json
|
||||
jq -c . < secrets.json
|
||||
|
||||
+1
-42
@@ -1,47 +1,6 @@
|
||||
## Unreleased
|
||||
|
||||
Features:
|
||||
|
||||
* `secretId` is no longer required for approle to support advanced use cases like machine login when `bind_secret_id` is false. [GH-522](https://github.com/hashicorp/vault-action/pull/522)
|
||||
|
||||
## 3.0.0 (February 15, 2024)
|
||||
|
||||
Improvements:
|
||||
|
||||
* Bump node runtime from node16 to node20 [GH-529](https://github.com/hashicorp/vault-action/pull/529)
|
||||
|
||||
## 2.8.1 (February 15, 2024)
|
||||
|
||||
Bugs:
|
||||
|
||||
* Revert [GH-509](https://github.com/hashicorp/vault-action/pull/509) which made a backwards incompatible bump of the node runtime from node16 to node20 [GH-527](https://github.com/hashicorp/vault-action/pull/527)
|
||||
|
||||
## 2.8.0 (February 1, 2024)
|
||||
|
||||
Features:
|
||||
|
||||
* Add `ignoreNotFound` input (default: false) to prevent the action from failing when a secret does not exist [GH-518](https://github.com/hashicorp/vault-action/pull/518)
|
||||
|
||||
Improvements:
|
||||
|
||||
* bump jsrsasign from 10.8.6 to 11.0.0 [GH-513](https://github.com/hashicorp/vault-action/pull/513)
|
||||
* bump @actions/core from 1.10.0 to 1.10.1 [GH-489](https://github.com/hashicorp/vault-action/pull/489)
|
||||
* bump jest-when from 3.5.2 to 3.6.0 [GH-484](https://github.com/hashicorp/vault-action/pull/484)
|
||||
* bump jest from 29.5.0 to 29.7.0 [GH-490](https://github.com/hashicorp/vault-action/pull/490)
|
||||
* bump @vercel/ncc from 0.36.1 to 0.38.1 [GH-503](https://github.com/hashicorp/vault-action/pull/503)
|
||||
|
||||
## 2.7.5 (January 30, 2024)
|
||||
|
||||
Improvements:
|
||||
|
||||
* Bump node runtime from node16 to node20 [GH-509](https://github.com/hashicorp/vault-action/pull/509)
|
||||
* Bump got from 11.8.5 to 11.8.6 [GH-492](https://github.com/hashicorp/vault-action/pull/492)
|
||||
|
||||
## 2.7.4 (October 26, 2023)
|
||||
|
||||
Features:
|
||||
|
||||
* Add ability to specify a wildcard for the key name to get all keys in the path [GH-488](https://github.com/hashicorp/vault-action/pull/488)
|
||||
* Add changes here
|
||||
|
||||
## 2.7.3 (July 13, 2023)
|
||||
|
||||
|
||||
@@ -8,9 +8,6 @@
|
||||
|
||||
A helper action for easily pulling secrets from HashiCorp Vault™.
|
||||
|
||||
Note: The Vault Github Action is a read-only action, and in general
|
||||
is not meant to modify Vault’s state.
|
||||
|
||||
<!-- TOC -->
|
||||
|
||||
- [Vault GitHub Action](#vault-github-action)
|
||||
@@ -25,7 +22,6 @@ is not meant to modify Vault’s state.
|
||||
- [Userpass](#userpass)
|
||||
- [Ldap](#ldap)
|
||||
- [Other Auth Methods](#other-auth-methods)
|
||||
- [Custom Path](#custom-path-name)
|
||||
- [Key Syntax](#key-syntax)
|
||||
- [Simple Key](#simple-key)
|
||||
- [Set Output Variable Name](#set-output-variable-name)
|
||||
@@ -301,20 +297,6 @@ with:
|
||||
If any other method is specified and you provide an `authPayload`, the action will
|
||||
attempt to `POST` to `auth/${method}/login` with the provided payload and parse out the client token.
|
||||
|
||||
### Custom Path Name
|
||||
|
||||
Auth methods at custom path names can be configured using the [`path`](#path) parameter
|
||||
|
||||
```yaml
|
||||
with:
|
||||
url: https://vault.mycompany.com:8200
|
||||
caCertificate: ${{ secrets.VAULT_CA_CERT }}
|
||||
path: my-custom-path
|
||||
method: userpass
|
||||
username: ${{ secrets.VAULT_USERNAME }}
|
||||
password: ${{ secrets.VAULT_PASSWORD }}
|
||||
```
|
||||
|
||||
## Key Syntax
|
||||
|
||||
The `secrets` parameter is a set of multiple secret requests separated by the `;` character.
|
||||
@@ -482,179 +464,34 @@ steps:
|
||||
|
||||
Here are all the inputs available through `with`:
|
||||
|
||||
### `url`
|
||||
|
||||
**Type: `string`**\
|
||||
**Required**
|
||||
|
||||
The URL for the Vault endpoint.
|
||||
|
||||
### `secrets`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
A semicolon-separated list of secrets to retrieve. These will automatically be
|
||||
converted to environmental variable keys. See [Key Syntax](#key-syntax) for
|
||||
more details.
|
||||
|
||||
### `namespace`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The Vault namespace from which to query secrets. Vault Enterprise only, unset by default.
|
||||
|
||||
### `method`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `token`**
|
||||
|
||||
The method to use to authenticate with Vault.
|
||||
|
||||
### `role`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Vault role for the specified auth method.
|
||||
|
||||
### `path`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The Vault path for the auth method.
|
||||
|
||||
### `token`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The Vault token to be used to authenticate with Vault.
|
||||
|
||||
### `roleId`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The role ID for App Role authentication.
|
||||
|
||||
### `secretId`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The secret ID for App Role authentication.
|
||||
|
||||
### `githubToken`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The Github Token to be used to authenticate with Vault.
|
||||
|
||||
### `jwtPrivateKey`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Base64 encoded private key to sign the JWT.
|
||||
|
||||
### `jwtKeyPassword`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Password for key stored in `jwtPrivateKey` (if needed).
|
||||
|
||||
### `jwtGithubAudience`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `sigstore`**
|
||||
|
||||
Identifies the recipient ("aud" claim) that the JWT is intended for.
|
||||
|
||||
### `jwtTtl`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `3600`**
|
||||
|
||||
Time in seconds, after which token expires.
|
||||
|
||||
### `kubernetesTokenPath`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `/var/run/secrets/kubernetes.io/serviceaccount/token`**
|
||||
|
||||
The path to the service-account secret with the jwt token for kubernetes based authentication.
|
||||
|
||||
### `username`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The username of the user to log in to Vault as. Available to both Userpass and LDAP auth methods.
|
||||
|
||||
### `password`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The password of the user to log in to Vault as. Available to both Userpass and LDAP auth methods.
|
||||
|
||||
### `authPayload`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The JSON payload to be sent to Vault when using a custom authentication method.
|
||||
|
||||
### `extraHeaders`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
A string of newline separated extra headers to include on every request.
|
||||
|
||||
### `exportEnv`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `true`**
|
||||
|
||||
Whether or not to export secrets as environment variables.
|
||||
|
||||
### `exportToken`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `false`**
|
||||
|
||||
Whether or not export Vault token as environment variables (i.e VAULT_TOKEN).
|
||||
|
||||
### `outputToken`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `false`**
|
||||
|
||||
Whether or not to set the `vault_token` output to contain the Vault token after authentication.
|
||||
|
||||
### `caCertificate`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Base64 encoded CA certificate the server certificate was signed with. Defaults to CAs provided by Mozilla.
|
||||
|
||||
### `clientCertificate`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Base64 encoded client certificate the action uses to authenticate with Vault when mTLS is enabled.
|
||||
|
||||
### `clientKey`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Base64 encoded client key the action uses to authenticate with Vault when mTLS is enabled.
|
||||
|
||||
### `tlsSkipVerify`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `false`**
|
||||
|
||||
When set to true, disables verification of server certificates when testing the action.
|
||||
|
||||
### `ignoreNotFound`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `false`**
|
||||
|
||||
When set to true, prevents the action from failing when a secret does not exist.
|
||||
| Input | Description | Default | Required |
|
||||
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | -------- |
|
||||
| `url` | The URL for the vault endpoint | | ✔ |
|
||||
| `secrets` | A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details | | |
|
||||
| `namespace` | The Vault namespace from which to query secrets. Vault Enterprise only, unset by default | | |
|
||||
| `method` | The method to use to authenticate with Vault. | `token` | |
|
||||
| `role` | Vault role for specified auth method | | |
|
||||
| `path` | Custom vault path, if the auth method was enabled at a different path | | |
|
||||
| `token` | The Vault Token to be used to authenticate with Vault | | |
|
||||
| `roleId` | The Role Id for App Role authentication | | |
|
||||
| `secretId` | The Secret Id for App Role authentication | | |
|
||||
| `githubToken` | The Github Token to be used to authenticate with Vault | | |
|
||||
| `jwtPrivateKey` | Base64 encoded Private key to sign JWT | | |
|
||||
| `jwtKeyPassword` | Password for key stored in jwtPrivateKey (if needed) | | |
|
||||
| `jwtGithubAudience` | Identifies the recipient ("aud" claim) that the JWT is intended for |`sigstore`| |
|
||||
| `jwtTtl` | Time in seconds, after which token expires | | 3600 |
|
||||
| `kubernetesTokenPath` | The path to the service-account secret with the jwt token for kubernetes based authentication |`/var/run/secrets/kubernetes.io/serviceaccount/token` | |
|
||||
| `username` | The username of the user to log in to Vault as. Available to both Userpass and LDAP auth methods | | |
|
||||
| `password` | The password of the user to log in to Vault as. Available to both Userpass and LDAP auth methods | | |
|
||||
| `authPayload` | The JSON payload to be sent to Vault when using a custom authentication method. | | |
|
||||
| `extraHeaders` | A string of newline separated extra headers to include on every request. | | |
|
||||
| `exportEnv` | Whether or not export secrets as environment variables. | `true` | |
|
||||
| `exportToken` | Whether or not export Vault token as environment variables (i.e VAULT_TOKEN). | `false` | |
|
||||
| `outputToken` | Whether or not to set the `vault_token` output to contain the Vault token after authentication. | `false` | |
|
||||
| `caCertificate` | Base64 encoded CA certificate the server certificate was signed with. | | |
|
||||
| `clientCertificate` | Base64 encoded client certificate the action uses to authenticate with Vault when mTLS is enabled. | | |
|
||||
| `clientKey` | Base64 encoded client key the action uses to authenticate with Vault when mTLS is enabled. | | |
|
||||
| `tlsSkipVerify` | When set to true, disables verification of server certificates when testing the action. | `false` | |
|
||||
|
||||
## Masking - Hiding Secrets from Logs
|
||||
|
||||
|
||||
+7
-11
@@ -1,4 +1,4 @@
|
||||
name: 'HashiCorp Vault'
|
||||
name: 'Vault Secrets'
|
||||
description: 'A Github Action that allows you to consume HashiCorp Vault™ secrets as secure environment variables'
|
||||
inputs:
|
||||
url:
|
||||
@@ -18,16 +18,16 @@ inputs:
|
||||
description: 'Vault role for specified auth method'
|
||||
required: false
|
||||
path:
|
||||
description: 'The Vault path for the auth method.'
|
||||
description: 'Custom Vault path, if the auth method was mounted at a different path'
|
||||
required: false
|
||||
token:
|
||||
description: 'The Vault token to be used to authenticate with Vault'
|
||||
description: 'The Vault Token to be used to authenticate with Vault'
|
||||
required: false
|
||||
roleId:
|
||||
description: 'The role ID for App Role authentication'
|
||||
description: 'The Role Id for App Role authentication'
|
||||
required: false
|
||||
secretId:
|
||||
description: 'The secret ID for App Role authentication'
|
||||
description: 'The Secret Id for App Role authentication'
|
||||
required: false
|
||||
githubToken:
|
||||
description: 'The Github Token to be used to authenticate with Vault'
|
||||
@@ -61,7 +61,7 @@ inputs:
|
||||
default: 'false'
|
||||
required: false
|
||||
caCertificate:
|
||||
description: 'Base64 encoded CA certificate the server certificate was signed with. Defaults to CAs provided by Mozilla.'
|
||||
description: 'Base64 encoded CA certificate to verify the Vault server certificate.'
|
||||
required: false
|
||||
clientCertificate:
|
||||
description: 'Base64 encoded client certificate for mTLS communication with the Vault server.'
|
||||
@@ -89,12 +89,8 @@ inputs:
|
||||
secretEncodingType:
|
||||
description: 'The encoding type of the secret to decode. If not specified, the secret will not be decoded. Supported values: base64, hex, utf8'
|
||||
required: false
|
||||
ignoreNotFound:
|
||||
description: 'Whether or not the action should exit successfully if some requested secrets were not found.'
|
||||
required: false
|
||||
default: 'false'
|
||||
runs:
|
||||
using: 'node20'
|
||||
using: 'node16'
|
||||
main: 'dist/index.js'
|
||||
branding:
|
||||
icon: 'unlock'
|
||||
|
||||
Vendored
+13726
-9079
File diff suppressed because one or more lines are too long
Vendored
-3
@@ -1,3 +0,0 @@
|
||||
{
|
||||
"type": "module"
|
||||
}
|
||||
@@ -1,12 +1,11 @@
|
||||
import { vi, describe, test, expect } from 'vitest';
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
const core = require('@actions/core');
|
||||
|
||||
vi.mock('@actions/core');
|
||||
import core from '@actions/core';
|
||||
const got = require('got');
|
||||
const { when } = require('jest-when');
|
||||
|
||||
import got from 'got';
|
||||
import { when } from 'jest-when'
|
||||
|
||||
import { exportSecrets } from '../../src/action.js';
|
||||
const { exportSecrets } = require('../../src/action');
|
||||
|
||||
const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8200'}`;
|
||||
const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
|
||||
@@ -103,7 +102,7 @@ describe('authenticate with approle', () => {
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
vi.resetAllMocks();
|
||||
jest.resetAllMocks();
|
||||
|
||||
when(core.getInput)
|
||||
.calledWith('method', expect.anything())
|
||||
|
||||
@@ -1,12 +1,11 @@
|
||||
import { vi, describe, test, expect } from 'vitest';
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
const core = require('@actions/core');
|
||||
|
||||
vi.mock('@actions/core');
|
||||
import core from '@actions/core';
|
||||
const got = require('got');
|
||||
const { when } = require('jest-when');
|
||||
|
||||
import got from 'got';
|
||||
import { when } from 'jest-when'
|
||||
|
||||
import { exportSecrets } from '../../src/action.js';
|
||||
const { exportSecrets } = require('../../src/action');
|
||||
|
||||
const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8200'}`;
|
||||
const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
|
||||
@@ -108,7 +107,7 @@ describe('integration', () => {
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
vi.resetAllMocks();
|
||||
jest.resetAllMocks();
|
||||
|
||||
when(core.getInput)
|
||||
.calledWith('url', expect.anything())
|
||||
@@ -125,34 +124,12 @@ describe('integration', () => {
|
||||
.mockReturnValueOnce(secrets);
|
||||
}
|
||||
|
||||
function mockIgnoreNotFound(shouldIgnore) {
|
||||
when(core.getInput)
|
||||
.calledWith('ignoreNotFound', expect.anything())
|
||||
.mockReturnValueOnce(shouldIgnore);
|
||||
}
|
||||
|
||||
|
||||
it('prints a nice error message when secret not found', async () => {
|
||||
mockInput(`secret/data/test secret ;
|
||||
secret/data/test secret | NAMED_SECRET ;
|
||||
secret/data/notFound kehe | NO_SIR ;`);
|
||||
|
||||
await expect(exportSecrets()).rejects.toEqual(Error(`Unable to retrieve result for "secret/data/notFound" because it was not found: {"errors":[]}`));
|
||||
})
|
||||
|
||||
it('does not error when secret not found and ignoreNotFound is true', async () => {
|
||||
mockInput(`secret/data/test secret ;
|
||||
secret/data/test secret | NAMED_SECRET ;
|
||||
secret/data/notFound kehe | NO_SIR ;`);
|
||||
|
||||
mockIgnoreNotFound("true");
|
||||
|
||||
await exportSecrets();
|
||||
|
||||
expect(core.exportVariable).toBeCalledTimes(2);
|
||||
|
||||
expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
|
||||
expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET');
|
||||
expect(exportSecrets()).rejects.toEqual(Error(`Unable to retrieve result for "secret/data/notFound" because it was not found: {"errors":[]}`));
|
||||
})
|
||||
|
||||
it('get simple secret', async () => {
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
module.exports = {
|
||||
verbose: true
|
||||
};
|
||||
@@ -1,18 +1,17 @@
|
||||
import { vi, describe, test, expect } from 'vitest';
|
||||
|
||||
vi.mock('@actions/core');
|
||||
import core from '@actions/core';
|
||||
import rsasign from 'jsrsasign';
|
||||
import {
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
const core = require('@actions/core');
|
||||
const rsasign = require('jsrsasign');
|
||||
const {
|
||||
privateRsaKey,
|
||||
privateRsaKeyBase64,
|
||||
publicRsaKey
|
||||
} from './rsa_keys.js';
|
||||
} = require('./rsa_keys');
|
||||
|
||||
import got from 'got';
|
||||
import { when } from 'jest-when'
|
||||
const got = require('got');
|
||||
const { when } = require('jest-when');
|
||||
|
||||
import { exportSecrets } from '../../src/action.js';
|
||||
const { exportSecrets } = require('../../src/action');
|
||||
|
||||
const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8200'}`;
|
||||
const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
|
||||
@@ -140,7 +139,7 @@ describe('jwt auth', () => {
|
||||
|
||||
describe('authenticate with private key', () => {
|
||||
beforeEach(() => {
|
||||
vi.resetAllMocks();
|
||||
jest.resetAllMocks();
|
||||
|
||||
when(core.getInput)
|
||||
.calledWith('url', expect.anything())
|
||||
@@ -190,7 +189,7 @@ describe('jwt auth', () => {
|
||||
})
|
||||
|
||||
beforeEach(() => {
|
||||
vi.resetAllMocks();
|
||||
jest.resetAllMocks();
|
||||
|
||||
when(core.getInput)
|
||||
.calledWith('url', expect.anything())
|
||||
|
||||
@@ -42,7 +42,7 @@ LrJEY9tZaRF8xraMZiOcBcyAt6S/TS29HttJ6+zlhcWx34fItEZ8jA5gzhTmspOY
|
||||
-----END PUBLIC KEY-----
|
||||
`;
|
||||
|
||||
export {
|
||||
module.exports = {
|
||||
privateRsaKey,
|
||||
privateRsaKeyBase64,
|
||||
publicRsaKey
|
||||
|
||||
@@ -1,12 +1,11 @@
|
||||
import { vi, describe, test, expect } from 'vitest';
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
const core = require('@actions/core');
|
||||
|
||||
vi.mock('@actions/core');
|
||||
import core from '@actions/core';
|
||||
const got = require('got');
|
||||
const { when } = require('jest-when');
|
||||
|
||||
import got from 'got';
|
||||
import { when } from 'jest-when'
|
||||
|
||||
import { exportSecrets } from '../../src/action.js';
|
||||
const { exportSecrets } = require('../../src/action');
|
||||
|
||||
const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8200'}`;
|
||||
const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
|
||||
@@ -85,7 +84,7 @@ describe('authenticate with userpass', () => {
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
vi.resetAllMocks();
|
||||
jest.resetAllMocks();
|
||||
|
||||
when(core.getInput)
|
||||
.calledWith('method', expect.anything())
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
import { defineConfig, configDefaults } from 'vitest/config'
|
||||
|
||||
export default defineConfig({
|
||||
test: {
|
||||
// required to make jest-when work with vitest
|
||||
globals: true,
|
||||
include: [
|
||||
'**/integrationTests/basic/**.{test,spec}.?(c|m)[jt]s?(x)',
|
||||
],
|
||||
},
|
||||
})
|
||||
@@ -1,5 +1,3 @@
|
||||
import { describe, test, expect } from 'vitest';
|
||||
|
||||
describe('e2e-tls', () => {
|
||||
it('verify', () => {
|
||||
expect(process.env.SECRET).toBe("SUPERSECRET");
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
module.exports = {
|
||||
verbose: true
|
||||
};
|
||||
@@ -1,5 +1,5 @@
|
||||
import got from 'got';
|
||||
import core from '@actions/core';
|
||||
const got = require('got');
|
||||
const core = require('@actions/core');
|
||||
|
||||
const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
|
||||
const caCertificateRaw = `${process.env.VAULTCA}`;
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
import { defineConfig, configDefaults } from 'vitest/config'
|
||||
|
||||
export default defineConfig({
|
||||
test: {
|
||||
// required to make jest-when work with vitest
|
||||
globals: true,
|
||||
include: [
|
||||
'**/integrationTests/e2e-tls/**.{test,spec}.?(c|m)[jt]s?(x)',
|
||||
],
|
||||
},
|
||||
})
|
||||
@@ -1,5 +1,3 @@
|
||||
import { describe, test, expect } from 'vitest';
|
||||
|
||||
describe('e2e', () => {
|
||||
it('verify', () => {
|
||||
expect(process.env.SECRET).toBe("SUPERSECRET");
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
module.exports = {
|
||||
verbose: true
|
||||
};
|
||||
@@ -1,4 +1,4 @@
|
||||
import got from 'got';
|
||||
const got = require('got');
|
||||
|
||||
const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
|
||||
const vaultToken = `${process.env.VAULT_TOKEN}` === undefined ? `${process.env.VAULT_TOKEN}` : "testtoken";
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
import { defineConfig, configDefaults } from 'vitest/config'
|
||||
|
||||
export default defineConfig({
|
||||
test: {
|
||||
// required to make jest-when work with vitest
|
||||
globals: true,
|
||||
include: [
|
||||
'**/integrationTests/e2e/**.{test,spec}.?(c|m)[jt]s?(x)',
|
||||
],
|
||||
},
|
||||
})
|
||||
@@ -1,12 +1,11 @@
|
||||
import { vi, describe, test, expect } from 'vitest';
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
const core = require('@actions/core');
|
||||
|
||||
vi.mock('@actions/core');
|
||||
import core from '@actions/core';
|
||||
const got = require('got');
|
||||
const { when } = require('jest-when');
|
||||
|
||||
import got from 'got';
|
||||
import { when } from 'jest-when'
|
||||
|
||||
import { exportSecrets } from '../../src/action.js';
|
||||
const { exportSecrets } = require('../../src/action');
|
||||
|
||||
const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8201'}`;
|
||||
const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
|
||||
@@ -42,7 +41,7 @@ describe('integration', () => {
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
vi.resetAllMocks();
|
||||
jest.resetAllMocks();
|
||||
|
||||
when(core.getInput)
|
||||
.calledWith('url', expect.anything())
|
||||
@@ -239,7 +238,7 @@ describe('authenticate with approle', () => {
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
vi.resetAllMocks();
|
||||
jest.resetAllMocks();
|
||||
|
||||
when(core.getInput)
|
||||
.calledWith('method', expect.anything())
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
module.exports = {
|
||||
verbose: true
|
||||
};
|
||||
@@ -1,11 +0,0 @@
|
||||
import { defineConfig, configDefaults } from 'vitest/config'
|
||||
|
||||
export default defineConfig({
|
||||
test: {
|
||||
// required to make jest-when work with vitest
|
||||
globals: true,
|
||||
include: [
|
||||
'**/integrationTests/enterprise/**.{test,spec}.?(c|m)[jt]s?(x)',
|
||||
],
|
||||
},
|
||||
})
|
||||
@@ -0,0 +1,3 @@
|
||||
module.exports = {
|
||||
testPathIgnorePatterns: ['/node_modules/', '<rootDir>/integrationTests/'],
|
||||
};
|
||||
+1
-1
@@ -7,4 +7,4 @@
|
||||
"compilerOptions": {
|
||||
"target": "es2018"
|
||||
}
|
||||
}
|
||||
}
|
||||
Generated
+1816
-4580
File diff suppressed because it is too large
Load Diff
+16
-14
@@ -2,15 +2,14 @@
|
||||
"name": "vault-action",
|
||||
"version": "0.1.0",
|
||||
"description": "A Github Action that allows you to consume vault secrets as secure environment variables.",
|
||||
"type": "module",
|
||||
"main": "dist/index.js",
|
||||
"scripts": {
|
||||
"build": "ncc build src/entry.js -o dist",
|
||||
"test": "vitest run",
|
||||
"test:integration:basic": "vitest run -c integrationTests/basic/vitest.config.js",
|
||||
"test:integration:enterprise": "vitest run -c integrationTests/enterprise/vitest.config.js",
|
||||
"test:integration:e2e": "vitest run -c integrationTests/e2e/vitest.config.js",
|
||||
"test:integration:e2e-tls": "vitest run -c integrationTests/e2e-tls/vitest.config.js"
|
||||
"test": "jest",
|
||||
"test:integration:basic": "jest -c integrationTests/basic/jest.config.js",
|
||||
"test:integration:enterprise": "jest -c integrationTests/enterprise/jest.config.js",
|
||||
"test:integration:e2e": "jest -c integrationTests/e2e/jest.config.js",
|
||||
"test:integration:e2e-tls": "jest -c integrationTests/e2e-tls/jest.config.js"
|
||||
},
|
||||
"files": [
|
||||
"src/**/*",
|
||||
@@ -35,15 +34,18 @@
|
||||
},
|
||||
"homepage": "https://github.com/hashicorp/vault-action#readme",
|
||||
"dependencies": {
|
||||
"@actions/core": "^1.10.1",
|
||||
"got": "^14.2.1",
|
||||
"jsonata": "^2.0.4",
|
||||
"jsrsasign": "^11.0.0"
|
||||
"got": "^11.8.6",
|
||||
"jsonata": "^2.0.3",
|
||||
"jsrsasign": "^10.8.6"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"@actions/core": ">=1 <2"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@vercel/ncc": "^0.38.1",
|
||||
"jest-when": "^3.6.0",
|
||||
"mock-http-server": "^1.4.5",
|
||||
"vitest": "^1.3.1"
|
||||
"@actions/core": "^1.10.0",
|
||||
"@vercel/ncc": "^0.36.1",
|
||||
"jest": "^29.5.0",
|
||||
"jest-when": "^3.5.2",
|
||||
"mock-http-server": "^1.4.5"
|
||||
}
|
||||
}
|
||||
|
||||
+11
-12
@@ -1,14 +1,12 @@
|
||||
import core from '@actions/core';
|
||||
import got from 'got';
|
||||
|
||||
import { normalizeOutputKey } from './utils.js';
|
||||
import { WILDCARD } from './constants.js';
|
||||
import { retrieveToken } from './auth.js';
|
||||
import { getSecrets } from './secrets.js';
|
||||
|
||||
// ncc doesn't compile jsonata imports properly, so we must use our own custom require
|
||||
import require from "./cjs-require.js";
|
||||
// @ts-check
|
||||
const core = require('@actions/core');
|
||||
const command = require('@actions/core/lib/command');
|
||||
const got = require('got').default;
|
||||
const jsonata = require('jsonata');
|
||||
const { normalizeOutputKey } = require('./utils');
|
||||
const { WILDCARD } = require('./constants');
|
||||
|
||||
const { auth: { retrieveToken }, secrets: { getSecrets } } = require('./index');
|
||||
|
||||
const AUTH_METHODS = ['approle', 'token', 'github', 'jwt', 'kubernetes', 'ldap', 'userpass'];
|
||||
const ENCODING_TYPES = ['base64', 'hex', 'utf8'];
|
||||
@@ -221,8 +219,9 @@ function parseHeadersInput(inputKey, inputOptions) {
|
||||
}, new Map());
|
||||
}
|
||||
|
||||
export {
|
||||
module.exports = {
|
||||
exportSecrets,
|
||||
parseSecretsInput,
|
||||
parseHeadersInput,
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
+10
-10
@@ -1,17 +1,17 @@
|
||||
import { vi, describe, test, expect } from 'vitest';
|
||||
jest.mock('got');
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
|
||||
vi.mock('got');
|
||||
vi.mock('@actions/core');
|
||||
|
||||
import core from '@actions/core';
|
||||
import got from 'got';
|
||||
import {
|
||||
const command = require('@actions/core/lib/command');
|
||||
const core = require('@actions/core');
|
||||
const got = require('got');
|
||||
const {
|
||||
exportSecrets,
|
||||
parseSecretsInput,
|
||||
parseHeadersInput
|
||||
} from './action.js';
|
||||
} = require('./action');
|
||||
|
||||
import { when } from 'jest-when'
|
||||
const { when } = require('jest-when');
|
||||
|
||||
describe('parseSecretsInput', () => {
|
||||
it('parses simple secret', () => {
|
||||
@@ -132,7 +132,7 @@ describe('parseHeaders', () => {
|
||||
|
||||
describe('exportSecrets', () => {
|
||||
beforeEach(() => {
|
||||
vi.resetAllMocks();
|
||||
jest.resetAllMocks();
|
||||
|
||||
when(core.getInput)
|
||||
.calledWith('url', expect.anything())
|
||||
|
||||
+6
-6
@@ -1,8 +1,8 @@
|
||||
// @ts-check
|
||||
import core from '@actions/core';
|
||||
import * as fs from 'fs';
|
||||
import got from 'got';
|
||||
import rsasign from 'jsrsasign';
|
||||
const core = require('@actions/core');
|
||||
const rsasign = require('jsrsasign');
|
||||
const fs = require('fs');
|
||||
const { default: got } = require('got');
|
||||
|
||||
const defaultKubernetesTokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token'
|
||||
/***
|
||||
@@ -17,7 +17,7 @@ async function retrieveToken(method, client) {
|
||||
switch (method) {
|
||||
case 'approle': {
|
||||
const vaultRoleId = core.getInput('roleId', { required: true });
|
||||
const vaultSecretId = core.getInput('secretId', { required: false });
|
||||
const vaultSecretId = core.getInput('secretId', { required: true });
|
||||
return await getClientToken(client, method, path, { role_id: vaultRoleId, secret_id: vaultSecretId });
|
||||
}
|
||||
case 'github': {
|
||||
@@ -154,6 +154,6 @@ async function getClientToken(client, method, path, payload) {
|
||||
* }} auth
|
||||
*/
|
||||
|
||||
export {
|
||||
module.exports = {
|
||||
retrieveToken,
|
||||
};
|
||||
|
||||
+17
-15
@@ -1,20 +1,22 @@
|
||||
import { vi, describe, test, expect } from 'vitest';
|
||||
|
||||
vi.mock('got');
|
||||
vi.mock('@actions/core');
|
||||
vi.mock('fs', () => ({
|
||||
stat: vi.fn().mockResolvedValue(null),
|
||||
jest.mock('got');
|
||||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
jest.mock('fs', () => ({
|
||||
stat: jest.fn().mockResolvedValue(null),
|
||||
promises: {
|
||||
access: vi.fn().mockResolvedValue(null),
|
||||
access: jest.fn().mockResolvedValue(null),
|
||||
}
|
||||
}));
|
||||
|
||||
import core from '@actions/core';
|
||||
import got from 'got'
|
||||
import * as fs from 'fs';
|
||||
import { when } from 'jest-when'
|
||||
const core = require('@actions/core');
|
||||
const got = require('got');
|
||||
const fs = require("fs")
|
||||
const { when } = require('jest-when');
|
||||
|
||||
import { retrieveToken } from './auth.js';
|
||||
|
||||
const {
|
||||
retrieveToken
|
||||
} = require('./auth');
|
||||
|
||||
|
||||
function mockInput(name, key) {
|
||||
@@ -25,7 +27,7 @@ function mockInput(name, key) {
|
||||
|
||||
function mockApiResponse() {
|
||||
const response = { body: { auth: { client_token: testToken, renewable: true, policies: [], accessor: "accessor" } } }
|
||||
got.post = vi.fn()
|
||||
got.post = jest.fn()
|
||||
got.post.mockReturnValue(response)
|
||||
}
|
||||
const testToken = "testoken";
|
||||
@@ -33,7 +35,7 @@ const testToken = "testoken";
|
||||
describe("test retrival for token", () => {
|
||||
|
||||
beforeEach(() => {
|
||||
vi.resetAllMocks();
|
||||
jest.resetAllMocks();
|
||||
});
|
||||
|
||||
it("test retrival with approle", async () => {
|
||||
@@ -74,7 +76,7 @@ describe("test retrival for token", () => {
|
||||
mockInput("kubernetesTokenPath", testTokenPath)
|
||||
mockInput("role", testRole)
|
||||
mockInput("path", testPath)
|
||||
fs.readFileSync = vi.fn()
|
||||
fs.readFileSync = jest.fn()
|
||||
fs.readFileSync.mockReturnValueOnce(jwtToken)
|
||||
const token = await retrieveToken(method, got)
|
||||
expect(token).toEqual(testToken)
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
// This allows us to use `require` in our ECMAScript module
|
||||
// See: https://github.com/vercel/ncc/issues/791
|
||||
// https://nodejs.org/api/module.html#modulecreaterequirefilename
|
||||
import { createRequire } from "module";
|
||||
const require = createRequire(import.meta.url);
|
||||
|
||||
export default require;
|
||||
+2
-2
@@ -1,5 +1,5 @@
|
||||
const WILDCARD = '*';
|
||||
|
||||
export {
|
||||
module.exports = {
|
||||
WILDCARD
|
||||
};
|
||||
};
|
||||
+2
-2
@@ -1,5 +1,5 @@
|
||||
import core from '@actions/core';
|
||||
import { exportSecrets } from './action.js';
|
||||
const core = require('@actions/core');
|
||||
const { exportSecrets } = require('./action');
|
||||
|
||||
(async () => {
|
||||
try {
|
||||
|
||||
+4
-4
@@ -1,7 +1,7 @@
|
||||
import auth from './auth.js';
|
||||
import secrets from './secrets.js';
|
||||
const auth = require('./auth');
|
||||
const secrets = require('./secrets');
|
||||
|
||||
export default {
|
||||
module.exports = {
|
||||
auth,
|
||||
secrets
|
||||
};
|
||||
};
|
||||
+14
-16
@@ -1,19 +1,17 @@
|
||||
import { vi, describe, test, expect } from 'vitest';
|
||||
jest.mock('@actions/core');
|
||||
|
||||
vi.mock('@actions/core');
|
||||
|
||||
import core from '@actions/core';
|
||||
import ServerMock from 'mock-http-server';
|
||||
import { exportSecrets } from './action.js';
|
||||
import { when } from 'jest-when';
|
||||
const core = require('@actions/core');
|
||||
const ServerMock = require("mock-http-server");
|
||||
const { exportSecrets } = require("./action");
|
||||
const { when } = require('jest-when');
|
||||
|
||||
describe('exportSecrets retries', () => {
|
||||
var server = new ServerMock({ host: "127.0.0.1", port: 0 });
|
||||
var calls = 0;
|
||||
|
||||
beforeEach(() => new Promise(done => {
|
||||
beforeEach((done) => {
|
||||
calls = 0;
|
||||
vi.resetAllMocks();
|
||||
jest.resetAllMocks();
|
||||
|
||||
when(core.getInput)
|
||||
.calledWith('token', expect.anything())
|
||||
@@ -30,11 +28,11 @@ describe('exportSecrets retries', () => {
|
||||
.mockReturnValueOnce('http://127.0.0.1:' + server.getHttpPort());
|
||||
done();
|
||||
});
|
||||
}));
|
||||
});
|
||||
|
||||
afterEach(() => new Promise(done => {
|
||||
afterEach((done) => {
|
||||
server.stop(done);
|
||||
}));
|
||||
});
|
||||
|
||||
function mockStatusCodes(statusCodes) {
|
||||
server.on({
|
||||
@@ -53,19 +51,19 @@ describe('exportSecrets retries', () => {
|
||||
});
|
||||
}
|
||||
|
||||
it('retries on 412 status code', () => new Promise(done => {
|
||||
it('retries on 412 status code', (done) => {
|
||||
mockStatusCodes([412, 200])
|
||||
exportSecrets().then(() => {
|
||||
expect(calls).toEqual(2);
|
||||
done();
|
||||
});
|
||||
}));
|
||||
});
|
||||
|
||||
it('retries on 500 status code', () => new Promise(done => {
|
||||
it('retries on 500 status code', (done) => {
|
||||
mockStatusCodes([500, 200])
|
||||
exportSecrets().then(() => {
|
||||
expect(calls).toEqual(2);
|
||||
done();
|
||||
});
|
||||
}));
|
||||
});
|
||||
});
|
||||
|
||||
+6
-19
@@ -1,12 +1,6 @@
|
||||
import core from '@actions/core';
|
||||
import { WILDCARD } from './constants.js';
|
||||
import { normalizeOutputKey } from './utils.js';
|
||||
|
||||
// ncc doesn't compile jsonata imports properly, so we must use our own custom require
|
||||
import require from "./cjs-require.js";
|
||||
const jsonata = require('jsonata');
|
||||
|
||||
|
||||
const jsonata = require("jsonata");
|
||||
const { WILDCARD } = require("./constants");
|
||||
const { normalizeOutputKey } = require("./utils");
|
||||
/**
|
||||
* @typedef {Object} SecretRequest
|
||||
* @property {string} path
|
||||
@@ -27,7 +21,7 @@ const jsonata = require('jsonata');
|
||||
* @param {import('got').Got} client
|
||||
* @return {Promise<SecretResponse<TRequest>[]>}
|
||||
*/
|
||||
async function getSecrets(secretRequests, client, ignoreNotFound) {
|
||||
async function getSecrets(secretRequests, client) {
|
||||
const responseCache = new Map();
|
||||
let results = [];
|
||||
|
||||
@@ -48,14 +42,7 @@ async function getSecrets(secretRequests, client, ignoreNotFound) {
|
||||
} catch (error) {
|
||||
const {response} = error;
|
||||
if (response?.statusCode === 404) {
|
||||
let notFoundMsg = `Unable to retrieve result for "${path}" because it was not found: ${response.body.trim()}`;
|
||||
const ignoreNotFound = (core.getInput('ignoreNotFound', { required: false }) || 'false').toLowerCase() != 'false';
|
||||
if (ignoreNotFound) {
|
||||
core.error(`✘ ${notFoundMsg}`);
|
||||
continue;
|
||||
} else {
|
||||
throw Error(notFoundMsg)
|
||||
}
|
||||
throw Error(`Unable to retrieve result for "${path}" because it was not found: ${response.body.trim()}`)
|
||||
}
|
||||
throw error
|
||||
}
|
||||
@@ -169,7 +156,7 @@ const selectAndAppendResults = async (
|
||||
];
|
||||
};
|
||||
|
||||
export {
|
||||
module.exports = {
|
||||
getSecrets,
|
||||
selectData
|
||||
}
|
||||
|
||||
+2
-2
@@ -14,6 +14,6 @@ function normalizeOutputKey(dataKey, isEnvVar = false) {
|
||||
return outputKey;
|
||||
}
|
||||
|
||||
export {
|
||||
normalizeOutputKey
|
||||
module.exports = {
|
||||
normalizeOutputKey
|
||||
};
|
||||
|
||||
+1
-1
@@ -9,4 +9,4 @@
|
||||
"exclude": [
|
||||
"node_modules"
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
import { defineConfig, configDefaults } from 'vitest/config'
|
||||
|
||||
export default defineConfig({
|
||||
test: {
|
||||
// required to make jest-when work with vitest
|
||||
globals: true,
|
||||
exclude:[
|
||||
...configDefaults.exclude,
|
||||
'**/integrationTests/**'
|
||||
]
|
||||
},
|
||||
})
|
||||
Reference in New Issue
Block a user