feat: add generic auth (#39)

* feat: add generic auth

Adds the ability to authenticate against any normal Vault endpoint by added the `authPayload` input.

When an unrecognized method is provided, the action will attempt to hit `v1/auth/<method>/login` with the provided `authPayload and parse out the token in the response

.github/FUNDING.yml

@@ -0,0 +1 @@
+ko_fi: richicoder

.github/workflows/build.yml

@@ -0,0 +1,171 @@
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v1
+    - name: Use Node.js 10.x
+      uses: actions/setup-node@v1
+      with:
+        node-version: 10.x
+    - name: setup npm cache
+      uses: actions/cache@v1
+      with:
+        path: ~/.npm
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+    - name: npm install
+      run: npm ci
+    - name: npm build
+      run: npm run build
+    - name: npm run test
+      run: npm run test
+
+  integration:
+    runs-on: ubuntu-latest
+
+    services:
+      vaultBasic:
+        image: vault:1.2.3
+        ports:
+          - 8200/tcp
+        env:
+          VAULT_DEV_ROOT_TOKEN_ID: testtoken
+        options: --cap-add=IPC_LOCK
+      vaultEnterprise:
+        image: hashicorp/vault-enterprise:1.3.0_ent
+        ports:
+          - 8200/tcp
+        env:
+          VAULT_DEV_ROOT_TOKEN_ID: testtoken
+        options: --cap-add=IPC_LOCK
+
+    steps:
+      - uses: actions/checkout@v1
+      - name: Use Node.js 10.x
+        uses: actions/setup-node@v1
+        with:
+          node-version: 10.x
+      - name: setup npm cache
+        uses: actions/cache@v1
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+      - name: npm install
+        run: npm ci
+      - name: npm build
+        run: npm run build
+      - name: npm run test:integration:basic
+        run: npm run test:integration:basic
+        env:
+          VAULT_HOST: localhost
+          VAULT_PORT: ${{ job.services.vaultBasic.ports[8200] }}
+          CI: true
+      - name: npm run test:integration:enterprise
+        run: npm run test:integration:enterprise
+        env:
+          VAULT_HOST: localhost
+          VAULT_PORT: ${{ job.services.vaultEnterprise.ports[8200] }}
+          CI: true
+
+  e2e:
+    runs-on: ubuntu-latest
+
+    services:
+      vault:
+        image: vault:1.3.0
+        ports:
+          - 8200/tcp
+        env:
+          VAULT_DEV_ROOT_TOKEN_ID: testtoken
+        options: --cap-add=IPC_LOCK
+
+    steps:
+    - uses: actions/checkout@v1
+    - name: Use Node.js 10.x
+      uses: actions/setup-node@v1
+      with:
+        node-version: 10.x
+    - name: setup npm cache
+      uses: actions/cache@v1
+      with:
+        path: ~/.npm
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+    - name: npm install
+      run: npm ci
+    - name: npm build
+      run: npm run build
+    - name: setup vault
+      run: node ./integrationTests/e2e/setup.js
+      env:
+        VAULT_HOST: localhost
+        VAULT_PORT: ${{ job.services.vault.ports[8200] }}
+    - name: use vault action (default K/V version 2)
+      uses: ./
+      id: kv-secrets
+      with:
+        url: http://localhost:${{ job.services.vault.ports[8200] }}
+        token: testtoken
+        secrets: |
+          test secret ;
+          test secret | NAMED_SECRET ;
+          nested/test otherSecret ;
+    - name: use vault action (custom K/V version 1)
+      uses: ./
+      with:
+        url: http://localhost:${{ job.services.vault.ports[8200] }}
+        token: testtoken
+        path: my-secret
+        kv-version: 1
+        secrets: |
+          test altSecret ;
+          test altSecret | NAMED_ALTSECRET ;
+          nested/test otherAltSecret ;
+    - name: use vault action (using cubbyhole engine)
+      uses: ./
+      with:
+        url: http://localhost:${{ job.services.vault.ports[8200] }}
+        token: testtoken
+        secrets: |
+          /cubbyhole/test foo ;
+          /cubbyhole/test zip | NAMED_CUBBYSECRET ;
+    - name: verify
+      run: npm run test:e2e
+      env:
+        OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
+
+  publish:
+    if: github.event_name	== 'push' && contains(github.ref, 'master')
+    runs-on: ubuntu-latest
+    needs: [build, integration, e2e]
+    steps:
+    - uses: actions/checkout@v1
+    - name: Use Node.js 10.x
+      uses: actions/setup-node@v1
+      with:
+        node-version: 10.x
+    - name: setup npm cache
+      uses: actions/cache@v1
+      with:
+        path: ~/.npm
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+    - name: npm install
+      run: npm ci
+    - name: release
+      if: success() && endsWith(github.ref, 'master')
+      run: npx semantic-release
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+

.github/workflows/test.yml

@@ -1,87 +0,0 @@
-name: Test
-
-on: [push]
-
-jobs:
-  unit:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v1
-    - name: Use Node.js 10.x
-      uses: actions/setup-node@v1
-      with:
-        node-version: 10.x
-    - name: npm install and test
-      run: |
-        npm ci
-        npm test
-      env:
-        CI: true
-
-  integration:
-    runs-on: ubuntu-latest
-
-    services:
-      vault:
-        image: vault:1.2.3
-        ports:
-          - 8200/tcp
-        env:
-          VAULT_DEV_ROOT_TOKEN_ID: testtoken
-        options: --cap-add=IPC_LOCK
-
-    steps:
-    - uses: actions/checkout@v1
-    - name: Use Node.js 10.x
-      uses: actions/setup-node@v1
-      with:
-        node-version: 10.x
-    - name: npm install
-      run: npm ci
-    - name: npm run test:integration
-      run: npm run test:integration
-      env:
-        VAULT_HOST: localhost
-        VAULT_PORT: ${{ job.services.vault.ports[8200] }}
-
-  e2e:
-    runs-on: ubuntu-latest
-
-    services:
-      vault:
-        image: vault:1.2.3
-        ports:
-          - 8200/tcp
-        env:
-          VAULT_DEV_ROOT_TOKEN_ID: testtoken
-        options: --cap-add=IPC_LOCK
-
-    steps:
-    - uses: actions/checkout@v1
-    - name: Use Node.js 10.x
-      uses: actions/setup-node@v1
-      with:
-        node-version: 10.x
-    - name: npm install
-      run: npm ci
-    - name: setup vault
-      run: node ./e2e/setup.js
-      env:
-        VAULT_HOST: localhost
-        VAULT_PORT: ${{ job.services.vault.ports[8200] }}
-    - name: use vault action
-      uses: ./
-      with:
-        url: http://localhost:${{ job.services.vault.ports[8200] }}
-        token: testtoken
-        secrets: |
-          test secret ;
-          test secret | NAMED_SECRET ;
-          nested/test otherSecret ;
-    - name: verify
-      run: npm run test:e2e
-
-  
-

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+    "markdown-toc.depthFrom": 2
+}

README.md

@@ -1,6 +1,27 @@
 # vault-action
 
-A helper action for easily pulling secrets from the v2 K/V backend of vault.
+A helper action for easily pulling secrets from HashiCorp Vault™.
+
+By default, this action pulls from  [Version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2/) of the K/V Engine. See examples below for how to [use v1](#using-kv-version-1) as well as [other non-K/V engines](#other-secret-engines).
+
+<!-- TOC -->
+
+- [Example Usage](#example-usage)
+- [Authentication method](#authentication-method)
+- [Key Syntax](#key-syntax)
+    - [Simple Key](#simple-key)
+    - [Set Output Variable Name](#set-output-variable-name)
+    - [Multiple Secrets](#multiple-secrets)
+    - [Using K/V version 1](#using-kv-version-1)
+- [Custom K/V Engine Path](#custom-kv-engine-path)
+- [Other Secret Engines](#other-secret-engines)
+- [Adding Extra Headers](#adding-extra-headers)
+- [Vault Enterprise Features](#vault-enterprise-features)
+    - [Namespace](#namespace)
+- [Reference](#reference)
+- [Masking - Hiding Secrets from Logs](#masking---hiding-secrets-from-logs)
+
+<!-- /TOC -->
 
 ## Example Usage
 
@@ -22,6 +43,35 @@ jobs:
             # ...
 ```
 
+## Authentication method
+
+While most workflows will likely use a vault token, you can also use an `approle` to authenticate with vaule. You can configure which by using the `method` parameter:
+
+- **token**: (by default) you must provide a `token` parameter
+```yaml
+...
+with:
+  url: https://vault.mycompany.com:8200
+  token: ${{ secrets.VaultToken }}
+```
+- **approle**: you must provide a `roleId` & `secretId` parameter
+```yaml
+...
+with:
+  url: https://vault.mycompany.com:8200
+  method: approle
+  roleId: ${{ secrets.roleId }}
+  secretId: ${{ secrets.secretId }}
+```
+- **github**: you must provide the github token as `githubToken`
+```yaml
+...
+with:
+  url: https://vault.mycompany.com:8200
+  method: github
+  githubToken: ${{ secrets.GITHUB_TOKEN }}
+```
+
 ## Key Syntax
 
 The `secrets` parameter is a set of multiple secret requests separated by the `;` character.
@@ -29,7 +79,7 @@ The `secrets` parameter is a set of multiple secret requests separated by the `;
 Each secret request is comprised of the `path` and the `key` of the desired secret, and optionally the desired Env Var output name.
 
 ```raw
-{{ Secret Path }} {{ Secret Key }} | {{ Output Environment Variable Name }}
+{{ Secret Path }} {{ Secret Key }} | {{ Output Variable Name }}
 ```
 
 ### Simple Key
@@ -41,15 +91,30 @@ with:
     secrets: ci npmToken
 ```
 
-`vault-action` will automatically normalize the given data key, and output:
+`vault-action` will automatically normalize the given secret selector key, and set the follow as environment variables for the following steps in the current job:
 
 ```bash
 NPMTOKEN=somelongtoken
 ```
 
-### Set Environment Variable Name
+You can also access the secret via ouputs:
 
-However, if you want to set it to a specific environmental variable, say `NPM_TOKEN`, you could do this instead:
+```yaml
+steps:
+    # ...
+    - name: Import Secrets
+      id: secrets
+      # Import config...
+    - name: Sensitive Operation
+      run: "my-cli --token '${{ steps.secrets.outputs.npmToken }}'"
+
+```
+
+_**Note:** If you'd like to only use outputs and disable automatic environment variables, you can set the `exportEnv` option to `false`._
+
+### Set Output Variable Name
+
+However, if you want to set it to a specific name, say `NPM_TOKEN`, you could do this instead:
 
 ```yaml
 with:
@@ -62,17 +127,168 @@ With that, `vault-action` will now use your requested name and output:
 NPM_TOKEN=somelongtoken
 ```
 
+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.NPM_TOKEN }}'"
+
+```
+
 ### Multiple Secrets
 
 This action can take multi-line input, so say you had your AWS keys stored in a path and wanted to retrieve both of them. You can do:
 
 ```yaml
 with:
-    keys: |
+    secrets: |
         ci/aws accessKey | AWS_ACCESS_KEY_ID ;
         ci/aws secretKey | AWS_SECRET_ACCESS_KEY
 ```
 
-## Masking
+### Using K/V version 1
 
-This action uses Github Action's built in masking, so all variables will automatically be masked if printed to the console or to logs.
+By default, `vault-action` expects a K/V engine using [version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2.html).
+
+In order to work with a [v1 engine](https://www.vaultproject.io/docs/secrets/kv/kv-v1/), the `kv-version` parameter may be passed:
+
+```yaml
+with:
+    kv-version: 1
+```
+
+## Custom K/V Engine Path
+
+When you enable the K/V Engine, by default it's placed at the path `secret`, so a secret named `ci` will be accessed from `secret/ci`. However, [if you enabled the secrets engine using a custom `path`](https://www.vaultproject.io/docs/commands/secrets/enable/#inlinecode--path-4), you
+can pass it as follows:
+
+```yaml
+with:
+    path: my-secrets
+    secrets: ci npmToken
+```
+
+This way, the `ci` secret in the example above will be retrieved from `my-secrets/ci`.
+
+## Other Secret Engines
+
+While this action primarily supports the K/V engine, it is possible to request secrets from other engines in Vault.
+
+To do so when specifying the `Secret Path`, just append a leading formard slash (`/`) and specify the path as described in the Vault API documentation.
+
+For example, to retrieve a stored secret from the [`cubbyhole` engine](https://www.vaultproject.io/api-docs/secret/cubbyhole/), assuming you have a stored secret at the path `foo` with the contents:
+
+```json
+{
+  "foo": "bar",
+  "zip": "zap"
+}
+```
+
+You could request the contents like so:
+
+```yaml
+with:
+    secrets: |
+        /cubbyhole/foo foo ;
+        /cubbyhole/foo zip | MY_KEY ;
+```
+
+Resulting in:
+
+```bash
+FOO=bar
+MY_KEY=zap
+```
+
+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.foo }}'"
+  - name: Another Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.MY_KEY }}'"
+```
+
+Secrets pulled from the same `Secret Path` are cached by default. So if you, for example, are using the `aws` engine and retrieve a key, only a single key for a given path is returned.
+
+e.g.:
+
+```yaml
+with:
+    secrets: |
+        /aws/creds/ci access_key | AWS_ACCESS_KEY_ID ;
+        /aws/creds/ci secret_key | AWS_SECRET_ACCESS_KEY
+```
+
+would work fine.
+
+NOTE: The `Secret Key` is pulled from the `data` property of the response.
+
+## Adding Extra Headers
+
+If you ever need to add extra headers to the vault request, say if you need to authenticate with a firewall, all you need to do is set `extraHeaders`:
+
+```yaml
+with:
+    secrets: |
+        ci/aws accessKey | AWS_ACCESS_KEY_ID ;
+        ci/aws secretKey | AWS_SECRET_ACCESS_KEY
+    extraHeaders: |
+      X-Secure-Id: ${{ secrets.SECURE_ID }}
+      X-Secure-Secret: ${{ secrets.SECURE_SECRET }}
+```
+
+This will automatically add the `x-secure-id` and `x-secure-secret` headers to every request to vault.
+
+## Vault Enterprise Features
+
+### Namespace
+
+If you need to retrieve secrets from a specific vault namespace, all that's required is an additional parameter specifying the namespace.
+
+```yaml
+steps:
+    # ...
+    - name: Import Secrets
+      uses: RichiCoder1/vault-action
+      with:
+        url: https://vault-enterprise.mycompany.com:8200
+        method: token
+        token: ${{ secrets.VaultToken }}
+        namespace: ns1
+        secrets: |
+            ci/aws accessKey | AWS_ACCESS_KEY_ID ;
+            ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
+            ci npm_token
+```
+
+## Reference
+
+Here is all the inputs available through `with`:
+
+| Input          | Description                                                                                                                                          | Default | Required |
+| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | -------- |
+| `url`          | The URL for the vault endpoint                                                                                                                       |         | ✔        |
+| `secrets`      | A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details |         | ✔        |
+| `namespace`    | The Vault namespace from which to query secrets. Vault Enterprise only, unset by default                                                             |         |          |
+| `path`         | The path of a non-default K/V engine                                                                                                                 |         |          |
+| `kv-version`   | The version of the K/V engine to use.                                                                                                                | `2`     |          |
+| `method`       | The method to use to authenticate with Vault.                                                                                                        | `token` |          |
+| `token`        | The Vault Token to be used to authenticate with Vault                                                                                                |         |          |
+| `roleId`       | The Role Id for App Role authentication                                                                                                              |         |          |
+| `secretId`     | The Secret Id for App Role authentication                                                                                                            |         |          |
+| `githubToken`  | The Github Token to be used to authenticate with Vault                                                                                               |         |          |
+| `extraHeaders` | A string of newline separated extra headers to include on every request.                                                                             |         |          |
+| `exportEnv`    | Whether or not export secrets as environment variables.                                                                                              | `true`  |          |
+
+## Masking - Hiding Secrets from Logs
+
+This action uses GitHub Action's built-in masking, so all variables will automatically be masked (aka hidden) if printed to the console or to logs.
+**This only obscures secrets from output logs.** If someone has the ability to edit your workflows, then they are able to read and therefore write secrets to somewhere else just like normal GitHub Secrets.

action.js

@@ -1,94 +0,0 @@
-const core = require('@actions/core');
-const command = require('@actions/core/lib/command');
-const got = require('got');
-
-async function exportSecrets() {
-    const vaultUrl = core.getInput('url', { required: true });
-    const vaultToken = core.getInput('token', { required: true });
-
-    const secretsInput = core.getInput('secrets', { required: true });
-    const secrets = parseSecretsInput(secretsInput);
-
-    for (const secret of secrets) {
-        const { secretPath, outputName, secretKey } = secret;
-        const result = await got(`${vaultUrl}/v1/secret/data/${secretPath}`, {
-            headers: {
-                'X-Vault-Token': vaultToken
-            }
-        });
-
-        const parsedResponse = JSON.parse(result.body);
-        const vaultKeyData = parsedResponse.data;
-        const versionData = vaultKeyData.data;
-        const value = versionData[secretKey];
-        command.issue('add-mask', value);
-        core.exportVariable(outputName, `${value}`);
-        core.debug(`✔ ${secretPath} => ${outputName}`);
-    }
-};
-
-/**
- * Parses a secrets input string into key paths and their resulting environment variable name.
- * @param {string} secretsInput 
- */
-function parseSecretsInput(secretsInput) {
-    const secrets = secretsInput
-        .split(';')
-        .filter(key => !!key)
-        .map(key => key.trim())
-        .filter(key => key.length !== 0);
-
-    /** @type {{ secretPath: string; outputName: string; dataKey: string; }[]} */
-    const output = [];
-    for (const secret of secrets) {
-        let path = secret;
-        let outputName = null;
-
-        const renameSigilIndex = secret.lastIndexOf('|');
-        if (renameSigilIndex > -1) {
-            path = secret.substring(0, renameSigilIndex).trim();
-            outputName = secret.substring(renameSigilIndex + 1).trim();
-
-            if (outputName.length < 1) {
-                throw Error(`You must provide a value when mapping a secret to a name. Input: "${secret}"`);
-            }
-        }
-
-        const pathParts = path
-            .split(/\s+/)
-            .map(part => part.trim())
-            .filter(part => part.length !== 0);
-
-        if (pathParts.length !== 2) {
-            throw Error(`You must provide a valid path and key. Input: "${secret}"`)
-        }
-
-        const [secretPath, secretKey] = pathParts;
-
-        // If we're not using a mapped name, normalize the key path into a variable name.
-        if (!outputName) {
-            outputName = normalizeOutputKey(secretKey);
-        }
-
-        output.push({
-            secretPath,
-            outputName,
-            secretKey
-        });
-    }
-    return output;
-}
-
-/**
- * Replaces any forward-slash characters to 
- * @param {string} dataKey
- */
-function normalizeOutputKey(dataKey) {
-    return dataKey.replace('/', '__').replace(/[^\w-]/, '').toUpperCase();
-}
-
-module.exports = {
-    exportSecrets,
-    parseSecretsInput,
-    normalizeOutputKey
-};

action.test.js

@@ -1,136 +0,0 @@
-jest.mock('got');
-jest.mock('@actions/core');
-jest.mock('@actions/core/lib/command');
-
-const core = require('@actions/core');
-const got = require('got');
-const {
-    exportSecrets,
-    parseSecretsInput,
-} = require('./action');
-
-const { when } = require('jest-when');
-
-describe('parseSecretsInput', () => {
-    it('parses simple secret', () => {
-        const output = parseSecretsInput('test key');
-        expect(output).toContainEqual({
-            secretPath: 'test',
-            secretKey: 'key',
-            outputName: 'KEY',
-        });
-    });
-
-    it('parses mapped secret', () => {
-        const output = parseSecretsInput('test key|testName');
-        expect(output).toHaveLength(1);
-        expect(output[0]).toMatchObject({
-            outputName: 'testName',
-        });
-    });
-
-    it('fails on invalid mapped name', () => {
-        expect(() => parseSecretsInput('test key|'))
-            .toThrowError(`You must provide a value when mapping a secret to a name. Input: "test key|"`)
-    });
-
-    it('fails on invalid path for mapped', () => {
-        expect(() => parseSecretsInput('|testName'))
-            .toThrowError(`You must provide a valid path and key. Input: "|testName"`)
-    });
-
-    it('parses multiple secrets', () => {
-        const output = parseSecretsInput('first a;second b;');
-
-        expect(output).toHaveLength(2);
-        expect(output[0]).toMatchObject({
-            secretPath: 'first',
-        });
-        expect(output[1]).toMatchObject({
-            secretPath: 'second',
-        });
-    });
-
-    it('parses multiple complex secret input', () => {
-        const output = parseSecretsInput('first a;second b|secondName');
-
-        expect(output).toHaveLength(2);
-        expect(output[0]).toMatchObject({
-            outputName: 'A',
-        });
-        expect(output[1]).toMatchObject({
-            outputName: 'secondName',
-        });
-    });
-
-    it('parses multiline input', () => {
-        const output = parseSecretsInput(`
-        first a;
-        second b;
-        third c | SOME_C;`);
-
-        expect(output).toHaveLength(3);
-        expect(output[0]).toMatchObject({
-            secretPath: 'first',
-        });
-        expect(output[1]).toMatchObject({
-            outputName: 'B',
-        });
-        expect(output[2]).toMatchObject({
-            outputName: 'SOME_C',
-        });
-    })
-});
-
-
-describe('exportSecrets', () => {
-    beforeEach(() => {
-        jest.resetAllMocks();
-
-        when(core.getInput)
-            .calledWith('url')
-            .mockReturnValue('http://vault:8200');
-
-        when(core.getInput)
-            .calledWith('token')
-            .mockReturnValue('EXAMPLE');
-    });
-
-    function mockInput(key) {
-        when(core.getInput)
-            .calledWith('secrets')
-            .mockReturnValue(key);
-    }
-
-    function mockVaultData(data) {
-        got.mockResolvedValue({
-            body: JSON.stringify({
-                data: {
-                    data
-                }
-            })
-        });
-    }
-
-    it('simple secret retrieval', async () => {
-        mockInput('test key');
-        mockVaultData({
-            key: 1
-        });
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledWith('KEY', '1');
-    });
-
-    it('mapped secret retrieval', async () => {
-        mockInput('test key|TEST_NAME');
-        mockVaultData({
-            key: 1
-        });
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledWith('TEST_NAME', '1');
-    });
-});

action.yml

@@ -1,15 +1,51 @@
-name: 'Vault'
-description: 'A Github Action that allows you to consume the v2 K/V backend of HashiCorp Vault as secure environment variables'
+name: 'Vault Secrets'
+description: 'A Github Action that allows you to consume the v2 K/V backend of HashiCorp Vault™ as secure environment variables'
 inputs:
   url:
     description: 'The URL for the vault endpoint'
     required: true
-  token:
-    description: 'The Vault Token to be used to authenticate with Vault'
-    required: true
   secrets:
     description: 'A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details'
     required: true
+  namespace:
+    description: 'The Vault namespace from which to query secrets. Vault Enterprise only, unset by default'
+    required: false
+  path:
+    description: 'The path of a non-default K/V engine'
+    required: false
+  kv-version:
+    description: 'The version of the K/V engine to use.'
+    default: '2'
+    required: false
+  method:
+    description: 'The method to use to authenticate with Vault.'
+    default: 'token'
+    required: false
+  token:
+    description: 'The Vault Token to be used to authenticate with Vault'
+    required: false
+  roleId:
+    description: 'The Role Id for App Role authentication'
+    required: false
+  secretId:
+    description: 'The Secret Id for App Role authentication'
+    required: false
+  githubToken:
+    description: 'The Github Token to be used to authenticate with Vault'
+    required: false
+  authPayload:
+    description: 'The JSON payload to be sent to Vault when using a custom authentication method.'
+    required: false
+  extraHeaders:
+    description: 'A string of newline separated extra headers to include on every request.'
+    required: false
+  exportEnv:
+    description: 'Whether or not export secrets as environment variables.'
+    default: 'true'
+    required: false
 runs:
   using: 'node12'
-  main: 'index.js'
+  main: 'dist/index.js'
+branding:
+  icon: 'unlock'
+  color: 'gray-dark'

docker-compose.yml

@@ -0,0 +1,17 @@
+# Start vault server locally for the purposes of integration tests.
+version: "3.0"
+services:
+  vault:
+    image: vault:1.3.0
+    environment:
+      VAULT_DEV_ROOT_TOKEN_ID: testtoken
+    ports:
+      - 8200:8200
+    privileged: true
+  vault-enterprise:
+    image: hashicorp/vault-enterprise:1.3.0_ent
+    environment:
+      VAULT_DEV_ROOT_TOKEN_ID: testtoken
+    ports:
+      - 8201:8200
+    privileged: true

e2e/e2e.test.js

@@ -1,7 +0,0 @@
-describe('e2e', () => {
-    it('verify', () => {
-        expect(process.env.SECRET).toBe("SUPERSECRET");
-        expect(process.env.NAMED_SECRET).toBe("SUPERSECRET");
-        expect(process.env.OTHERSECRET).toBe("OTHERSUPERSECRET");
-    });
-});

e2e/setup.js

@@ -1,41 +0,0 @@
-const got = require('got');
-
-(async () => {
-    try {
-        // Verify Connection
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/config`, {
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-        });
-
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/test`, {
-            method: 'POST',
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-            body: {
-                data: {
-                    secret: "SUPERSECRET",
-                },
-            },
-            json: true,
-        });
-
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/nested/test`, {
-            method: 'POST',
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-            body: {
-                data: {
-                    otherSecret: "OTHERSUPERSECRET",
-                },
-            },
-            json: true,
-        });
-    } catch (error) {
-        console.log(error);
-        process.exit(1);
-    }
-})();

integration/integration.test.js

@@ -1,103 +0,0 @@
-jest.mock('@actions/core');
-jest.mock('@actions/core/lib/command');
-const core = require('@actions/core');
-
-const got = require('got');
-const { when } = require('jest-when');
-
-const { exportSecrets } = require('../action');
-
-describe('integration', () => {
-
-    beforeAll(async () => {
-        // Verify Connection
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/config`, {
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-        });
-
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/test`, {
-            method: 'POST',
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-            body: {
-                data: {
-                    secret: "SUPERSECRET",
-                },
-            },
-            json: true,
-        });
-
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/nested/test`, {
-            method: 'POST',
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-            body: {
-                data: {
-                    otherSecret: "OTHERSUPERSECRET",
-                },
-            },
-            json: true,
-        });
-    })
-
-    beforeEach(() => {
-        jest.resetAllMocks();
-
-        when(core.getInput)
-            .calledWith('url')
-            .mockReturnValue(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`);
-
-        when(core.getInput)
-            .calledWith('token')
-            .mockReturnValue('testtoken');
-    });
-
-    function mockInput(secrets) {
-        when(core.getInput)
-            .calledWith('secrets')
-            .mockReturnValue(secrets);
-    }
-
-    it('get simple secret', async () => {
-        mockInput('test secret')
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
-    });
-
-    it('re-map secret', async () => {
-        mockInput('test secret | TEST_KEY')
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledWith('TEST_KEY', 'SUPERSECRET');
-    });
-
-    it('get nested secret', async () => {
-        mockInput('nested/test otherSecret')
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
-    });
-
-    it('get multiple secrets', async () => {
-        mockInput(`
-        test secret ;
-        test secret | NAMED_SECRET ;
-        nested/test otherSecret ;`);
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledTimes(3);
-
-        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
-        expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET');
-        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
-    });
-});

integrationTests/basic/integration.test.js

@@ -0,0 +1,210 @@
+jest.mock('@actions/core');
+jest.mock('@actions/core/lib/command');
+const core = require('@actions/core');
+
+const got = require('got');
+const { when } = require('jest-when');
+
+const { exportSecrets } = require('../../src/action');
+
+const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8200'}`;
+
+describe('integration', () => {
+    beforeAll(async () => {
+        // Verify Connection
+        await got(`${vaultUrl}/v1/secret/config`, {
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+        });
+
+        await got(`${vaultUrl}/v1/secret/data/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    secret: 'SUPERSECRET',
+                },
+            },
+        });
+
+        await got(`${vaultUrl}/v1/secret/data/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    otherSecret: 'OTHERSUPERSECRET',
+                },
+            }
+        });
+
+        // Enable custom secret engine
+        try {
+            await got(`${vaultUrl}/v1/sys/mounts/my-secret`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+                json: {
+                    type: 'kv'
+                }
+            });
+        } catch (error) {
+            const {response} = error;
+            if (response.statusCode === 400 && response.body.includes("path is already in use")) {
+                // Engine might already be enabled from previous test runs
+            } else {
+                throw error;
+            }
+        }
+
+        await got(`${vaultUrl}/v1/my-secret/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                secret: 'CUSTOMSECRET',
+            }
+        });
+
+        await got(`${vaultUrl}/v1/my-secret/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                otherSecret: 'OTHERCUSTOMSECRET',
+            },
+        });
+    });
+
+    beforeEach(() => {
+        jest.resetAllMocks();
+
+        when(core.getInput)
+            .calledWith('url')
+            .mockReturnValueOnce(`${vaultUrl}`);
+
+        when(core.getInput)
+            .calledWith('token')
+            .mockReturnValueOnce('testtoken');
+    });
+
+    function mockInput(secrets) {
+        when(core.getInput)
+            .calledWith('secrets')
+            .mockReturnValueOnce(secrets);
+    }
+
+    function mockEngineName(name) {
+        when(core.getInput)
+            .calledWith('path')
+            .mockReturnValueOnce(name);
+    }
+
+    function mockVersion(version) {
+        when(core.getInput)
+            .calledWith('kv-version')
+            .mockReturnValueOnce(version);
+    }
+
+    it('get simple secret', async () => {
+        mockInput('test secret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
+    });
+
+    it('re-map secret', async () => {
+        mockInput('test secret | TEST_KEY');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('TEST_KEY', 'SUPERSECRET');
+    });
+
+    it('get nested secret', async () => {
+        mockInput('nested/test otherSecret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
+    });
+
+    it('get multiple secrets', async () => {
+        mockInput(`
+        test secret ;
+        test secret | NAMED_SECRET ;
+        nested/test otherSecret ;`);
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledTimes(3);
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
+        expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET');
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
+    });
+
+    it('get secret from K/V v1', async () => {
+        mockInput('test secret');
+        mockEngineName('my-secret');
+        mockVersion('1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'CUSTOMSECRET');
+    });
+
+    it('get nested secret from K/V v1', async () => {
+        mockInput('nested/test otherSecret');
+        mockEngineName('my-secret');
+        mockVersion('1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERCUSTOMSECRET');
+    });
+
+    describe('generic engines', () => {
+        beforeAll(async () => {
+            await got(`${vaultUrl}/v1/cubbyhole/test`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+                json: {
+                    foo: "bar",
+                    zip: "zap"
+                },
+            });
+        });
+
+        it('supports cubbyhole', async () => {            
+            mockInput('/cubbyhole/test foo');
+
+            await exportSecrets();
+
+            expect(core.exportVariable).toBeCalledWith('FOO', 'bar');
+        });
+
+        it('caches responses', async () => {            
+            mockInput(`
+            /cubbyhole/test foo ;
+            /cubbyhole/test zip`);
+
+            await exportSecrets();
+
+            expect(core.debug).toBeCalledWith('ℹ using cached response');
+
+            expect(core.exportVariable).toBeCalledWith('FOO', 'bar');
+            expect(core.exportVariable).toBeCalledWith('ZIP', 'zap');
+        });
+    })
+});

integrationTests/e2e/README.md

@@ -0,0 +1,4 @@
+# e2e tests
+
+This test suite runs `vault-action` as a GitHub Action in the context of a live build, and then verifies that the appropriate environmental variables are set.
+These tests are intended to mostly be very simple smoke tests to verify that the action is being compiled and run correctly in context.

integrationTests/e2e/e2e.test.js

@@ -0,0 +1,13 @@
+describe('e2e', () => {
+    it('verify', () => {
+        expect(process.env.SECRET).toBe("SUPERSECRET");
+        expect(process.env.NAMED_SECRET).toBe("SUPERSECRET");
+        expect(process.env.OTHERSECRET).toBe("OTHERSUPERSECRET");
+        expect(process.env.OTHER_SECRET_OUTPUT).toBe("OTHERSUPERSECRET");
+        expect(process.env.ALTSECRET).toBe("CUSTOMSECRET");
+        expect(process.env.NAMED_ALTSECRET).toBe("CUSTOMSECRET");
+        expect(process.env.OTHERALTSECRET).toBe("OTHERCUSTOMSECRET");
+        expect(process.env.FOO).toBe("bar");
+        expect(process.env.NAMED_CUBBYSECRET).toBe("zap");
+    });
+});

integrationTests/e2e/setup.js

@@ -0,0 +1,82 @@
+const got = require('got');
+
+const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
+
+(async () => {
+    try {
+        // Verify Connection
+        await got(`http://${vaultUrl}/v1/secret/config`, {
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+        });
+
+        await got(`http://${vaultUrl}/v1/secret/data/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    secret: 'SUPERSECRET',
+                },
+            },
+        });
+
+        await got(`http://${vaultUrl}/v1/secret/data/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    otherSecret: 'OTHERSUPERSECRET',
+                },
+            }
+        });
+
+        await got(`http://${vaultUrl}/v1/sys/mounts/my-secret`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                type: 'kv'
+            }
+        });
+
+        await got(`http://${vaultUrl}/v1/my-secret/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                altSecret: 'CUSTOMSECRET',
+            }
+        });
+
+        await got(`http://${vaultUrl}/v1/my-secret/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                otherAltSecret: 'OTHERCUSTOMSECRET',
+            },
+        });
+
+        await got(`http://${vaultUrl}/v1/cubbyhole/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                foo: 'bar',
+                zip: 'zap',
+            },
+        });
+    } catch (error) {
+        console.log(error);
+        process.exit(1);
+    }
+})();

integrationTests/enterprise/enterprise.test.js

@@ -0,0 +1,307 @@
+jest.mock('@actions/core');
+jest.mock('@actions/core/lib/command');
+const core = require('@actions/core');
+
+const got = require('got');
+const { when } = require('jest-when');
+
+const { exportSecrets } = require('../../src/action');
+
+const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8201'}`;
+
+describe('integration', () => {
+    beforeAll(async () => {
+        try {
+            // Verify Connection
+            await got(`${vaultUrl}/v1/secret/config`, {
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+            });
+
+            // Create namespace
+            await enableNamespace('ns1');
+
+            // Enable K/V v2 secret engine at 'secret/'
+            await enableEngine('secret', 'ns1', 2);
+
+            await writeSecret('secret', 'test', 'ns1', 2, {secret: 'SUPERSECRET_IN_NAMESPACE'})
+            await writeSecret('secret', 'nested/test', 'ns1', 2, {otherSecret: 'OTHERSUPERSECRET_IN_NAMESPACE'})
+
+            // Enable K/V v1 secret engine at 'my-secret/'
+            await enableEngine('my-secret', 'ns1', 1);
+
+            await writeSecret('my-secret', 'test', 'ns1', 1, {secret: 'CUSTOMSECRET_IN_NAMESPACE'})
+            await writeSecret('my-secret', 'nested/test', 'ns1', 1, {otherSecret: 'OTHERCUSTOMSECRET_IN_NAMESPACE'})
+        } catch (e) {
+            console.error('Failed to setup test', e);
+            throw e;
+        }
+    });
+
+    beforeEach(() => {
+        jest.resetAllMocks();
+
+        when(core.getInput)
+            .calledWith('url')
+            .mockReturnValueOnce(`${vaultUrl}`);
+
+        when(core.getInput)
+            .calledWith('token')
+            .mockReturnValueOnce('testtoken');
+
+        when(core.getInput)
+            .calledWith('namespace')
+            .mockReturnValueOnce('ns1');
+    });
+
+    it('get simple secret', async () => {
+        mockInput('test secret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET_IN_NAMESPACE');
+    });
+
+    it('re-map secret', async () => {
+        mockInput('test secret | TEST_KEY');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('TEST_KEY', 'SUPERSECRET_IN_NAMESPACE');
+    });
+
+    it('get nested secret', async () => {
+        mockInput('nested/test otherSecret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET_IN_NAMESPACE');
+    });
+
+    it('get multiple secrets', async () => {
+        mockInput(`
+        test secret ;
+        test secret | NAMED_SECRET ;
+        nested/test otherSecret ;`);
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledTimes(3);
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET_IN_NAMESPACE');
+        expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET_IN_NAMESPACE');
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET_IN_NAMESPACE');
+    });
+
+    it('get secret from K/V v1', async () => {
+        mockInput('test secret');
+        mockEngineName('my-secret');
+        mockVersion('1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'CUSTOMSECRET_IN_NAMESPACE');
+    });
+
+    it('get nested secret from K/V v1', async () => {
+        mockInput('nested/test otherSecret');
+        mockEngineName('my-secret');
+        mockVersion('1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERCUSTOMSECRET_IN_NAMESPACE');
+    });
+});
+
+describe('authenticate with approle', () => {
+    let roleId;
+    let secretId;
+    beforeAll(async () => {
+        try {
+            // Verify Connection
+            await got(`${vaultUrl}/v1/secret/config`, {
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+            });
+
+            // Create namespace
+            await enableNamespace("ns2");
+
+            // Enable K/V v2 secret engine at 'secret/'
+            await enableEngine("secret", "ns2", 2);
+
+            // Add secret
+            await writeSecret('secret', 'test', 'ns2', 2, {secret: 'SUPERSECRET_WITH_APPROLE'})
+
+            // Enable approle
+            try {
+                await got(`${vaultUrl}/v1/sys/auth/approle`, {
+                    method: 'POST',
+                    headers: {
+                        'X-Vault-Token': 'testtoken',
+                        'X-Vault-Namespace': 'ns2',
+                    },
+                    json: {
+                        type: 'approle'
+                    },
+                });
+            } catch (error) {
+                const {response} = error;
+                if (response.statusCode === 400 && response.body.includes("path is already in use")) {
+                    // Approle might already be enabled from previous test runs
+                } else {
+                    throw error;
+                }
+            }
+
+            // Create policies
+            await got(`${vaultUrl}/v1/sys/policies/acl/test`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                    'X-Vault-Namespace': 'ns2',
+                },
+                json: {
+                    "name":"test",
+                    "policy":"path \"auth/approle/*\" {\n    capabilities = [\"read\", \"list\"]\n}\npath \"auth/approle/role/my-role/role-id\"\n{\n    capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\n}\npath \"auth/approle/role/my-role/secret-id\"\n{\n    capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\n}\n\npath \"secret/data/*\" {\n    capabilities = [\"list\"]\n}\npath \"secret/metadata/*\" {\n    capabilities = [\"list\"]\n}\n\npath \"secret/data/test\" {\n    capabilities = [\"read\", \"list\"]\n}\npath \"secret/metadata/test\" {\n    capabilities = [\"read\", \"list\"]\n}\npath \"secret/data/test/*\" {\n    capabilities = [\"read\", \"list\"]\n}\npath \"secret/metadata/test/*\" {\n    capabilities = [\"read\", \"list\"]\n}\n"
+                },
+            });
+
+            // Create approle
+            await got(`${vaultUrl}/v1/auth/approle/role/my-role`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                    'X-Vault-Namespace': 'ns2',
+                },
+                json: {
+                    policies: 'test'
+                },
+            });
+
+            // Get role-id
+            const roldIdResponse = await got(`${vaultUrl}/v1/auth/approle/role/my-role/role-id`, {
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                    'X-Vault-Namespace': 'ns2',
+                },
+                responseType: 'json',
+            });
+            roleId = roldIdResponse.body.data.role_id;
+
+            // Get secret-id
+            const secretIdResponse = await got(`${vaultUrl}/v1/auth/approle/role/my-role/secret-id`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                    'X-Vault-Namespace': 'ns2',
+                },
+                responseType: 'json',
+            });
+            secretId = secretIdResponse.body.data.secret_id;
+        } catch(err) {
+            console.warn('Create approle', err.response.body);
+            throw err;
+        }
+    });
+
+    beforeEach(() => {
+        jest.resetAllMocks();
+
+        when(core.getInput)
+            .calledWith('method', expect.anything())
+            .mockReturnValueOnce('approle');
+        when(core.getInput)
+            .calledWith('roleId')
+            .mockReturnValueOnce(roleId);
+        when(core.getInput)
+            .calledWith('secretId')
+            .mockReturnValueOnce(secretId);
+        when(core.getInput)
+            .calledWith('url')
+            .mockReturnValueOnce(`${vaultUrl}`);
+        when(core.getInput)
+            .calledWith('namespace')
+            .mockReturnValueOnce('ns2');
+    });
+
+    it('authenticate with approle', async() => {
+        mockInput('test secret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET_WITH_APPROLE');
+    })
+});
+
+async function enableNamespace(name) {
+    try {
+        await got(`${vaultUrl}/v1/sys/namespaces/${name}`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            }
+        });
+    } catch (error) {
+        const {response} = error;
+        if (response.statusCode === 400 && response.body.includes("already exists")) {
+            // Namespace might already be enabled from previous test runs
+        } else {
+            throw error;
+        }
+    }
+}
+
+async function enableEngine(path, namespace, version) {
+    try {
+        await got(`${vaultUrl}/v1/sys/mounts/${path}`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+                'X-Vault-Namespace': namespace,
+            },
+            json: { type: 'kv', config: {}, options: { version }, generate_signing_key: true },
+        });
+    } catch (error) {
+        const {response} = error;
+        if (response.statusCode === 400 && response.body.includes("path is already in use")) {
+            // Engine might already be enabled from previous test runs
+        } else {
+            throw error;
+        }
+    }
+}
+
+async function writeSecret(engine, path, namespace, version, data) {
+    const secretPath = (version == 1) ? (`${engine}/${path}`) : (`${engine}/data/${path}`);
+    const secretPayload = (version == 1) ? (data) : ({data});
+    await got(`${vaultUrl}/v1/${secretPath}`, {
+        method: 'POST',
+        headers: {
+            'X-Vault-Token': 'testtoken',
+            'X-Vault-Namespace': namespace,
+        },
+        json: secretPayload
+    });
+}
+
+function mockInput(secrets) {
+    when(core.getInput)
+        .calledWith('secrets')
+        .mockReturnValueOnce(secrets);
+}
+
+function mockEngineName(name) {
+    when(core.getInput)
+        .calledWith('path')
+        .mockReturnValueOnce(name);
+}
+
+function mockVersion(version) {
+    when(core.getInput)
+        .calledWith('kv-version')
+        .mockReturnValueOnce(version);
+}

integrationTests/enterprise/jest.config.js

@@ -0,0 +1,3 @@
+module.exports = {
+    verbose: true
+};

jest.config.js

@@ -1,3 +1,3 @@
 module.exports = {
-    testPathIgnorePatterns: ['/node_modules/', '<rootDir>/integration/', '<rootDir>/e2e/'],
+    testPathIgnorePatterns: ['/node_modules/', '<rootDir>/integrationTests/'],
 };

package.json

@@ -2,11 +2,22 @@
     "name": "vault-action",
     "version": "0.1.0",
     "description": "A Github Action that allows you to consume vault secrets as secure environment variables.",
-  "main": "index.js",
+    "main": "dist/index.js",
     "scripts": {
+        "build": "ncc build src/index.js -o dist",
         "test": "jest",
-    "test:integration": "jest -c integration/jest.config.js",
-    "test:e2e": "jest -c e2e/jest.config.js"
+        "test:integration:basic": "jest -c integrationTests/basic/jest.config.js",
+        "test:integration:enterprise": "jest -c integrationTests/enterprise/jest.config.js",
+        "test:e2e": "jest -c integrationTests/e2e/jest.config.js"
+    },
+    "release": {
+        "branch": "master",
+        "plugins": [
+            "@semantic-release/commit-analyzer",
+            "@semantic-release/release-notes-generator",
+            "@semantic-release/github"
+        ],
+        "ci": false
     },
     "repository": {
         "type": "git",
@@ -27,12 +38,15 @@
     },
     "homepage": "https://github.com/RichiCoder1/vault-action#readme",
     "dependencies": {
-    "@actions/core": "^1.1.1",
-    "got": "^9.6.0"
+        "got": "^10.2.2",
+        "@actions/core": "^1.2.3"
     },
     "devDependencies": {
-    "@types/jest": "^24.0.18",
-    "jest": "^24.9.0",
-    "jest-when": "^2.7.0"
+        "@types/got": "^9.6.9",
+        "@types/jest": "^25.1.3",
+        "@zeit/ncc": "^0.22.0",
+        "jest": "^25.1.0",
+        "jest-when": "^2.7.0",
+        "semantic-release": "^17.0.4"
     }
 }

src/action.js

@@ -0,0 +1,242 @@
+// @ts-check
+const core = require('@actions/core');
+const command = require('@actions/core/lib/command');
+const got = require('got').default;
+const { retrieveToken } = require('./auth');
+
+const AUTH_METHODS = ['approle', 'token', 'github'];
+const VALID_KV_VERSION = [-1, 1, 2];
+
+async function exportSecrets() {
+    const vaultUrl = core.getInput('url', { required: true });
+    const vaultNamespace = core.getInput('namespace', { required: false });
+    const extraHeaders = parseHeadersInput('extraHeaders', { required: false });
+    const exportEnv = core.getInput('exportEnv', { required: false }) != 'false';
+
+    let enginePath = core.getInput('path', { required: false });
+    /** @type {number | string} */
+    let kvVersion = core.getInput('kv-version', { required: false });
+
+    const secretsInput = core.getInput('secrets', { required: true });
+    const secretRequests = parseSecretsInput(secretsInput);
+
+    const vaultMethod = (core.getInput('method', { required: false }) || 'token').toLowerCase();
+    if (!AUTH_METHODS.includes(vaultMethod)) {
+        throw Error(`Sorry, the authentication method ${vaultMethod} is not currently supported.`);
+    }
+
+    const defaultOptions = {
+        prefixUrl: vaultUrl,
+        headers: {}
+    }
+
+    for (const [headerName, headerValue] of extraHeaders) {
+        defaultOptions.headers[headerName] = headerValue;
+    }
+
+    if (vaultNamespace != null) {
+        defaultOptions.headers["X-Vault-Namespace"] = vaultNamespace;
+    }
+
+    const client = got.extend(defaultOptions);
+    const vaultToken = await retrieveToken(vaultMethod, client);
+
+    if (!enginePath) {
+        enginePath = 'secret';
+    }
+
+    if (!kvVersion) {
+        kvVersion = 2;
+    }
+    kvVersion = +kvVersion;
+
+    if (Number.isNaN(kvVersion) || !VALID_KV_VERSION.includes(kvVersion)) {
+        throw Error(`You must provide a valid K/V version (${VALID_KV_VERSION.slice(1).join(', ')}). Input: "${kvVersion}"`);
+    }
+
+    const responseCache = new Map();
+    for (const secretRequest of secretRequests) {
+        const { secretPath, outputVarName, envVarName, secretSelector, isJSONPath } = secretRequest;
+        const requestOptions = {
+            headers: {
+                'X-Vault-Token': vaultToken
+            },
+        };
+
+        for (const [headerName, headerValue] of extraHeaders) {
+            requestOptions.headers[headerName] = headerValue;
+        }
+
+        if (vaultNamespace != null) {
+            requestOptions.headers["X-Vault-Namespace"] = vaultNamespace;
+        }
+
+        let requestPath = `v1`;
+        const kvRequest = !secretPath.startsWith('/')
+        if (!kvRequest) {
+            requestPath += secretPath;
+        } else {
+           requestPath += (kvVersion === 2)
+                    ? `/${enginePath}/data/${secretPath}`
+                    : `/${enginePath}/${secretPath}`;
+        }
+
+        let body;
+        if (responseCache.has(requestPath)) {
+            body = responseCache.get(requestPath);
+            core.debug('ℹ using cached response');
+        } else {
+            const result = await client.get(requestPath, requestOptions);
+            body = result.body;
+            responseCache.set(requestPath, body);
+        }
+
+        let dataDepth = isJSONPath === true ? 0 : kvRequest === false ? 1 : kvVersion;
+
+        const secretData = getResponseData(body, dataDepth);
+        const value = selectData(secretData, secretSelector, isJSONPath);
+        command.issue('add-mask', value);
+        if (exportEnv) {
+            core.exportVariable(envVarName, `${value}`);
+        }
+        core.setOutput(outputVarName, `${value}`);
+        core.debug(`✔ ${secretPath} => outputs.${outputVarName}${exportEnv ? ` | env.${envVarName}` : ''}`);
+    }
+};
+
+/** @typedef {Object} SecretRequest 
+ * @property {string} secretPath
+ * @property {string} envVarName
+ * @property {string} outputVarName
+ * @property {string} secretSelector
+ * @property {boolean} isJSONPath
+*/
+
+/**
+ * Parses a secrets input string into key paths and their resulting environment variable name.
+ * @param {string} secretsInput
+ */
+function parseSecretsInput(secretsInput) {
+    const secrets = secretsInput
+        .split(';')
+        .filter(key => !!key)
+        .map(key => key.trim())
+        .filter(key => key.length !== 0);
+
+    /** @type {SecretRequest[]} */
+    const output = [];
+    for (const secret of secrets) {
+        let path = secret;
+        let outputVarName = null;
+
+        const renameSigilIndex = secret.lastIndexOf('|');
+        if (renameSigilIndex > -1) {
+            path = secret.substring(0, renameSigilIndex).trim();
+            outputVarName = secret.substring(renameSigilIndex + 1).trim();
+
+            if (outputVarName.length < 1) {
+                throw Error(`You must provide a value when mapping a secret to a name. Input: "${secret}"`);
+            }
+        }
+
+        const pathParts = path
+            .split(/\s+/)
+            .map(part => part.trim())
+            .filter(part => part.length !== 0);
+
+        if (pathParts.length !== 2) {
+            throw Error(`You must provide a valid path and key. Input: "${secret}"`);
+        }
+
+        const [secretPath, secretSelector] = pathParts;
+
+        const isJSONPath = secretSelector.includes('.');
+
+        if (isJSONPath && !outputVarName) {
+            throw Error(`You must provide a name for the output key when using json selectors. Input: "${secret}"`);
+        }
+
+        let envVarName = outputVarName;
+        if (!outputVarName) {
+            outputVarName = secretSelector;
+            envVarName = normalizeOutputKey(outputVarName);
+        }
+
+        output.push({
+            secretPath,
+            envVarName,
+            outputVarName,
+            secretSelector,
+            isJSONPath
+        });
+    }
+    return output;
+}
+
+/**
+ * Parses a JSON response and returns the secret data
+ * @param {string} responseBody
+ * @param {number} dataLevel
+ */
+function getResponseData(responseBody, dataLevel) {
+    let secretData = JSON.parse(responseBody);
+
+    for (let i = 0; i < dataLevel; i++) {
+        secretData = secretData['data'];
+    }
+    return secretData;
+}
+
+/**
+ * Parses a JSON response and returns the secret data
+ * @param {Object} data
+ * @param {string} selector
+ */
+function selectData(data, selector, isJSONPath) {
+    if (!isJSONPath) {
+        return data[selector];
+    }
+
+    // TODO: JSONPath
+}
+
+/**
+ * Replaces any forward-slash characters to
+ * @param {string} dataKey
+ */
+function normalizeOutputKey(dataKey) {
+    return dataKey.replace('/', '__').replace(/[^\w-]/, '').toUpperCase();
+}
+
+/**
+ * @param {string} inputKey
+ * @param {any} inputOptions
+ */
+function parseHeadersInput(inputKey, inputOptions) {
+    /** @type {string}*/
+    const rawHeadersString = core.getInput(inputKey, inputOptions) || '';
+    const headerStrings = rawHeadersString
+        .split('\n')
+        .map(line => line.trim())
+        .filter(line => line !== '');
+    return headerStrings
+        .reduce((map, line) => {
+            const seperator = line.indexOf(':');
+            const key = line.substring(0, seperator).trim().toLowerCase();
+            const value = line.substring(seperator + 1).trim();
+            if (map.has(key)) {
+                map.set(key, [map.get(key), value].join(', '));
+            } else {
+                map.set(key, value);
+            }
+            return map;
+        }, new Map());
+}
+
+module.exports = {
+    exportSecrets,
+    parseSecretsInput,
+    parseResponse: getResponseData,
+    normalizeOutputKey,
+    parseHeadersInput
+};

src/action.test.js

@@ -0,0 +1,270 @@
+jest.mock('got');
+jest.mock('@actions/core');
+jest.mock('@actions/core/lib/command');
+
+const core = require('@actions/core');
+const got = require('got');
+const {
+    exportSecrets,
+    parseSecretsInput,
+    parseResponse,
+    parseHeadersInput
+} = require('./action');
+
+const { when } = require('jest-when');
+
+describe('parseSecretsInput', () => {
+    it('parses simple secret', () => {
+        const output = parseSecretsInput('test key');
+        expect(output).toContainEqual({
+            secretPath: 'test',
+            secretSelector: 'key',
+            outputVarName: 'key',
+            envVarName: 'KEY',
+            isJSONPath: false
+        });
+    });
+
+    it('parses mapped secret', () => {
+        const output = parseSecretsInput('test key|testName');
+        expect(output).toHaveLength(1);
+        expect(output[0]).toMatchObject({
+            outputVarName: 'testName',
+            envVarName: 'testName',
+        });
+    });
+
+    it('fails on invalid mapped name', () => {
+        expect(() => parseSecretsInput('test key|'))
+            .toThrowError(`You must provide a value when mapping a secret to a name. Input: "test key|"`)
+    });
+
+    it('fails on invalid path for mapped', () => {
+        expect(() => parseSecretsInput('|testName'))
+            .toThrowError(`You must provide a valid path and key. Input: "|testName"`)
+    });
+
+    it('parses multiple secrets', () => {
+        const output = parseSecretsInput('first a;second b;');
+
+        expect(output).toHaveLength(2);
+        expect(output[0]).toMatchObject({
+            secretPath: 'first',
+        });
+        expect(output[1]).toMatchObject({
+            secretPath: 'second',
+        });
+    });
+
+    it('parses multiple complex secret input', () => {
+        const output = parseSecretsInput('first a;second b|secondName');
+
+        expect(output).toHaveLength(2);
+        expect(output[0]).toMatchObject({
+            outputVarName: 'a',
+            envVarName: 'A',
+        });
+        expect(output[1]).toMatchObject({
+            outputVarName: 'secondName',
+            envVarName: 'secondName'
+        });
+    });
+
+    it('parses multiline input', () => {
+        const output = parseSecretsInput(`
+        first a;
+        second b;
+        third c | SOME_C;`);
+
+        expect(output).toHaveLength(3);
+        expect(output[0]).toMatchObject({
+            secretPath: 'first',
+        });
+        expect(output[1]).toMatchObject({
+            outputVarName: 'b',
+            envVarName: 'B'
+        });
+        expect(output[2]).toMatchObject({
+            outputVarName: 'SOME_C',
+            envVarName: 'SOME_C',
+        });
+    })
+});
+
+describe('parseHeaders', () => {
+    it('parses simple header', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce('TEST: 1');
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toContainEqual(['test', '1']);
+    });
+
+    it('parses simple header with whitespace', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(`
+            TEST: 1
+            `);
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toContainEqual(['test', '1']);
+    });
+
+    it('parses multiple headers', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(`
+            TEST: 1
+            FOO: bAr
+            `);
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toContainEqual(['test', '1']);
+        expect(Array.from(result)).toContainEqual(['foo', 'bAr']);
+    });
+
+    it('parses null response', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(null);
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toHaveLength(0);
+    });
+})
+
+describe('parseResponse', () => {
+    // https://www.vaultproject.io/api/secret/kv/kv-v1.html#sample-response
+    it('parses K/V version 1 response', () => {
+        const response = JSON.stringify({
+            data: {
+                foo: 'bar'
+            }
+        })
+        const output = parseResponse(response, 1);
+
+        expect(output).toEqual({
+            foo: 'bar'
+        });
+    });
+
+    // https://www.vaultproject.io/api/secret/kv/kv-v2.html#read-secret-version
+    it('parses K/V version 2 response', () => {
+        const response = JSON.stringify({
+            data: {
+                data: {
+                    foo: 'bar'
+                }
+            }
+        })
+        const output = parseResponse(response, 2);
+
+        expect(output).toEqual({
+            foo: 'bar'
+        });
+    });
+});
+
+
+describe('exportSecrets', () => {
+    beforeEach(() => {
+        jest.resetAllMocks();
+
+        when(core.getInput)
+            .calledWith('url')
+            .mockReturnValueOnce('http://vault:8200');
+
+        when(core.getInput)
+            .calledWith('token')
+            .mockReturnValueOnce('EXAMPLE');
+    });
+
+    function mockInput(key) {
+        when(core.getInput)
+            .calledWith('secrets')
+            .mockReturnValueOnce(key);
+    }
+
+    function mockVersion(version) {
+        when(core.getInput)
+            .calledWith('kv-version')
+            .mockReturnValueOnce(version);
+    }
+
+    function mockExtraHeaders(headerString) {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(headerString);
+    }
+
+    function mockVaultData(data, version='2') {
+        switch(version) {
+            case '1':
+                got.extend.mockReturnValue({
+                    get: async () => ({ body: JSON.stringify({ data }) })
+                });
+            break;
+            case '2':
+                got.extend.mockReturnValue({
+                    get: async () => ({ body: JSON.stringify({ data: {
+                        data
+                    } }) })
+                });
+            break;
+        }
+    }
+
+    it('simple secret retrieval', async () => {
+        mockInput('test key');
+        mockVaultData({
+            key: 1
+        });
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
+    });
+
+    it('mapped secret retrieval', async () => {
+        mockInput('test key|TEST_NAME');
+        mockVaultData({
+            key: 1
+        });
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('TEST_NAME', '1');
+        expect(core.setOutput).toBeCalledWith('TEST_NAME', '1');
+    });
+
+    it('simple secret retrieval from K/V v1', async () => {
+        const version = '1';
+
+        mockInput('test key');
+        mockExtraHeaders(`
+        TEST: 1
+        `);
+        mockVaultData({
+            key: 1
+        });
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
+    });
+
+    it('simple secret retrieval with extra headers', async () => {
+        const version = '1';
+
+        mockInput('test key');
+        mockVersion(version);
+        mockVaultData({
+            key: 1
+        }, version);
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
+    });
+});

src/auth.js

@@ -0,0 +1,81 @@
+// @ts-check
+const core = require('@actions/core');
+
+/***
+ * Authenticate with Vault and retrieve a Vault token that can be used for requests.
+ * @param {string} method
+ * @param {import('got').Got} client
+ */
+async function retrieveToken(method, client) {
+    switch (method) {
+        case 'approle': {
+            const vaultRoleId = core.getInput('roleId', { required: true });
+            const vaultSecretId = core.getInput('secretId', { required: true });
+            return await getClientToken(client, method, { role_id: vaultRoleId, secret_id: vaultSecretId });
+        }
+        case 'github': {
+            const githubToken = core.getInput('githubToken', { required: true });
+            return await getClientToken(client, method, { token: githubToken });
+        }
+        default: {
+            if (!method || method === 'token') {
+                return core.getInput('token', { required: true });
+            } else {
+                /** @type {string} */
+                const payload = core.getInput('authPayload', { required: true });
+                if (!payload) {
+                    throw Error('When using a custom authentication method, you must provide the payload');
+                }
+                return await getClientToken(client, method, JSON.parse(payload.trim()));
+            }
+        }
+    }
+}
+
+/***
+ * Call the appropriate login endpoint and parse out the token in the response.
+ * @param {import('got').Got} client
+ * @param {string} method
+ * @param {any} payload
+ */
+async function getClientToken(client, method, payload) {
+    /** @type {'json'} */
+    const responseType = 'json';
+    var options = {
+        json: payload,
+        responseType,
+    };
+
+    core.debug(`Retrieving Vault Token from v1/auth/${method}/login endpoint`);
+
+    /** @type {import('got').Response<VaultLoginResponse>} */
+    const response = await client.post(`v1/auth/${method}/login`, options);
+    if (response && response.body && response.body.auth && response.body.auth.client_token) {
+        core.debug('✔ Vault Token successfully retrieved');
+
+        core.startGroup('Token Info');
+        core.debug(`Operating under policies: ${JSON.stringify(response.body.auth.policies)}`);
+        core.debug(`Token Metadata: ${JSON.stringify(response.body.auth.metadata)}`);
+        core.endGroup();
+
+        return response.body.auth.client_token;
+    } else {
+        throw Error(`Unable to retrieve token from ${method}'s login endpoint.`);
+    }
+}
+
+/***
+ * @typedef {Object} VaultLoginResponse
+ * @property {{
+ *  client_token: string;
+ *  accessor: string;
+ *  policies: string[];
+ *  metadata: unknown;
+ *  lease_duration: number;
+ *  renewable: boolean;
+ * }} auth
+ */
+
+module.exports = {
+    retrieveToken,
+};

tsconfig.json

@@ -0,0 +1,12 @@
+{
+    "compilerOptions": {
+        "module": "commonjs",
+        "target": "es2019",
+        "moduleResolution": "node",
+        "allowJs": true,
+        "noEmit": true
+    },
+    "exclude": [
+        "node_modules"
+    ]
+}