feat: support for KV version 1 and custom-named engines (#12)

* feat: kv v1 and engine path

* doc: add custom version and engine path usage docs

Co-authored-by: Richard Simpson <richardsimpson@outlook.com>

.github/workflows/build.yml

@@ -0,0 +1,160 @@
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v1
+    - name: Use Node.js 10.x
+      uses: actions/setup-node@v1
+      with:
+        node-version: 10.x
+    - name: setup npm cache
+      uses: actions/cache@v1
+      with:
+        path: ~/.npm
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+    - name: npm install
+      run: npm ci
+    - name: npm build
+      run: npm run build
+    - name: npm run test
+      run: npm run test
+
+  integration:
+    runs-on: ubuntu-latest
+
+    services:
+      vaultBasic:
+        image: vault:1.2.3
+        ports:
+          - 8200/tcp
+        env:
+          VAULT_DEV_ROOT_TOKEN_ID: testtoken
+        options: --cap-add=IPC_LOCK
+      vaultEnterprise:
+        image: hashicorp/vault-enterprise:1.3.0_ent
+        ports:
+          - 8200/tcp
+        env:
+          VAULT_DEV_ROOT_TOKEN_ID: testtoken
+        options: --cap-add=IPC_LOCK
+
+    steps:
+      - uses: actions/checkout@v1
+      - name: Use Node.js 10.x
+        uses: actions/setup-node@v1
+        with:
+          node-version: 10.x
+      - name: setup npm cache
+        uses: actions/cache@v1
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+      - name: npm install
+        run: npm ci
+      - name: npm build
+        run: npm run build
+      - name: npm run test:integration:basic
+        run: npm run test:integration:basic
+        env:
+          VAULT_HOST: localhost
+          VAULT_PORT: ${{ job.services.vaultBasic.ports[8200] }}
+          CI: true
+      - name: npm run test:integration:enterprise
+        run: npm run test:integration:enterprise
+        env:
+          VAULT_HOST: localhost
+          VAULT_PORT: ${{ job.services.vaultEnterprise.ports[8200] }}
+          CI: true
+
+  e2e:
+    runs-on: ubuntu-latest
+
+    services:
+      vault:
+        image: vault:1.3.0
+        ports:
+          - 8200/tcp
+        env:
+          VAULT_DEV_ROOT_TOKEN_ID: testtoken
+        options: --cap-add=IPC_LOCK
+
+    steps:
+    - uses: actions/checkout@v1
+    - name: Use Node.js 10.x
+      uses: actions/setup-node@v1
+      with:
+        node-version: 10.x
+    - name: setup npm cache
+      uses: actions/cache@v1
+      with:
+        path: ~/.npm
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+    - name: npm install
+      run: npm ci
+    - name: npm build
+      run: npm run build
+    - name: setup vault
+      run: node ./integrationTests/e2e/setup.js
+      env:
+        VAULT_HOST: localhost
+        VAULT_PORT: ${{ job.services.vault.ports[8200] }}
+    - name: use vault action (default K/V version 2)
+      uses: ./
+      with:
+        url: http://localhost:${{ job.services.vault.ports[8200] }}
+        token: testtoken
+        secrets: |
+          test secret ;
+          test secret | NAMED_SECRET ;
+          nested/test otherSecret ;
+    - name: use vault action (custom K/V version 1)
+      uses: ./
+      with:
+        url: http://localhost:${{ job.services.vault.ports[8200] }}
+        token: testtoken
+        path: my-secret
+        kv-version: 1
+        secrets: |
+          test altSecret ;
+          test altSecret | NAMED_ALTSECRET ;
+          nested/test otherAltSecret ;
+    - name: verify
+      run: npm run test:e2e
+
+  publish:
+    if: github.event_name	== 'push' && contains(github.ref, 'master')
+    runs-on: ubuntu-latest
+    needs: [build, integration, e2e]
+    steps:
+    - uses: actions/checkout@v1
+    - name: Use Node.js 10.x
+      uses: actions/setup-node@v1
+      with:
+        node-version: 10.x
+    - name: setup npm cache
+      uses: actions/cache@v1
+      with:
+        path: ~/.npm
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+    - name: npm install
+      run: npm ci
+    - name: release
+      if: success() && endsWith(github.ref, 'master')
+      run: npx semantic-release
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+

.github/workflows/test.yml

@@ -1,87 +0,0 @@
-name: Test
-
-on: [push]
-
-jobs:
-  unit:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v1
-    - name: Use Node.js 10.x
-      uses: actions/setup-node@v1
-      with:
-        node-version: 10.x
-    - name: npm install and test
-      run: |
-        npm ci
-        npm test
-      env:
-        CI: true
-
-  integration:
-    runs-on: ubuntu-latest
-
-    services:
-      vault:
-        image: vault:1.2.3
-        ports:
-          - 8200/tcp
-        env:
-          VAULT_DEV_ROOT_TOKEN_ID: testtoken
-        options: --cap-add=IPC_LOCK
-
-    steps:
-    - uses: actions/checkout@v1
-    - name: Use Node.js 10.x
-      uses: actions/setup-node@v1
-      with:
-        node-version: 10.x
-    - name: npm install
-      run: npm ci
-    - name: npm run test:integration
-      run: npm run test:integration
-      env:
-        VAULT_HOST: localhost
-        VAULT_PORT: ${{ job.services.vault.ports[8200] }}
-
-  e2e:
-    runs-on: ubuntu-latest
-
-    services:
-      vault:
-        image: vault:1.2.3
-        ports:
-          - 8200/tcp
-        env:
-          VAULT_DEV_ROOT_TOKEN_ID: testtoken
-        options: --cap-add=IPC_LOCK
-
-    steps:
-    - uses: actions/checkout@v1
-    - name: Use Node.js 10.x
-      uses: actions/setup-node@v1
-      with:
-        node-version: 10.x
-    - name: npm install
-      run: npm ci
-    - name: setup vault
-      run: node ./e2e/setup.js
-      env:
-        VAULT_HOST: localhost
-        VAULT_PORT: ${{ job.services.vault.ports[8200] }}
-    - name: use vault action
-      uses: ./
-      with:
-        url: http://localhost:${{ job.services.vault.ports[8200] }}
-        token: testtoken
-        secrets: |
-          test secret ;
-          test secret | NAMED_SECRET ;
-          nested/test otherSecret ;
-    - name: verify
-      run: npm run test:e2e
-
-  
-

README.md

@@ -1,6 +1,8 @@
 # vault-action
 
-A helper action for easily pulling secrets from the v2 K/V backend of vault.
+A helper action for easily pulling secrets from the K/V backend of vault.
+
+Expects [Version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2/) of the KV Secrets Engine by default.
 
 ## Example Usage
 
@@ -22,6 +24,26 @@ jobs:
             # ...
 ```
 
+## Authentication method
+
+The `method` parameter can have these value :
+- **token**: (by default) you must provide a token parameter
+```yaml
+...
+with:
+  url: https://vault.mycompany.com:8200
+  token: ${{ secrets.VaultToken }}
+```
+- **approle**: you must provide a roleId & secretId parameter
+```yaml
+...
+with:
+  url: https://vault.mycompany.com:8200
+  method: approle
+  roleId: ${{ secrets.roleId }}
+  secretId: ${{ secrets.secretId }}
+```
+
 ## Key Syntax
 
 The `secrets` parameter is a set of multiple secret requests separated by the `;` character.
@@ -68,11 +90,55 @@ This action can take multi-line input, so say you had your AWS keys stored in a
 
 ```yaml
 with:
-    keys: |
+    secrets: |
         ci/aws accessKey | AWS_ACCESS_KEY_ID ;
         ci/aws secretKey | AWS_SECRET_ACCESS_KEY
 ```
 
+### Using K/V version 1
+
+By default, `vault-action` expects a K/V engine using [version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2.html).
+
+In order to work with a [v1 engine](https://www.vaultproject.io/docs/secrets/kv/kv-v1/), the `kv-version` parameter may be passed:
+
+```yaml
+with:
+    kv-version: 1
+```
+
+### Custom Engine Path
+
+When you enable the K/V Engine, by default it's placed at the path `secret`, so a secret named `ci` will be accessed from `secret/ci`. However, [if you enabled the secrets engine using a custom `path`](https://www.vaultproject.io/docs/commands/secrets/enable/#inlinecode--path-4), you
+can pass it as follows:
+
+```yaml
+with:
+    path: my-secrets
+    secrets: ci npmToken
+```
+
+This way, the `ci` secret in the example above will be retrieved from `my-secrets/ci`.
+
+### Namespace
+
+This action could be use with namespace Vault Enterprise feature. You can specify namespace in request :
+
+```yaml
+steps:
+    # ...
+    - name: Import Secrets
+      uses: RichiCoder1/vault-action
+      with:
+        url: https://vault-enterprise.mycompany.com:8200
+        method: token
+        token: ${{ secrets.VaultToken }}
+        namespace: ns1
+        secrets: |
+            ci/aws accessKey | AWS_ACCESS_KEY_ID ;
+            ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
+            ci npm_token
+```
+
 ## Masking
 
 This action uses Github Action's built in masking, so all variables will automatically be masked if printed to the console or to logs.

action.js

@@ -2,25 +2,84 @@ const core = require('@actions/core');
 const command = require('@actions/core/lib/command');
 const got = require('got');
 
+const AUTH_METHODS = ['approle', 'token'];
 async function exportSecrets() {
     const vaultUrl = core.getInput('url', { required: true });
-    const vaultToken = core.getInput('token', { required: true });
+    const vaultNamespace = core.getInput('namespace', { required: false });
+
+    let enginePath = core.getInput('path', { required: false });
+    let kvVersion = core.getInput('kv-version', { required: false });
 
     const secretsInput = core.getInput('secrets', { required: true });
     const secrets = parseSecretsInput(secretsInput);
 
+    const vaultMethod = core.getInput('method', { required: false }) || 'token';
+    if (!AUTH_METHODS.includes(vaultMethod)) {
+        throw Error(`Sorry, the authentication method ${vaultMethod} is not currently supported.`);
+    }
+
+    let vaultToken = null;
+    switch (vaultMethod) {
+        case 'approle':
+            const vaultRoleId = core.getInput('roleId', { required: true });
+            const vaultSecretId = core.getInput('secretId', { required: true });
+            core.debug('Try to retrieve Vault Token from approle');
+            var options = {
+                headers: {},
+                json: { role_id: vaultRoleId, secret_id: vaultSecretId },
+                responseType: 'json'
+            };
+
+            if (vaultNamespace != null) {
+                options.headers["X-Vault-Namespace"] = vaultNamespace;
+            }
+
+            const result = await got.post(`${vaultUrl}/v1/auth/approle/login`, options);
+            if (result && result.body && result.body.auth && result.body.auth.client_token) {
+                vaultToken = result.body.auth.client_token;
+                core.debug('✔ Vault Token has retrieved from approle');
+            } else {
+                throw Error(`No token was retrieved with the role_id and secret_id provided.`);
+            }
+            break;
+        default:
+            vaultToken = core.getInput('token', { required: true });
+            break;
+    }
+
+    if (!enginePath) {
+        enginePath = 'secret';
+    }
+
+    if (!kvVersion) {
+        kvVersion = '2';
+    }
+
+    if (kvVersion !== '1' && kvVersion !== '2') {
+        throw Error(`You must provide a valid K/V version (1 or 2). Input: "${kvVersion}"`);
+    }
+
+    kvVersion = parseInt(kvVersion);
+
     for (const secret of secrets) {
         const { secretPath, outputName, secretKey } = secret;
-        const result = await got(`${vaultUrl}/v1/secret/data/${secretPath}`, {
+        const requestOptions = {
             headers: {
                 'X-Vault-Token': vaultToken
-            }
-        });
+            },
+        };
 
-        const parsedResponse = JSON.parse(result.body);
-        const vaultKeyData = parsedResponse.data;
-        const versionData = vaultKeyData.data;
-        const value = versionData[secretKey];
+        if (vaultNamespace != null) {
+            requestOptions.headers["X-Vault-Namespace"] = vaultNamespace;
+        }
+
+        const requestPath = (kvVersion === 1)
+                            ? `${vaultUrl}/v1/${enginePath}/${secretPath}`
+                            : `${vaultUrl}/v1/${enginePath}/data/${secretPath}`;
+        const result = await got(requestPath, requestOptions);
+
+        const secretData = parseResponse(result.body, kvVersion);
+        const value = secretData[secretKey];
         command.issue('add-mask', value);
         core.exportVariable(outputName, `${value}`);
         core.debug(`✔ ${secretPath} => ${outputName}`);
@@ -29,7 +88,7 @@ async function exportSecrets() {
 
 /**
  * Parses a secrets input string into key paths and their resulting environment variable name.
- * @param {string} secretsInput 
+ * @param {string} secretsInput
  */
 function parseSecretsInput(secretsInput) {
     const secrets = secretsInput
@@ -80,7 +139,30 @@ function parseSecretsInput(secretsInput) {
 }
 
 /**
- * Replaces any forward-slash characters to 
+ * Parses a JSON response and returns the secret data
+ * @param {string} responseBody
+ * @param {number} kvVersion
+ */
+function parseResponse(responseBody, kvVersion) {
+    const parsedResponse = JSON.parse(responseBody);
+    let secretData;
+
+    switch(kvVersion) {
+        case 1: {
+            secretData = parsedResponse.data;
+        } break;
+
+        case 2: {
+            const vaultKeyData = parsedResponse.data;
+            secretData = vaultKeyData.data;
+        } break;
+    }
+
+    return secretData;
+}
+
+/**
+ * Replaces any forward-slash characters to
  * @param {string} dataKey
  */
 function normalizeOutputKey(dataKey) {
@@ -90,5 +172,6 @@ function normalizeOutputKey(dataKey) {
 module.exports = {
     exportSecrets,
     parseSecretsInput,
+    parseResponse,
     normalizeOutputKey
-};
+};

action.test.js

@@ -7,6 +7,7 @@ const got = require('got');
 const {
     exportSecrets,
     parseSecretsInput,
+    parseResponse
 } = require('./action');
 
 const { when } = require('jest-when');
@@ -82,6 +83,38 @@ describe('parseSecretsInput', () => {
     })
 });
 
+describe('parseResponse', () => {
+    // https://www.vaultproject.io/api/secret/kv/kv-v1.html#sample-response
+    it('parses K/V version 1 response', () => {
+        const response = JSON.stringify({
+            data: {
+                foo: 'bar'
+            }
+        })
+        const output = parseResponse(response, 1);
+
+        expect(output).toEqual({
+            foo: 'bar'
+        });
+    });
+
+    // https://www.vaultproject.io/api/secret/kv/kv-v2.html#read-secret-version
+    it('parses K/V version 2 response', () => {
+        const response = JSON.stringify({
+            data: {
+                data: {
+                    foo: 'bar'
+                }
+            }
+        })
+        const output = parseResponse(response, 2);
+
+        expect(output).toEqual({
+            foo: 'bar'
+        });
+    });
+});
+
 
 describe('exportSecrets', () => {
     beforeEach(() => {
@@ -89,27 +122,44 @@ describe('exportSecrets', () => {
 
         when(core.getInput)
             .calledWith('url')
-            .mockReturnValue('http://vault:8200');
+            .mockReturnValueOnce('http://vault:8200');
 
         when(core.getInput)
             .calledWith('token')
-            .mockReturnValue('EXAMPLE');
+            .mockReturnValueOnce('EXAMPLE');
     });
 
     function mockInput(key) {
         when(core.getInput)
             .calledWith('secrets')
-            .mockReturnValue(key);
+            .mockReturnValueOnce(key);
     }
 
-    function mockVaultData(data) {
-        got.mockResolvedValue({
-            body: JSON.stringify({
-                data: {
-                    data
-                }
-            })
-        });
+    function mockVersion(version) {
+        when(core.getInput)
+            .calledWith('kv-version')
+            .mockReturnValueOnce(version);
+    }
+
+    function mockVaultData(data, version='2') {
+        switch(version) {
+            case '1':
+                got.mockResolvedValue({
+                    body: JSON.stringify({
+                        data
+                    })
+                });
+            break;
+            case '2':
+                got.mockResolvedValue({
+                    body: JSON.stringify({
+                        data: {
+                            data
+                        }
+                    })
+                });
+            break;
+        }
     }
 
     it('simple secret retrieval', async () => {
@@ -133,4 +183,18 @@ describe('exportSecrets', () => {
 
         expect(core.exportVariable).toBeCalledWith('TEST_NAME', '1');
     });
-});
+
+    it('simple secret retrieval from K/V v1', async () => {
+        const version = '1';
+
+        mockInput('test key');
+        mockVersion(version);
+        mockVaultData({
+            key: 1
+        }, version);
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+    });
+});

action.yml

@@ -1,4 +1,4 @@
-name: 'Vault'
+name: 'Vault Secrets'
 description: 'A Github Action that allows you to consume the v2 K/V backend of HashiCorp Vault as secure environment variables'
 inputs:
   url:
@@ -10,6 +10,12 @@ inputs:
   secrets:
     description: 'A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details'
     required: true
+  namespace:
+    description: 'The Vault namespace from which to query secrets. Vault Enterprise only, unset by default'
+    required: false
 runs:
   using: 'node12'
-  main: 'index.js'
+  main: 'dist/index.js'
+branding:
+  icon: 'unlock'
+  color: 'gray-dark'

docker-compose.yml

@@ -0,0 +1,17 @@
+# Start vault server locally for the purposes of integration tests.
+version: "3.0"
+services:
+  vault:
+    image: vault:1.3.0
+    environment:
+      VAULT_DEV_ROOT_TOKEN_ID: testtoken
+    ports:
+      - 8200:8200
+    privileged: true
+  vault-enterprise:
+    image: hashicorp/vault-enterprise:1.3.0_ent
+    environment:
+      VAULT_DEV_ROOT_TOKEN_ID: testtoken
+    ports:
+      - 8201:8200
+    privileged: true

e2e/setup.js

@@ -1,41 +0,0 @@
-const got = require('got');
-
-(async () => {
-    try {
-        // Verify Connection
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/config`, {
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-        });
-
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/test`, {
-            method: 'POST',
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-            body: {
-                data: {
-                    secret: "SUPERSECRET",
-                },
-            },
-            json: true,
-        });
-
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/nested/test`, {
-            method: 'POST',
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-            body: {
-                data: {
-                    otherSecret: "OTHERSUPERSECRET",
-                },
-            },
-            json: true,
-        });
-    } catch (error) {
-        console.log(error);
-        process.exit(1);
-    }
-})();

integration/integration.test.js

@@ -1,103 +0,0 @@
-jest.mock('@actions/core');
-jest.mock('@actions/core/lib/command');
-const core = require('@actions/core');
-
-const got = require('got');
-const { when } = require('jest-when');
-
-const { exportSecrets } = require('../action');
-
-describe('integration', () => {
-
-    beforeAll(async () => {
-        // Verify Connection
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/config`, {
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-        });
-
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/test`, {
-            method: 'POST',
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-            body: {
-                data: {
-                    secret: "SUPERSECRET",
-                },
-            },
-            json: true,
-        });
-
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/nested/test`, {
-            method: 'POST',
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-            body: {
-                data: {
-                    otherSecret: "OTHERSUPERSECRET",
-                },
-            },
-            json: true,
-        });
-    })
-
-    beforeEach(() => {
-        jest.resetAllMocks();
-
-        when(core.getInput)
-            .calledWith('url')
-            .mockReturnValue(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`);
-
-        when(core.getInput)
-            .calledWith('token')
-            .mockReturnValue('testtoken');
-    });
-
-    function mockInput(secrets) {
-        when(core.getInput)
-            .calledWith('secrets')
-            .mockReturnValue(secrets);
-    }
-
-    it('get simple secret', async () => {
-        mockInput('test secret')
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
-    });
-
-    it('re-map secret', async () => {
-        mockInput('test secret | TEST_KEY')
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledWith('TEST_KEY', 'SUPERSECRET');
-    });
-
-    it('get nested secret', async () => {
-        mockInput('nested/test otherSecret')
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
-    });
-
-    it('get multiple secrets', async () => {
-        mockInput(`
-        test secret ;
-        test secret | NAMED_SECRET ;
-        nested/test otherSecret ;`);
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledTimes(3);
-
-        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
-        expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET');
-        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
-    });
-});

integrationTests/basic/integration.test.js

@@ -0,0 +1,174 @@
+jest.mock('@actions/core');
+jest.mock('@actions/core/lib/command');
+const core = require('@actions/core');
+
+const got = require('got');
+const { when } = require('jest-when');
+
+const { exportSecrets } = require('../../action');
+
+const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8200'}`;
+
+describe('integration', () => {
+    beforeAll(async () => {
+        // Verify Connection
+        await got(`${vaultUrl}/v1/secret/config`, {
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+        });
+
+        await got(`${vaultUrl}/v1/secret/data/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    secret: 'SUPERSECRET',
+                },
+            },
+        });
+
+        await got(`${vaultUrl}/v1/secret/data/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    otherSecret: 'OTHERSUPERSECRET',
+                },
+            }
+        });
+
+        // Enable custom secret engine
+        try {
+            await got(`${vaultUrl}/v1/sys/mounts/my-secret`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+                json: {
+                    type: 'kv'
+                }
+            });
+        } catch (error) {
+            const {response} = error;
+            if (response.statusCode === 400 && response.body.includes("path is already in use")) {
+                // Engine might already be enabled from previous test runs
+            } else {
+                throw error;
+            }
+        }
+
+        await got(`${vaultUrl}/v1/my-secret/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                secret: 'CUSTOMSECRET',
+            }
+        });
+
+        await got(`${vaultUrl}/v1/my-secret/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                otherSecret: 'OTHERCUSTOMSECRET',
+            },
+        });
+    });
+
+    beforeEach(() => {
+        jest.resetAllMocks();
+
+        when(core.getInput)
+            .calledWith('url')
+            .mockReturnValueOnce(`${vaultUrl}`);
+
+        when(core.getInput)
+            .calledWith('token')
+            .mockReturnValueOnce('testtoken');
+    });
+
+    function mockInput(secrets) {
+        when(core.getInput)
+            .calledWith('secrets')
+            .mockReturnValueOnce(secrets);
+    }
+
+    function mockEngineName(name) {
+        when(core.getInput)
+            .calledWith('path')
+            .mockReturnValueOnce(name);
+    }
+
+    function mockVersion(version) {
+        when(core.getInput)
+            .calledWith('kv-version')
+            .mockReturnValueOnce(version);
+    }
+
+    it('get simple secret', async () => {
+        mockInput('test secret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
+    });
+
+    it('re-map secret', async () => {
+        mockInput('test secret | TEST_KEY');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('TEST_KEY', 'SUPERSECRET');
+    });
+
+    it('get nested secret', async () => {
+        mockInput('nested/test otherSecret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
+    });
+
+    it('get multiple secrets', async () => {
+        mockInput(`
+        test secret ;
+        test secret | NAMED_SECRET ;
+        nested/test otherSecret ;`);
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledTimes(3);
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
+        expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET');
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
+    });
+
+    it('get secret from K/V v1', async () => {
+        mockInput('test secret');
+        mockEngineName('my-secret');
+        mockVersion('1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'CUSTOMSECRET');
+    });
+
+    it('get nested secret from K/V v1', async () => {
+        mockInput('nested/test otherSecret');
+        mockEngineName('my-secret');
+        mockVersion('1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERCUSTOMSECRET');
+    });
+});

integrationTests/e2e/README.md

@@ -0,0 +1,4 @@
+# e2e tests
+
+This test suite runs `vault-action` as a GitHub Action in the context of a live build, and then verifies that the appropriate environmental variables are set.
+These tests are intended to mostly be very simple smoke tests to verify that the action is being compiled and run correctly in context.

integrationTests/e2e/e2e.test.js

@@ -3,5 +3,8 @@ describe('e2e', () => {
         expect(process.env.SECRET).toBe("SUPERSECRET");
         expect(process.env.NAMED_SECRET).toBe("SUPERSECRET");
         expect(process.env.OTHERSECRET).toBe("OTHERSUPERSECRET");
+        expect(process.env.ALTSECRET).toBe("CUSTOMSECRET");
+        expect(process.env.NAMED_ALTSECRET).toBe("CUSTOMSECRET");
+        expect(process.env.OTHERALTSECRET).toBe("OTHERCUSTOMSECRET");
     });
-});
+});

integrationTests/e2e/setup.js

@@ -0,0 +1,71 @@
+const got = require('got');
+
+const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
+
+(async () => {
+    try {
+        // Verify Connection
+        await got(`http://${vaultUrl}/v1/secret/config`, {
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+        });
+
+        await got(`http://${vaultUrl}/v1/secret/data/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    secret: 'SUPERSECRET',
+                },
+            },
+        });
+
+        await got(`http://${vaultUrl}/v1/secret/data/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    otherSecret: 'OTHERSUPERSECRET',
+                },
+            }
+        });
+
+        await got(`http://${vaultUrl}/v1/sys/mounts/my-secret`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                type: 'kv'
+            }
+        });
+
+        await got(`http://${vaultUrl}/v1/my-secret/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                altSecret: 'CUSTOMSECRET',
+            }
+        });
+
+        await got(`http://${vaultUrl}/v1/my-secret/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                otherAltSecret: 'OTHERCUSTOMSECRET',
+            },
+        });
+    } catch (error) {
+        console.log(error);
+        process.exit(1);
+    }
+})();

integrationTests/enterprise/enterprise.test.js

@@ -0,0 +1,307 @@
+jest.mock('@actions/core');
+jest.mock('@actions/core/lib/command');
+const core = require('@actions/core');
+
+const got = require('got');
+const { when } = require('jest-when');
+
+const { exportSecrets } = require('../../action');
+
+const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8201'}`;
+
+describe('integration', () => {
+    beforeAll(async () => {
+        try {
+            // Verify Connection
+            await got(`${vaultUrl}/v1/secret/config`, {
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+            });
+
+            // Create namespace
+            await enableNamespace('ns1');
+
+            // Enable K/V v2 secret engine at 'secret/'
+            await enableEngine('secret', 'ns1', 2);
+
+            await writeSecret('secret', 'test', 'ns1', 2, {secret: 'SUPERSECRET_IN_NAMESPACE'})
+            await writeSecret('secret', 'nested/test', 'ns1', 2, {otherSecret: 'OTHERSUPERSECRET_IN_NAMESPACE'})
+
+            // Enable K/V v1 secret engine at 'my-secret/'
+            await enableEngine('my-secret', 'ns1', 1);
+
+            await writeSecret('my-secret', 'test', 'ns1', 1, {secret: 'CUSTOMSECRET_IN_NAMESPACE'})
+            await writeSecret('my-secret', 'nested/test', 'ns1', 1, {otherSecret: 'OTHERCUSTOMSECRET_IN_NAMESPACE'})
+        } catch (e) {
+            console.error('Failed to setup test', e);
+            throw e;
+        }
+    });
+
+    beforeEach(() => {
+        jest.resetAllMocks();
+
+        when(core.getInput)
+            .calledWith('url')
+            .mockReturnValueOnce(`${vaultUrl}`);
+
+        when(core.getInput)
+            .calledWith('token')
+            .mockReturnValueOnce('testtoken');
+
+        when(core.getInput)
+            .calledWith('namespace')
+            .mockReturnValueOnce('ns1');
+    });
+
+    it('get simple secret', async () => {
+        mockInput('test secret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET_IN_NAMESPACE');
+    });
+
+    it('re-map secret', async () => {
+        mockInput('test secret | TEST_KEY');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('TEST_KEY', 'SUPERSECRET_IN_NAMESPACE');
+    });
+
+    it('get nested secret', async () => {
+        mockInput('nested/test otherSecret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET_IN_NAMESPACE');
+    });
+
+    it('get multiple secrets', async () => {
+        mockInput(`
+        test secret ;
+        test secret | NAMED_SECRET ;
+        nested/test otherSecret ;`);
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledTimes(3);
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET_IN_NAMESPACE');
+        expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET_IN_NAMESPACE');
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET_IN_NAMESPACE');
+    });
+
+    it('get secret from K/V v1', async () => {
+        mockInput('test secret');
+        mockEngineName('my-secret');
+        mockVersion('1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'CUSTOMSECRET_IN_NAMESPACE');
+    });
+
+    it('get nested secret from K/V v1', async () => {
+        mockInput('nested/test otherSecret');
+        mockEngineName('my-secret');
+        mockVersion('1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERCUSTOMSECRET_IN_NAMESPACE');
+    });
+});
+
+describe('authenticate with approle', () => {
+    let roleId;
+    let secretId;
+    beforeAll(async () => {
+        try {
+            // Verify Connection
+            await got(`${vaultUrl}/v1/secret/config`, {
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+            });
+
+            // Create namespace
+            await enableNamespace("ns2");
+
+            // Enable K/V v2 secret engine at 'secret/'
+            await enableEngine("secret", "ns2", 2);
+
+            // Add secret
+            await writeSecret('secret', 'test', 'ns2', 2, {secret: 'SUPERSECRET_WITH_APPROLE'})
+
+            // Enable approle
+            try {
+                await got(`${vaultUrl}/v1/sys/auth/approle`, {
+                    method: 'POST',
+                    headers: {
+                        'X-Vault-Token': 'testtoken',
+                        'X-Vault-Namespace': 'ns2',
+                    },
+                    json: {
+                        type: 'approle'
+                    },
+                });
+            } catch (error) {
+                const {response} = error;
+                if (response.statusCode === 400 && response.body.includes("path is already in use")) {
+                    // Approle might already be enabled from previous test runs
+                } else {
+                    throw error;
+                }
+            }
+
+            // Create policies
+            await got(`${vaultUrl}/v1/sys/policies/acl/test`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                    'X-Vault-Namespace': 'ns2',
+                },
+                json: {
+                    "name":"test",
+                    "policy":"path \"auth/approle/*\" {\n    capabilities = [\"read\", \"list\"]\n}\npath \"auth/approle/role/my-role/role-id\"\n{\n    capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\n}\npath \"auth/approle/role/my-role/secret-id\"\n{\n    capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\n}\n\npath \"secret/data/*\" {\n    capabilities = [\"list\"]\n}\npath \"secret/metadata/*\" {\n    capabilities = [\"list\"]\n}\n\npath \"secret/data/test\" {\n    capabilities = [\"read\", \"list\"]\n}\npath \"secret/metadata/test\" {\n    capabilities = [\"read\", \"list\"]\n}\npath \"secret/data/test/*\" {\n    capabilities = [\"read\", \"list\"]\n}\npath \"secret/metadata/test/*\" {\n    capabilities = [\"read\", \"list\"]\n}\n"
+                },
+            });
+
+            // Create approle
+            await got(`${vaultUrl}/v1/auth/approle/role/my-role`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                    'X-Vault-Namespace': 'ns2',
+                },
+                json: {
+                    policies: 'test'
+                },
+            });
+
+            // Get role-id
+            const roldIdResponse = await got(`${vaultUrl}/v1/auth/approle/role/my-role/role-id`, {
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                    'X-Vault-Namespace': 'ns2',
+                },
+                responseType: 'json',
+            });
+            roleId = roldIdResponse.body.data.role_id;
+
+            // Get secret-id
+            const secretIdResponse = await got(`${vaultUrl}/v1/auth/approle/role/my-role/secret-id`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                    'X-Vault-Namespace': 'ns2',
+                },
+                responseType: 'json',
+            });
+            secretId = secretIdResponse.body.data.secret_id;
+        } catch(err) {
+            console.warn('Create approle', err.response.body);
+            throw err;
+        }
+    });
+
+    beforeEach(() => {
+        jest.resetAllMocks();
+
+        when(core.getInput)
+            .calledWith('method')
+            .mockReturnValueOnce('approle');
+        when(core.getInput)
+            .calledWith('roleId')
+            .mockReturnValueOnce(roleId);
+        when(core.getInput)
+            .calledWith('secretId')
+            .mockReturnValueOnce(secretId);
+        when(core.getInput)
+            .calledWith('url')
+            .mockReturnValueOnce(`${vaultUrl}`);
+        when(core.getInput)
+            .calledWith('namespace')
+            .mockReturnValueOnce('ns2');
+    });
+
+    it('authenticate with approle', async()=> {
+        mockInput('test secret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET_WITH_APPROLE');
+    })
+});
+
+async function enableNamespace(name) {
+    try {
+        await got(`${vaultUrl}/v1/sys/namespaces/${name}`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            }
+        });
+    } catch (error) {
+        const {response} = error;
+        if (response.statusCode === 400 && response.body.includes("already exists")) {
+            // Namespace might already be enabled from previous test runs
+        } else {
+            throw error;
+        }
+    }
+}
+
+async function enableEngine(path, namespace, version) {
+    try {
+        await got(`${vaultUrl}/v1/sys/mounts/${path}`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+                'X-Vault-Namespace': namespace,
+            },
+            json: { type: 'kv', config: {}, options: { version }, generate_signing_key: true },
+        });
+    } catch (error) {
+        const {response} = error;
+        if (response.statusCode === 400 && response.body.includes("path is already in use")) {
+            // Engine might already be enabled from previous test runs
+        } else {
+            throw error;
+        }
+    }
+}
+
+async function writeSecret(engine, path, namespace, version, data) {
+    const secretPath = (version == 1) ? (`${engine}/${path}`) : (`${engine}/data/${path}`);
+    const secretPayload = (version == 1) ? (data) : ({data});
+    await got(`${vaultUrl}/v1/${secretPath}`, {
+        method: 'POST',
+        headers: {
+            'X-Vault-Token': 'testtoken',
+            'X-Vault-Namespace': namespace,
+        },
+        json: secretPayload
+    });
+}
+
+function mockInput(secrets) {
+    when(core.getInput)
+        .calledWith('secrets')
+        .mockReturnValueOnce(secrets);
+}
+
+function mockEngineName(name) {
+    when(core.getInput)
+        .calledWith('path')
+        .mockReturnValueOnce(name);
+}
+
+function mockVersion(version) {
+    when(core.getInput)
+        .calledWith('kv-version')
+        .mockReturnValueOnce(version);
+}

integrationTests/enterprise/jest.config.js

@@ -0,0 +1,3 @@
+module.exports = {
+    verbose: true
+};

jest.config.js

@@ -1,3 +1,3 @@
 module.exports = {
-    testPathIgnorePatterns: ['/node_modules/', '<rootDir>/integration/', '<rootDir>/e2e/'],
+    testPathIgnorePatterns: ['/node_modules/', '<rootDir>/integrationTests/'],
 };

package.json

@@ -1,38 +1,51 @@
 {
-  "name": "vault-action",
-  "version": "0.1.0",
-  "description": "A Github Action that allows you to consume vault secrets as secure environment variables.",
-  "main": "index.js",
-  "scripts": {
-    "test": "jest",
-    "test:integration": "jest -c integration/jest.config.js",
-    "test:e2e": "jest -c e2e/jest.config.js"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/RichiCoder1/vault-action.git"
-  },
-  "keywords": [
-    "hashicorp",
-    "vault",
-    "github",
-    "actions",
-    "github-actions",
-    "javascript"
-  ],
-  "author": "Richard Simpson <richardsimpson@outlook.com>",
-  "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/RichiCoder1/vault-action/issues"
-  },
-  "homepage": "https://github.com/RichiCoder1/vault-action#readme",
-  "dependencies": {
-    "@actions/core": "^1.1.1",
-    "got": "^9.6.0"
-  },
-  "devDependencies": {
-    "@types/jest": "^24.0.18",
-    "jest": "^24.9.0",
-    "jest-when": "^2.7.0"
-  }
+    "name": "vault-action",
+    "version": "0.1.0",
+    "description": "A Github Action that allows you to consume vault secrets as secure environment variables.",
+    "main": "dist/index.js",
+    "scripts": {
+        "build": "ncc build index.js -o dist",
+        "test": "jest",
+        "test:integration:basic": "jest -c integrationTests/basic/jest.config.js",
+        "test:integration:enterprise": "jest -c integrationTests/enterprise/jest.config.js",
+        "test:e2e": "jest -c integrationTests/e2e/jest.config.js"
+    },
+    "release": {
+        "branch": "master",
+        "plugins": [
+            "@semantic-release/commit-analyzer",
+            "@semantic-release/release-notes-generator",
+            "@semantic-release/github"
+        ],
+        "ci": false
+    },
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/RichiCoder1/vault-action.git"
+    },
+    "keywords": [
+        "hashicorp",
+        "vault",
+        "github",
+        "actions",
+        "github-actions",
+        "javascript"
+    ],
+    "author": "Richard Simpson <richardsimpson@outlook.com>",
+    "license": "MIT",
+    "bugs": {
+        "url": "https://github.com/RichiCoder1/vault-action/issues"
+    },
+    "homepage": "https://github.com/RichiCoder1/vault-action#readme",
+    "dependencies": {
+        "@actions/core": "^1.1.1",
+        "got": "^10.2.2"
+    },
+    "devDependencies": {
+        "@types/jest": "^24.0.18",
+        "@zeit/ncc": "^0.20.5",
+        "jest": "^24.9.0",
+        "jest-when": "^2.7.0",
+        "semantic-release": "^15.13.24"
+    }
 }