Update action.yml

* Simplify secret UX

* Update doc

* Fix tests

.github/FUNDING.yml

@@ -1 +0,0 @@
-ko_fi: richicoder

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,23 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: "[BUG] "
+labels: bug
+assignees: RichiCoder1
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+The yaml of the `vault-action` step, with any sensitive information masked or removed.
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Log Output**
+For the most verbose logs, [add a secret called `ACTIONS_STEP_DEBUG` with the value `true`](https://github.com/actions/toolkit/blob/master/docs/action-debugging.md). Then, re-run the workflow if possible and post the *raw logs* for the step here with any sensitive information masked or removed.
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: "[FEAT] "
+labels: enhancement
+assignees: RichiCoder1
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/workflows/build.yml

@@ -3,169 +3,286 @@ on:
     branches:
       - master
   pull_request:
+    branches:
+      - master
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v1
-    - name: Use Node.js 10.x
+
-      uses: actions/setup-node@v1
+    - uses: actions/setup-node@v1
       with:
-        node-version: 10.x
+        node-version: ''
-    - name: setup npm cache
+
+    - name: Setup NPM Cache
       uses: actions/cache@v1
       with:
         path: ~/.npm
         key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
         restore-keys: |
           ${{ runner.os }}-node-
-    - name: npm install
+
+    - name: NPM Install
       run: npm ci
-    - name: npm build
+
+    - name: NPM Build
       run: npm run build
-    - name: npm run test
+
+    - name: NPM Run Test
       run: npm run test
 
-  integration:
+  integrationOSS:
     runs-on: ubuntu-latest
 
-    services:
+    steps:
-      vaultBasic:
+    - uses: actions/checkout@v1
-        image: vault:1.2.3
+
-        ports:
+    - name: Run docker-compose
-          - 8200/tcp
+      run: docker-compose up -d vault
-        env:
+
-          VAULT_DEV_ROOT_TOKEN_ID: testtoken
+    - uses: actions/setup-node@v1
-        options: --cap-add=IPC_LOCK
+      with:
-      vaultEnterprise:
+        node-version: ''
-        image: hashicorp/vault-enterprise:1.3.0_ent
+
-        ports:
+    - name: Setup NPM Cache
-          - 8200/tcp
+      uses: actions/cache@v1
-        env:
+      with:
-          VAULT_DEV_ROOT_TOKEN_ID: testtoken
+        path: ~/.npm
-        options: --cap-add=IPC_LOCK
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+
+    - name: NPM Install
+      run: npm ci
+
+    - name: NPM Build
+      run: npm run build
+
+    - name: NPM Run test;integration:basic
+      run: npm run test:integration:basic
+      env:
+        VAULT_HOST: localhost
+        VAULT_PORT: 8200
+        CI: true
+
+  integrationEnterprise:
+    runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v1
+    - uses: actions/checkout@v1
-      - name: Use Node.js 10.x
+
-        uses: actions/setup-node@v1
+    - name: Run docker-compose
-        with:
+      run: docker-compose up -d vault-enterprise
-          node-version: 10.x
+
-      - name: setup npm cache
+    - uses: actions/setup-node@v1
-        uses: actions/cache@v1
+      with:
-        with:
+        node-version: ''
-          path: ~/.npm
+
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+    - name: Setup NPM Cache
-          restore-keys: |
+      uses: actions/cache@v1
-            ${{ runner.os }}-node-
+      with:
-      - name: npm install
+        path: ~/.npm
-        run: npm ci
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-      - name: npm build
+        restore-keys: |
-        run: npm run build
+          ${{ runner.os }}-node-
-      - name: npm run test:integration:basic
+
-        run: npm run test:integration:basic
+    - name: NPM Install
-        env:
+      run: npm ci
-          VAULT_HOST: localhost
+
-          VAULT_PORT: ${{ job.services.vaultBasic.ports[8200] }}
+    - name: NPM Build
-          CI: true
+      run: npm run build
-      - name: npm run test:integration:enterprise
+
-        run: npm run test:integration:enterprise
+    - name: NPM Run test:intergration:enterprise
-        env:
+      run: npm run test:integration:enterprise
-          VAULT_HOST: localhost
+      env:
-          VAULT_PORT: ${{ job.services.vaultEnterprise.ports[8200] }}
+        VAULT_HOST: localhost
-          CI: true
+        VAULT_PORT: 8200
+        CI: true
 
   e2e:
     runs-on: ubuntu-latest
 
-    services:
-      vault:
-        image: vault:1.3.0
-        ports:
-          - 8200/tcp
-        env:
-          VAULT_DEV_ROOT_TOKEN_ID: testtoken
-        options: --cap-add=IPC_LOCK
-
     steps:
     - uses: actions/checkout@v1
-    - name: Use Node.js 10.x
+
-      uses: actions/setup-node@v1
+    - name: Run docker-compose
+      run: docker-compose up -d vault
+
+    - uses: actions/setup-node@v1
       with:
-        node-version: 10.x
+        node-version: ''
-    - name: setup npm cache
+
+    - name: Setup NPM Cache
       uses: actions/cache@v1
       with:
         path: ~/.npm
         key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
         restore-keys: |
           ${{ runner.os }}-node-
-    - name: npm install
+
+    - name: NPM Install
       run: npm ci
-    - name: npm build
+
+    - name: NPM Build
       run: npm run build
-    - name: setup vault
+
+    - name: Setup Vault
       run: node ./integrationTests/e2e/setup.js
       env:
         VAULT_HOST: localhost
-        VAULT_PORT: ${{ job.services.vault.ports[8200] }}
+        VAULT_PORT: 8200
-    - name: use vault action (default K/V version 2)
+
+    - name: Test Vault Action (default KV V2)
       uses: ./
       id: kv-secrets
       with:
-        url: http://localhost:${{ job.services.vault.ports[8200] }}
+        url: http://localhost:8200
         token: testtoken
         secrets: |
-          test secret ;
+          secret/data/test secret ;
-          test secret | NAMED_SECRET ;
+          secret/data/test secret | NAMED_SECRET ;
-          nested/test otherSecret ;
+          secret/data/nested/test otherSecret ;
-    - name: use vault action (custom K/V version 1)
+
+    - name: Test Vault Action (default KV V1)
       uses: ./
       with:
-        url: http://localhost:${{ job.services.vault.ports[8200] }}
+        url: http://localhost:8200
         token: testtoken
-        path: my-secret
-        kv-version: 1
         secrets: |
-          test altSecret ;
+          my-secret/test altSecret ;
-          test altSecret | NAMED_ALTSECRET ;
+          my-secret/test altSecret | NAMED_ALTSECRET ;
-          nested/test otherAltSecret ;
+          my-secret/nested/test otherAltSecret ;
-    - name: use vault action (using cubbyhole engine)
+
+    - name: Test Vault Action (cubbyhole)
       uses: ./
       with:
-        url: http://localhost:${{ job.services.vault.ports[8200] }}
+        url: http://localhost:8200
         token: testtoken
         secrets: |
           /cubbyhole/test foo ;
           /cubbyhole/test zip | NAMED_CUBBYSECRET ;
-    - name: verify
+
+    - name: Verify Vault Action Outputs
       run: npm run test:e2e
       env:
         OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
 
-  publish:
+  e2e-tls:
-    if: github.event_name	== 'push' && contains(github.ref, 'master')
     runs-on: ubuntu-latest
-    needs: [build, integration, e2e]
+
     steps:
     - uses: actions/checkout@v1
-    - name: Use Node.js 10.x
+
-      uses: actions/setup-node@v1
+    - name: Run docker-compose
+      run: docker-compose up -d vault-tls
+
+    - uses: actions/setup-node@v1
       with:
-        node-version: 10.x
+        node-version: ''
-    - name: setup npm cache
+
+    - name: Setup NPM Cache
       uses: actions/cache@v1
       with:
         path: ~/.npm
         key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
         restore-keys: |
           ${{ runner.os }}-node-
-    - name: npm install
+
-      run: npm ci
+    - name: NPM Install
-    - name: release
+      run: npm ci
-      if: success() && endsWith(github.ref, 'master')
+
-      run: npx semantic-release
+    - name: NPM Build
-      env:
+      run: npm run build
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Setup Vault
+      run: node ./integrationTests/e2e-tls/setup.js
+      env:
+        VAULT_HOST: localhost
+        VAULT_PORT: 8200
+        VAULTCA: ${{ secrets.VAULTCA }}
+        VAULT_CLIENT_CERT: ${{ secrets.VAULT_CLIENT_CERT }}
+        VAULT_CLIENT_KEY: ${{ secrets.VAULT_CLIENT_KEY }}
+
+    - name: Test Vault Action (default KV V2)
+      uses: ./
+      id: kv-secrets
+      with:
+        url: https://localhost:8200
+        token: ${{ env.VAULT_TOKEN }}
+        caCertificate: ${{ secrets.VAULTCA }}
+        clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
+        clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
+        secrets: |
+          secret/data/test secret ;
+          secret/data/test secret | NAMED_SECRET ;
+          secret/data/nested/test otherSecret ;
+
+    - name: Test Vault Action (tlsSkipVerify)
+      uses: ./
+      with:
+        url: https://localhost:8200
+        token: ${{ env.VAULT_TOKEN }}
+        tlsSkipVerify: true
+        clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
+        clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
+        secrets: |
+          secret/data/tlsSkipVerify skip ;
+
+    - name: Test Vault Action (default KV V1)
+      uses: ./
+      with:
+        url: https://localhost:8200
+        token: ${{ env.VAULT_TOKEN }}
+        caCertificate: ${{ secrets.VAULTCA }}
+        clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
+        clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
+        secrets: |
+          my-secret/test altSecret ;
+          my-secret/test altSecret | NAMED_ALTSECRET ;
+          my-secret/nested/test otherAltSecret ;
+
+    - name: Test Vault Action (cubbyhole)
+      uses: ./
+      with:
+        url: https://localhost:8200
+        token: ${{ env.VAULT_TOKEN }}
+        secrets: |
+          /cubbyhole/test foo ;
+          /cubbyhole/test zip | NAMED_CUBBYSECRET ;
+        caCertificate: ${{ secrets.VAULTCA }}
+        clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
+        clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
+
+    - name: Verify Vault Action Outputs
+      run: npm run test:e2e-tls
+      env:
+        OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
+
+# Removing publish step for now.
+#  publish:
+#    if: github.event_name	== 'push' && contains(github.ref, 'master')
+#    runs-on: ubuntu-latest
+#    needs: [build, integration, e2e]
+#    steps:
+#    - uses: actions/checkout@v1
+#    - uses: actions/setup-node@v1
+#      with:
+#        node-version: ''
+#    - name: setup npm cache
+#      uses: actions/cache@v1
+#      with:
+#        path: ~/.npm
+#        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+#        restore-keys: |
+#          ${{ runner.os }}-node-
+#    - name: npm install
+#      run: npm ci
+#    - name: release
+#      if: success() && endsWith(github.ref, 'master')
+#      run: npx semantic-release
+#      env:
+#        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+#        NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 

.vscode/launch.json

@@ -0,0 +1,35 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "type": "node",
+            "name": "vscode-jest-tests",
+            "request": "launch",
+            "args": [
+                "--runInBand"
+            ],
+            "cwd": "${workspaceFolder}",
+            "console": "integratedTerminal",
+            "internalConsoleOptions": "neverOpen",
+            "disableOptimisticBPs": true,
+            "program": "${workspaceFolder}/node_modules/jest/bin/jest"
+        },        
+        {
+            "type": "node",
+            "name": "vscode-integration-tests",
+            "request": "launch",
+            "args": [
+                "--runInBand",
+                "--config=${workspaceFolder}/integrationTests/basic/jest.config.js"
+            ],
+            "cwd": "${workspaceFolder}",
+            "console": "integratedTerminal",
+            "internalConsoleOptions": "neverOpen",
+            "disableOptimisticBPs": true,
+            "program": "${workspaceFolder}/node_modules/jest/bin/jest"
+        }
+    ]
+}

CHANGELOG.md

@@ -0,0 +1,13 @@
+## Unreleased
+
+## 2.0.0 (August 24th, 2020)
+
+Features:
+
+* Added TLS and mTLS support [GH-97](https://github.com/hashicorp/vault-action/pull/97)
+
+Improvements:
+
+* Breaking change: removed KV specific parameters and generalized secret UX [GH-102](https://github.com/hashicorp/vault-action/pull/102)
+
+Bugs:

README.md

@@ -1,9 +1,13 @@
-# vault-action
+# Vault GitHub Action
+
+---
+
+**Please note**: We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault or this Vault Action, _please responsibly disclose_ by contacting us at [security@hashicorp.com](mailto:security@hashicorp.com).
+
+---
 
 A helper action for easily pulling secrets from HashiCorp Vault™.
 
-By default, this action pulls from  [Version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2/) of the K/V Engine. See examples below for how to [use v1](#using-kv-version-1) as well as [other non-K/V engines](#other-secret-engines).
-
 <!-- TOC -->
 
 - [Example Usage](#example-usage)
@@ -12,14 +16,14 @@ By default, this action pulls from  [Version 2](https://www.vaultproject.io/docs
     - [Simple Key](#simple-key)
     - [Set Output Variable Name](#set-output-variable-name)
     - [Multiple Secrets](#multiple-secrets)
-    - [Using K/V version 1](#using-kv-version-1)
+    - [Nested Secrets](#nested-secrets)
-- [Custom K/V Engine Path](#custom-kv-engine-path)
 - [Other Secret Engines](#other-secret-engines)
 - [Adding Extra Headers](#adding-extra-headers)
 - [Vault Enterprise Features](#vault-enterprise-features)
     - [Namespace](#namespace)
 - [Reference](#reference)
 - [Masking - Hiding Secrets from Logs](#masking---hiding-secrets-from-logs)
+- [Normalization](#normalization)
 
 <!-- /TOC -->
 
@@ -32,14 +36,15 @@ jobs:
         steps:
             # ...
             - name: Import Secrets
-              uses: RichiCoder1/vault-action
+              uses: hashicorp/vault-action
               with:
                 url: https://vault.mycompany.com:8200
                 token: ${{ secrets.VaultToken }}
+                caCertificate: ${{ secrets.VAULTCA }}
                 secrets: |
-                    ci/aws accessKey | AWS_ACCESS_KEY_ID ;
+                    secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
-                    ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
+                    secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
-                    ci npm_token
+                    secret/data/ci npm_token
             # ...
 ```
 
@@ -53,6 +58,7 @@ While most workflows will likely use a vault token, you can also use an `approle
 with:
   url: https://vault.mycompany.com:8200
   token: ${{ secrets.VaultToken }}
+  caCertificate: ${{ secrets.VAULTCA }}
 ```
 - **approle**: you must provide a `roleId` & `secretId` parameter
 ```yaml
@@ -62,6 +68,7 @@ with:
   method: approle
   roleId: ${{ secrets.roleId }}
   secretId: ${{ secrets.secretId }}
+  caCertificate: ${{ secrets.VAULTCA }}
 ```
 - **github**: you must provide the github token as `githubToken`
 ```yaml
@@ -70,6 +77,7 @@ with:
   url: https://vault.mycompany.com:8200
   method: github
   githubToken: ${{ secrets.GITHUB_TOKEN }}
+  caCertificate: ${{ secrets.VAULTCA }}
 ```
 
 If any other method is specified and you provide an `authPayload`, the action will attempt to `POST` to `auth/${method}/login` with the provided payload and parse out the client token.
@@ -78,19 +86,19 @@ If any other method is specified and you provide an `authPayload`, the action wi
 
 The `secrets` parameter is a set of multiple secret requests separated by the `;` character.
 
-Each secret request is comprised of the `path` and the `key` of the desired secret, and optionally the desired Env Var output name.
+Each secret request consists of the `path` and the `key` of the desired secret, and optionally the desired Env Var output name.
 
 ```raw
-{{ Secret Path }} {{ Secret Key }} | {{ Output Variable Name }}
+{{ Secret Path }} {{ Secret Key or Selector }} | {{ Env/Output Variable Name }}
 ```
 
 ### Simple Key
 
-To retrieve a key `npmToken` from path `ci` that has value `somelongtoken` from vault you could do:
+To retrieve a key `npmToken` from path `secret/data/ci` that has value `somelongtoken` from vault you could do:
 
 ```yaml
 with:
-    secrets: ci npmToken
+    secrets: secret/data/ci npmToken
 ```
 
 `vault-action` will automatically normalize the given secret selector key, and set the follow as environment variables for the following steps in the current job:
@@ -120,7 +128,7 @@ However, if you want to set it to a specific name, say `NPM_TOKEN`, you could do
 
 ```yaml
 with:
-    secrets: ci npmToken | NPM_TOKEN
+    secrets: secret/data/ci npmToken | NPM_TOKEN
 ```
 
 With that, `vault-action` will now use your requested name and output:
@@ -147,50 +155,18 @@ This action can take multi-line input, so say you had your AWS keys stored in a
 ```yaml
 with:
     secrets: |
-        ci/aws accessKey | AWS_ACCESS_KEY_ID ;
+        secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
-        ci/aws secretKey | AWS_SECRET_ACCESS_KEY
+        secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY
 ```
 
-### Using K/V version 1
-
-By default, `vault-action` expects a K/V engine using [version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2.html).
-
-In order to work with a [v1 engine](https://www.vaultproject.io/docs/secrets/kv/kv-v1/), the `kv-version` parameter may be passed:
-
-```yaml
-with:
-    kv-version: 1
-```
-
-## Custom K/V Engine Path
-
-When you enable the K/V Engine, by default it's placed at the path `secret`, so a secret named `ci` will be accessed from `secret/ci`. However, [if you enabled the secrets engine using a custom `path`](https://www.vaultproject.io/docs/commands/secrets/enable/#inlinecode--path-4), you
-can pass it as follows:
-
-```yaml
-with:
-    path: my-secrets
-    secrets: ci npmToken
-```
-
-This way, the `ci` secret in the example above will be retrieved from `my-secrets/ci`.
-
 ## Other Secret Engines
 
-While this action primarily supports the K/V engine, it is possible to request secrets from other engines in Vault.
+Vault Action currently supports retrieving secrets from any engine where secrets 
+are retrieved via `GET` requests.  This means secret engines such as PKI are currently 
+not supported due to their requirement of sending parameters along with the request 
+(such as `common_name`).
 
-To do so when specifying the `Secret Path`, just append a leading formard slash (`/`) and specify the path as described in the Vault API documentation.
+For example, to request a secret from the `cubbyhole` secret engine:
-
-For example, to retrieve a stored secret from the [`cubbyhole` engine](https://www.vaultproject.io/api-docs/secret/cubbyhole/), assuming you have a stored secret at the path `foo` with the contents:
-
-```json
-{
-  "foo": "bar",
-  "zip": "zap"
-}
-```
-
-You could request the contents like so:
 
 ```yaml
 with:
@@ -218,21 +194,6 @@ steps:
     run: "my-cli --token '${{ steps.secrets.outputs.MY_KEY }}'"
 ```
 
-Secrets pulled from the same `Secret Path` are cached by default. So if you, for example, are using the `aws` engine and retrieve a key, only a single key for a given path is returned.
-
-e.g.:
-
-```yaml
-with:
-    secrets: |
-        /aws/creds/ci access_key | AWS_ACCESS_KEY_ID ;
-        /aws/creds/ci secret_key | AWS_SECRET_ACCESS_KEY
-```
-
-would work fine.
-
-NOTE: The `Secret Key` is pulled from the `data` property of the response.
-
 ## Adding Extra Headers
 
 If you ever need to add extra headers to the vault request, say if you need to authenticate with a firewall, all you need to do is set `extraHeaders`:
@@ -240,58 +201,65 @@ If you ever need to add extra headers to the vault request, say if you need to a
 ```yaml
 with:
     secrets: |
-        ci/aws accessKey | AWS_ACCESS_KEY_ID ;
+        secret/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
-        ci/aws secretKey | AWS_SECRET_ACCESS_KEY
+        secret/ci/aws secretKey | AWS_SECRET_ACCESS_KEY
     extraHeaders: |
       X-Secure-Id: ${{ secrets.SECURE_ID }}
       X-Secure-Secret: ${{ secrets.SECURE_SECRET }}
 ```
 
-This will automatically add the `x-secure-id` and `x-secure-secret` headers to every request to vault.
+This will automatically add the `x-secure-id` and `x-secure-secret` headers to every request to Vault.
 
 ## Vault Enterprise Features
 
 ### Namespace
 
-If you need to retrieve secrets from a specific vault namespace, all that's required is an additional parameter specifying the namespace.
+If you need to retrieve secrets from a specific Vault namespace, all that's required is an additional parameter specifying the namespace.
 
 ```yaml
 steps:
     # ...
     - name: Import Secrets
-      uses: RichiCoder1/vault-action
+      uses: hashicorp/vault-action
       with:
         url: https://vault-enterprise.mycompany.com:8200
         method: token
+        caCertificate: ${{ secrets.VAULTCA }}
         token: ${{ secrets.VaultToken }}
         namespace: ns1
         secrets: |
-            ci/aws accessKey | AWS_ACCESS_KEY_ID ;
+            secret/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
-            ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
+            secret/ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
-            ci npm_token
+            secret/ci npm_token
 ```
 
 ## Reference
 
-Here is all the inputs available through `with`:
+Here are all the inputs available through `with`:
 
-| Input          | Description                                                                                                                                          | Default | Required |
+| Input               | Description                                                                                                                                          | Default | Required |
-| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | -------- |
+| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | -------- |
-| `url`          | The URL for the vault endpoint                                                                                                                       |         | ✔        |
+| `url`               | The URL for the vault endpoint                                                                                                                       |         | ✔        |
-| `secrets`      | A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details |         | ✔        |
+| `secrets`           | A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details |         | ✔        |
-| `namespace`    | The Vault namespace from which to query secrets. Vault Enterprise only, unset by default                                                             |         |          |
+| `namespace`         | The Vault namespace from which to query secrets. Vault Enterprise only, unset by default                                                             |         |          |
-| `path`         | The path of a non-default K/V engine                                                                                                                 |         |          |
+| `method`            | The method to use to authenticate with Vault.                                                                                                        | `token` |          |
-| `kv-version`   | The version of the K/V engine to use.                                                                                                                | `2`     |          |
+| `token`             | The Vault Token to be used to authenticate with Vault                                                                                                |         |          |
-| `method`       | The method to use to authenticate with Vault.                                                                                                        | `token` |          |
+| `roleId`            | The Role Id for App Role authentication                                                                                                              |         |          |
-| `token`        | The Vault Token to be used to authenticate with Vault                                                                                                |         |          |
+| `secretId`          | The Secret Id for App Role authentication                                                                                                            |         |          |
-| `roleId`       | The Role Id for App Role authentication                                                                                                              |         |          |
+| `githubToken`       | The Github Token to be used to authenticate with Vault                                                                                               |         |          |
-| `secretId`     | The Secret Id for App Role authentication                                                                                                            |         |          |
+| `authPayload`       | The JSON payload to be sent to Vault when using a custom authentication method.                                                                      |         |          |
-| `githubToken`  | The Github Token to be used to authenticate with Vault                                                                                               |         |          |
+| `extraHeaders`      | A string of newline separated extra headers to include on every request.                                                                             |         |          |
-| `authPayload`  | The JSON payload to be sent to Vault when using a custom authentication method.                                                                      |         |          |
+| `exportEnv`         | Whether or not export secrets as environment variables.                                                                                              | `true`  |          |
-| `extraHeaders` | A string of newline separated extra headers to include on every request.                                                                             |         |          |
+| `caCertificate`     | Base64 encoded CA certificate the server certificate was signed with.                                                                                |         |          |
-| `exportEnv`    | Whether or not export secrets as environment variables.                                                                                              | `true`  |          |
+| `clientCertificate` | Base64 encoded client certificate the action uses to authenticate with Vault when mTLS is enabled.                                                   |         |          |
+| `clientKey`         | Base64 encoded client key the action uses to authenticate with Vault when mTLS is enabled.                                                           |         |          |
+| `tlsSkipVerify`     | When set to true, disables verification of server certificates when testing the action.                                                              | `false` |          | 
 
 ## Masking - Hiding Secrets from Logs
 
 This action uses GitHub Action's built-in masking, so all variables will automatically be masked (aka hidden) if printed to the console or to logs.
 **This only obscures secrets from output logs.** If someone has the ability to edit your workflows, then they are able to read and therefore write secrets to somewhere else just like normal GitHub Secrets.
+
+## Normalization
+
+To make it simpler to consume certain secrets as env vars, if no Env/Output Var Name is specified `vault-action` will replace and `.` chars with `__`, remove any other non-letter or number characters. If you're concerned about the result, it's recommended to provide an explicit Output Var Key.

action.yml

@@ -1,5 +1,5 @@
 name: 'Vault Secrets'
-description: 'A Github Action that allows you to consume the v2 K/V backend of HashiCorp Vault™ as secure environment variables'
+description: 'A Github Action that allows you to consume HashiCorp Vault™ secrets as secure environment variables'
 inputs:
   url:
     description: 'The URL for the vault endpoint'
@@ -10,13 +10,6 @@ inputs:
   namespace:
     description: 'The Vault namespace from which to query secrets. Vault Enterprise only, unset by default'
     required: false
-  path:
-    description: 'The path of a non-default K/V engine'
-    required: false
-  kv-version:
-    description: 'The version of the K/V engine to use.'
-    default: '2'
-    required: false
   method:
     description: 'The method to use to authenticate with Vault.'
     default: 'token'
@@ -43,6 +36,19 @@ inputs:
     description: 'Whether or not export secrets as environment variables.'
     default: 'true'
     required: false
+  caCertificate:
+    description: 'Base64 encoded CA certificate to verify the Vault server certificate.'
+    required: false
+  clientCertificate:
+    description: 'Base64 encoded client certificate for mTLS communication with the Vault server.'
+    required: false
+  clientKey:
+    description: 'Base64 encoded client key for mTLS communication with the Vault server.'
+    required: false
+  tlsSkipVerify:
+    description: 'When set to true, disables verification of the Vault server certificate.  Setting this to true in production is not recommended.'
+    required: false
+    default: "false"
 runs:
   using: 'node12'
   main: 'dist/index.js'

docker-compose.yml

@@ -2,16 +2,31 @@
 version: "3.0"
 services:
   vault:
-    image: vault:1.3.0
+    image: vault:latest
     environment:
       VAULT_DEV_ROOT_TOKEN_ID: testtoken
     ports:
       - 8200:8200
     privileged: true
   vault-enterprise:
-    image: hashicorp/vault-enterprise:1.3.0_ent
+    image: hashicorp/vault-enterprise:latest
     environment:
       VAULT_DEV_ROOT_TOKEN_ID: testtoken
     ports:
-      - 8201:8200
+      - 8200:8200
-    privileged: true
+    privileged: true
+  vault-tls:
+    image: vault:latest
+    hostname: vault-tls
+    environment:
+      VAULT_CAPATH: /etc/vault/ca.crt
+    ports:
+    - 8200:8200
+    privileged: true
+    volumes:
+    - ${PWD}/integrationTests/e2e-tls/configs:/etc/vault
+    - vault-data:/var/lib/vault:rw
+    entrypoint: vault server -config=/etc/vault/config.hcl
+
+volumes:
+  vault-data:

integrationTests/basic/integration.test.js

@@ -42,9 +42,21 @@ describe('integration', () => {
             }
         });
 
+        await got(`${vaultUrl}/v1/secret/data/foobar`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    fookv2: 'bar',
+                },
+            }
+        });
+
         // Enable custom secret engine
         try {
-            await got(`${vaultUrl}/v1/sys/mounts/my-secret`, {
+            await got(`${vaultUrl}/v1/sys/mounts/secret-kv1`, {
                 method: 'POST',
                 headers: {
                     'X-Vault-Token': 'testtoken',
@@ -62,7 +74,7 @@ describe('integration', () => {
             }
         }
 
-        await got(`${vaultUrl}/v1/my-secret/test`, {
+        await got(`${vaultUrl}/v1/secret-kv1/test`, {
             method: 'POST',
             headers: {
                 'X-Vault-Token': 'testtoken',
@@ -72,7 +84,17 @@ describe('integration', () => {
             }
         });
 
-        await got(`${vaultUrl}/v1/my-secret/nested/test`, {
+        await got(`${vaultUrl}/v1/secret-kv1/foobar`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                fookv1: 'bar',
+            }
+        });
+
+        await got(`${vaultUrl}/v1/secret-kv1/nested/test`, {
             method: 'POST',
             headers: {
                 'X-Vault-Token': 'testtoken',
@@ -101,20 +123,8 @@ describe('integration', () => {
             .mockReturnValueOnce(secrets);
     }
 
-    function mockEngineName(name) {
-        when(core.getInput)
-            .calledWith('path')
-            .mockReturnValueOnce(name);
-    }
-
-    function mockVersion(version) {
-        when(core.getInput)
-            .calledWith('kv-version')
-            .mockReturnValueOnce(version);
-    }
-
     it('get simple secret', async () => {
-        mockInput('test secret');
+        mockInput('secret/data/test secret');
 
         await exportSecrets();
 
@@ -122,7 +132,7 @@ describe('integration', () => {
     });
 
     it('re-map secret', async () => {
-        mockInput('test secret | TEST_KEY');
+        mockInput('secret/data/test secret | TEST_KEY');
 
         await exportSecrets();
 
@@ -130,7 +140,7 @@ describe('integration', () => {
     });
 
     it('get nested secret', async () => {
-        mockInput('nested/test otherSecret');
+        mockInput('secret/data/nested/test otherSecret');
 
         await exportSecrets();
 
@@ -139,9 +149,9 @@ describe('integration', () => {
 
     it('get multiple secrets', async () => {
         mockInput(`
-        test secret ;
+        secret/data/test secret ;
-        test secret | NAMED_SECRET ;
+        secret/data/test secret | NAMED_SECRET ;
-        nested/test otherSecret ;`);
+        secret/data/nested/test otherSecret ;`);
 
         await exportSecrets();
 
@@ -152,10 +162,16 @@ describe('integration', () => {
         expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
     });
 
+    it('leading slash kvv2', async () => {
+        mockInput('/secret/data/foobar fookv2');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('FOOKV2', 'bar');
+    });
+
     it('get secret from K/V v1', async () => {
-        mockInput('test secret');
+        mockInput('secret-kv1/test secret');
-        mockEngineName('my-secret');
-        mockVersion('1');
 
         await exportSecrets();
 
@@ -163,15 +179,21 @@ describe('integration', () => {
     });
 
     it('get nested secret from K/V v1', async () => {
-        mockInput('nested/test otherSecret');
+        mockInput('secret-kv1/nested/test otherSecret');
-        mockEngineName('my-secret');
-        mockVersion('1');
 
         await exportSecrets();
 
         expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERCUSTOMSECRET');
     });
 
+    it('leading slash kvv1', async () => {
+        mockInput('/secret-kv1/foobar fookv1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('FOOKV1', 'bar');
+    });
+
     describe('generic engines', () => {
         beforeAll(async () => {
             await got(`${vaultUrl}/v1/cubbyhole/test`, {

integrationTests/e2e-tls/README.md

@@ -0,0 +1,4 @@
+# e2e tests
+
+This test suite runs `vault-action` as a GitHub Action in the context of a live build, and then verifies that the appropriate environmental variables are set.
+These tests are intended to mostly be very simple smoke tests to verify that the action is being compiled and run correctly in context.

integrationTests/e2e-tls/configs/ca.crt

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIEFjCCAv6gAwIBAgIUe0i7/HGZKvbDb30L9mC99KXFwj8wDQYJKoZIhvcNAQEL
+BQAwgaIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
+Ew1TYW4gRnJhbmNpc2NvMRIwEAYDVQQKEwlIYXNoaUNvcnAxIzAhBgNVBAsTGlRl
+c3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MS0wKwYDVQQDEyRQcm90b3R5cGUgVGVz
+dCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMjAwODA1MTg1MjAwWhcNMjUwODA0
+MTg1MjAwWjCBojELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAU
+BgNVBAcTDVNhbiBGcmFuY2lzY28xEjAQBgNVBAoTCUhhc2hpQ29ycDEjMCEGA1UE
+CxMaVGVzdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxLTArBgNVBAMTJFByb3RvdHlw
+ZSBUZXN0IENlcnRpZmljYXRlIEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAMrRXuu2+zhBs0pLYEdXIaPc4KoWO3xm2RJdbzy3hfjFybQ8
+H/Y6Hi7txjGGSb45xSfXT/RF2srNfs235I+sfB8rrEizNpzkXqOgGa8LKvh2tgBT
+BK/jDWsEdDhxmkpFhE69wEW+D5ub7QGnx9jrqLKfwCmUA0utlzcFBk2nRNhRtsrp
+CI5YL1VN4coLpgXdvbodzbynPzGHe9R/o9K0Uiz2hgHooyKwhkVYwo0BIAQamLFz
+TS7lyeLf0thDOxV31NX8SpSucqRf50WHNk8T/YtKZ9EhlBDT4ybZwwvcC/ocxxcg
+1LvB0YweZNjSeO78S4CMh1TFGXnF/xOtGABlIbcCAwEAAaNCMEAwDgYDVR0PAQH/
+BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFABD/NxvYLpo5zVNeD01
+r8IIFYlBMA0GCSqGSIb3DQEBCwUAA4IBAQB7TfpIx53gf/oI3mgR6Ciz287WBzFR
+OzhJXwHk5J3mx8VC1W8tDRXih2lCLd/f9qDy6LyL/hZcoonev6w9oReuOMBiH6l4
+Pf3yq2aDXX0AoGgm75c1m34kY669JLMsHq5+xuUDeeFUMd60w9zVtZfBSumy/sgN
+PdjtvThh8sSByocYULs3tuxZDGyQ6GyQcn/xlMrGtmcD5IuX5IXqcKRVlZttykNx
+S2ltcR00fekw8WZyPSzMJaP+/Kcq3T2viN02MS6qEycQZoYfEAMdj+A0kjbsZG9D
+6J92z78b2DuLAUvZVpynNk/UbpDeqIDy40V3JDmtvrfGUMkMhMqgK/+J
+-----END CERTIFICATE-----

integrationTests/e2e-tls/configs/client.crt

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIENTCCAx2gAwIBAgIUMu5h1ysA5DlM6lzZFliT2C2n4lEwDQYJKoZIhvcNAQEL
+BQAwgaIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
+Ew1TYW4gRnJhbmNpc2NvMRIwEAYDVQQKEwlIYXNoaUNvcnAxIzAhBgNVBAsTGlRl
+c3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MS0wKwYDVQQDEyRQcm90b3R5cGUgVGVz
+dCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwIBcNMjAwODA1MTg1MjAwWhgPMjEyMDA3
+MTIxODUyMDBaMIGMMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEW
+MBQGA1UEBxMNU2FuIEZyYW5jaXNjbzESMBAGA1UEChMJSGFzaGlDb3JwMSMwIQYD
+VQQLExpUZXN0IENlcnRpZmljYXRlIEF1dGhvcml0eTEXMBUGA1UEAxMOaGFzaGlj
+b3JwLnRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC/zYDKdDGo
++Qy7eJUNjOe6jpeGvK1lMu5T1Xka+h2ay6WH5gLyrPw5pi582iYpJdHVbplKMywx
+LxZv7mAbKNxqdp8UZKy0A3bCuHQqRF8ssXXHufQ8EGxNkLMLJP0e2q39OnrxXekS
+8Ct3aJm3V8qkcV3CpVdPNgJh4TSuneCXIxVWjFYSiyHi0/5TRd2D+aQPz12szg5F
+mBW4dLzYKHEMlWcjWG8mxtbLyt+jSR1+tSehQx7KndufdfniOWEDBdbeR3yDnZdn
+p8DnRWK4oaEI3Sl8tKlDd1Yp+R96aqOEn1tPW6Jy6Vdvk3fCefclbWZ6B9kiJ/1r
+gxq7AN7iKmHNAgMBAAGjdTBzMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggr
+BgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRn2mwyk+MPChnLg0iWy1r9
+b3JvwTAfBgNVHSMEGDAWgBQAQ/zcb2C6aOc1TXg9Na/CCBWJQTANBgkqhkiG9w0B
+AQsFAAOCAQEAOpCy0vHp1Kxgv0VBRrbrwSQLBGP8a1ubVWoeoZQ+EvX9ozqDrHxm
+gM4XPYUJlUOOEu0ZRgCW60YK33E1zNKnA1F0/3/rmqMkKnm0BBs/5WzMWtsIBPcU
+e0CeJmaRIXnERQMH/svD+RrFo1dcF8rUDIlWez7+xGqoIGBg7v4jEmkZ3HdckcE+
+/xvC61YSG8NsJwR/CEcQ8YCyVfgvuS0ukWs4dN15aVDL3Oe61h3bRcGAywOJBrdq
+9xaq7ezZp/+lUSkYnatWJBuC/aviH9g9s+gMT0I3fWHh8BB0Ne2txwJ15K/qz5he
+TjxFsumrh50aFqjSiEHndtY5UWuGAFLiSw==
+-----END CERTIFICATE-----

integrationTests/e2e-tls/configs/client.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAv82AynQxqPkMu3iVDYznuo6XhrytZTLuU9V5Gvodmsulh+YC
+8qz8OaYufNomKSXR1W6ZSjMsMS8Wb+5gGyjcanafFGSstAN2wrh0KkRfLLF1x7n0
+PBBsTZCzCyT9Htqt/Tp68V3pEvArd2iZt1fKpHFdwqVXTzYCYeE0rp3glyMVVoxW
+Eosh4tP+U0Xdg/mkD89drM4ORZgVuHS82ChxDJVnI1hvJsbWy8rfo0kdfrUnoUMe
+yp3bn3X54jlhAwXW3kd8g52XZ6fA50ViuKGhCN0pfLSpQ3dWKfkfemqjhJ9bT1ui
+culXb5N3wnn3JW1megfZIif9a4MauwDe4iphzQIDAQABAoIBAQCYHJuidAoaTwGZ
+ACV9rJzuqD1lvubpFj5KwEcebPPjmtQ5deIqoaQa+D9wBvYyteq3ENKDNRg8HXL2
+7B7OC1bbHB5HZxxMW17pSK3gA39Ti52z+zbGF+Q8k6BbG0efG6DW7nUoTOkWeuCN
+/6fA7uAoEDxirQwUJuo2xAsq3MyMLwcs95rke9Bly8ABFNaV1oMZq8YT/w8oSc2b
+/7WtxXmChHlVYXTcMqzVPqNFqPRixZRWQ+BSHoXmEDviuGd51L4s9D7iXp32TvUx
+DMHeS1DFA2en7ZF1uc9VXZeplkkDtVhUe4d6qOqCcUwDFEvMonnyVSa6/FkR5jYZ
+2yujTdfhAoGBAM0hGOnmnDnCjADUt4mZlr+Mf0XmdKzEV+hid4CQUvBoTXgjYMvv
+c397eNePce7SwSUE1/APERInGUPhRLVFW5q6/34WRtGBbQkT8ByeJANXes4UFZe3
+wdNLczWUlSl0G3jTf+Kh3+K5/PtmyxSrAS/9GIk+ibs1mlJOPyVnWqUJAoGBAO9e
+WlP9/ruXluvkQyM5ZlnAnZYMsFGzzPx4tkazUjurtqxQoyZ0z+pPItGQ7lOl+pDA
+EWiTun66g+Da9uBiBCJUeXiC1ge2p6bT6N194BrYyrWML9hcIL4mqVojUEUmhnSh
+6b9h1pC7vFmw5ZFMIIkS60cfBMgQMZxMJN8NuaulAoGBAJM5hwURg90c2ZkbEyPK
+PVz7fLlxnxoEzcc3LOf0LeLoKXnpgma8VJwRxXiJNs+fKgrkwAtG9QyfTU3f1412
+2zlhr1ASsv9ZMiXKzpHrmpNfbP+NgLXkqFN7mpPBMZGQCMuemPHTFrpGnODfNTB/
+T5newIZ4gSgBX+Jk0IOK+47pAoGAeKo6pK6ck9pV5TIbOg18b/AuQG7DD1yxD/CW
+CkvpP1VPb8vygrdN/FLKPZRu39IC3qdD31DhKXNCeb5Hx1MBvICS/1INLLRCDVIz
+yDvlFgOFJEG3+LxwcQqyQlMc6s8B5pecarKaZDmPODN5dmZG3HKiEicr1OJ878pe
+p+aWW1UCgYBmGFbCc1qqlqp+srYGsv3rIgNs5HSfrAjbgY8xh9foMgrYCRAm57gv
+01yVxMXWmKA6ReVEu8OTVy9fkuOL/vw2o+C6W4IPZYdvSQoPwd5Lf+AqxEQvFF1m
+tT3SZAM3EhQ7tIXdIQHY27SJ1KlUJMrvUq1CiRWiG/MOKf/87JXPog==
+-----END RSA PRIVATE KEY-----

integrationTests/e2e-tls/configs/config.hcl

@@ -0,0 +1,15 @@
+ui = false
+disable_mlock = true
+
+listener "tcp" {
+  address = "[::]:8200"
+  cluster_address = "[::]:8201"
+  tls_cert_file = "/etc/vault/server.crt"
+  tls_key_file = "/etc/vault/server.key"
+  tls_client_ca_file = "/etc/vault/ca.crt"
+  tls_require_and_verify_client_cert = "true"
+}
+
+storage "file" {
+  path = "/var/lib/vault"
+}

integrationTests/e2e-tls/configs/server.crt

@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEXjCCA0agAwIBAgIUAswquazrfsyDRvXZwn5718DUhU4wDQYJKoZIhvcNAQEL
+BQAwgaIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
+Ew1TYW4gRnJhbmNpc2NvMRIwEAYDVQQKEwlIYXNoaUNvcnAxIzAhBgNVBAsTGlRl
+c3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MS0wKwYDVQQDEyRQcm90b3R5cGUgVGVz
+dCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwIBcNMjAwODA1MTg1MjAwWhgPMjEyMDA3
+MTIxODUyMDBaMIGMMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEW
+MBQGA1UEBxMNU2FuIEZyYW5jaXNjbzESMBAGA1UEChMJSGFzaGlDb3JwMSMwIQYD
+VQQLExpUZXN0IENlcnRpZmljYXRlIEF1dGhvcml0eTEXMBUGA1UEAxMOaGFzaGlj
+b3JwLnRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0azdZsrPC
+5Rv8nRxVJnLi+oZgCJYgzhCDiEbYqt1QK1gqNXp0ml5ck6ycj0drwzHzrrX+xcPV
+5FcNKH3RFyon9XkzjwaXkMv6IkgvH6/jQ1dDW9kWBf3Io3Y59wnD/YaIzNK0CYJS
+fRNdsZb4InH8gh+RL33+FeysgJwXG1TVA4tTUj7DQxDE0cDd9UD+C9Yx7OWiUjC1
+IjqdFPusX1nziKYjeI5/UiCmOUGqJJRoMPonuzuGIj9GdmBKmga64OfeZFqn4f6a
+ay61VnGCwZ24VniUwYElsFbcF2Nv9WqnrOeQlHOsYN68VMqHzaYPqE6SPa6mO5mI
+/tmpXrDG3Y+RAgMBAAGjgZ0wgZowDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoG
+CCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFE03/UTs2ZmJpWHSmstt
+hDngW6F3MB8GA1UdIwQYMBaAFABD/NxvYLpo5zVNeD01r8IIFYlBMCUGA1UdEQQe
+MByCCWxvY2FsaG9zdIIJdmF1bHQtdGxzhwR/AAABMA0GCSqGSIb3DQEBCwUAA4IB
+AQCzarBGJium5oZDSSP5GqxpS13QP2onEen6I1k2eRdcOqtbfNdQ20RJrb4dfNkE
+Dc09KWVlZAn+hYge2KKTXJ+4ltIC9V1LvquyWipNczOT1ve0H9gt3Wm88LdESqI5
+HOx43pIaa3cWXBlbzrFmT1SASYm1V5Oo1mXzpUukGokHLLmAz36VVuJGbD0BxYke
+5MefG4tNT1SsMsIqVvGxI9NiVs7YTdJu81MctSYK5snsEKnYdi9N7CHOk3bdDpeC
+v2Vo7XBk3s4sBMGmnJO+1JOcRFJioooEFkqNyQmg3atfInysVbreKS5KtWNTaCPm
+yI55plW8ga5ucja2VX3WbwAO
+-----END CERTIFICATE-----

integrationTests/e2e-tls/configs/server.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAtGs3WbKzwuUb/J0cVSZy4vqGYAiWIM4Qg4hG2KrdUCtYKjV6
+dJpeXJOsnI9Ha8Mx8661/sXD1eRXDSh90RcqJ/V5M48Gl5DL+iJILx+v40NXQ1vZ
+FgX9yKN2OfcJw/2GiMzStAmCUn0TXbGW+CJx/IIfkS99/hXsrICcFxtU1QOLU1I+
+w0MQxNHA3fVA/gvWMezlolIwtSI6nRT7rF9Z84imI3iOf1IgpjlBqiSUaDD6J7s7
+hiI/RnZgSpoGuuDn3mRap+H+mmsutVZxgsGduFZ4lMGBJbBW3Bdjb/Vqp6znkJRz
+rGDevFTKh82mD6hOkj2upjuZiP7ZqV6wxt2PkQIDAQABAoIBAQCvK0HsVvLtkSCh
+HbF6gwAcnHyHFQ8d/rRN4KxYhVynD85j/NRODer8G20F/J6tZDFFlSWinUTMkQxr
+/BpcPg9yCIWKp50Q30cMLujCyBMvphw9jBmzplGG0h5hnRbgMXDDtYoFvw3HJST+
+XQRlGpxtO7GGdwPvBD5sJdpnHOQ6g7qIYKmlHM99kHU8vr0VghqZAYxEh8RpnYez
+NLra+7ep+Zp1pFIniU6B8ohyL3OArbQ65qYrZYriAEI5HeEk0RhjewcPsV56LwbS
+CncTVS/dNYgk1zRIvytmbDVD3v/4lLvnpIWeKVdk7p1aGJeCdpLeWNvDLX0Ws67r
+QeZQizwhAoGBAMwAIA6+HPsx+8dhNbN3ydX8YU6uUfSeshhshIFZPIYL2vrKyAHU
+/GAYVzYJH/cU0IvlLJlLdQuiZkOXEX87tgdfmM/o4Qdl12RR0BvU0Cae0txtzNrP
+yTdfZqDhTz/V8jOAXUNA5oQA45Y3rI7JES8hBd1F9WFOH2WINp344GzlAoGBAOJo
+SgmRE24VcnfUMqrBpwZBdBrTxDQyTagvd+MuGomIQfcE2Y4rr1eIuJJ0HF5/eYxc
+DZRO/LVP9tQ8ozXi2tdmgUdKC79O2edmdOCWW5of464R/TLcM5B4SmS36RtdE3qJ
+ig4fcUmsJ15MAGpkXLMh5YSD/N3TmcnURtx06Fk9AoGATi+mGcBnnybzFuF9EYHR
+y7/lE6DgLF8+ZvoAdwralY2pqgFaUslsyO/LTRyGMc66d0OoqkAvZfwiMbmOrTMX
+ew/6o4Tf6lPwD7UDjAcul/67VlyG7T5CIoTf8r0oAJFhOLf0BrizINiuYX6JFlid
+y3BerQYJG/gzNFjWhglDCrkCgYA+3wUISRAjNrN10ShMwL/3/b8XIA1RDVMBTEU3
+gfr+jCb9SIx9bWYgoafXi4TBPRbswjdHIvQMCWuankgYU6m/vQhTWp2Of4AFQS9d
+moNPdmGMWhR8xidPjAfklimWXq9lDMKYj2SvN64rAmHvKXWQjO4mcVyL4RHIuTkA
+STqoZQKBgQDKHd8F6tjZHEFolmjS5l682g7zVTpBhozezJ/RqYvhJh5ew1pXoD/O
+Zu9iMfHoDjR4ZUXq6aeLUj/oIt1AsjwaGChOLLAvFbvePgS9XkYkwIlaxS4efAya
++CQE/JmY/a1/c2MDLNMCEXvUqX68pv6iDF8pfn+i4tn0omYqgfUlCA==
+-----END RSA PRIVATE KEY-----

integrationTests/e2e-tls/e2e-tls.test.js

@@ -0,0 +1,14 @@
+describe('e2e-tls', () => {
+    it('verify', () => {
+        expect(process.env.SECRET).toBe("SUPERSECRET");
+        expect(process.env.NAMED_SECRET).toBe("SUPERSECRET");
+        expect(process.env.OTHERSECRET).toBe("OTHERSUPERSECRET");
+        expect(process.env.OTHER_SECRET_OUTPUT).toBe("OTHERSUPERSECRET");
+        expect(process.env.ALTSECRET).toBe("CUSTOMSECRET");
+        expect(process.env.NAMED_ALTSECRET).toBe("CUSTOMSECRET");
+        expect(process.env.OTHERALTSECRET).toBe("OTHERCUSTOMSECRET");
+        expect(process.env.FOO).toBe("bar");
+        expect(process.env.NAMED_CUBBYSECRET).toBe("zap");
+        expect(process.env.SKIP).toBe("true");
+    });
+});

integrationTests/e2e-tls/jest.config.js

@@ -0,0 +1,3 @@
+module.exports = {
+    verbose: true
+};

integrationTests/e2e-tls/setup.js

@@ -0,0 +1,197 @@
+const got = require('got');
+const core = require('@actions/core');
+
+const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
+const caCertificateRaw = `${process.env.VAULTCA}`;
+const clientCertificateRaw = `${process.env.VAULT_CLIENT_CERT}`;
+const clientKeyRaw = `${process.env.VAULT_CLIENT_KEY}`;
+
+(async () => {
+    try {
+        var caCertificate = Buffer.from(caCertificateRaw, 'base64').toString();
+        if (caCertificate == null) {
+            throw Error("VAULTCA env not set.")
+        }
+
+        var clientCertificate = Buffer.from(clientCertificateRaw, 'base64').toString();
+        if (clientCertificate == null) {
+            throw Error("VAULT_CLIENT_CERT env not set.")
+        }
+
+        var clientKey = Buffer.from(clientKeyRaw, 'base64').toString();
+        if (clientKey == null) {
+            throw Error("VAULT_CLIENT_KEY env not set.")
+        }
+
+        // Init
+        const {body} = await got(`https://${vaultUrl}/v1/sys/init`, {
+            method: 'POST',
+            json: {
+                secret_shares: 1,
+                secret_threshold: 1,
+            },
+            responseType: 'json',
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            }
+        });
+
+        if (body.keys_base64.length != 1) {
+            throw Error("No unseal key found after init.")
+        }
+        var unseal = body.keys_base64[0];
+
+        if (body.root_token == "") {
+            throw Error("No root token found after init.")
+        }
+        var rootToken = body.root_token;
+
+        core.exportVariable('VAULT_TOKEN', rootToken);
+        core.setSecret(rootToken)
+
+        // Unseal 
+        await got(`https://${vaultUrl}/v1/sys/unseal`, {
+            method: 'POST',
+            json: {
+                key: unseal,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            }
+        });
+
+        await got(`https://${vaultUrl}/v1/sys/mounts/secret`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                type: 'kv-v2'
+            }
+        });
+
+        await got(`https://${vaultUrl}/v1/secret/data/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                data: {
+                    secret: 'SUPERSECRET',
+                },
+            },
+        });
+
+        await got(`https://${vaultUrl}/v1/secret/data/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                data: {
+                    otherSecret: 'OTHERSUPERSECRET',
+                },
+            }
+        });
+
+        await got(`https://${vaultUrl}/v1/secret/data/tlsSkipVerify`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                data: {
+                    skip: 'true',
+                },
+            }
+        });
+
+        await got(`https://${vaultUrl}/v1/sys/mounts/my-secret`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                type: 'kv'
+            }
+        });
+
+        await got(`https://${vaultUrl}/v1/my-secret/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                altSecret: 'CUSTOMSECRET',
+            }
+        });
+
+        await got(`https://${vaultUrl}/v1/my-secret/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                otherAltSecret: 'OTHERCUSTOMSECRET',
+            },
+        });
+
+        await got(`https://${vaultUrl}/v1/cubbyhole/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                foo: 'bar',
+                zip: 'zap',
+            },
+        });
+    } catch (error) {
+        console.log(error);
+        process.exit(1);
+    }
+})();

integrationTests/enterprise/enterprise.test.js

@@ -56,7 +56,7 @@ describe('integration', () => {
     });
 
     it('get simple secret', async () => {
-        mockInput('test secret');
+        mockInput('secret/data/test secret');
 
         await exportSecrets();
 
@@ -64,7 +64,7 @@ describe('integration', () => {
     });
 
     it('re-map secret', async () => {
-        mockInput('test secret | TEST_KEY');
+        mockInput('secret/data/test secret | TEST_KEY');
 
         await exportSecrets();
 
@@ -72,7 +72,7 @@ describe('integration', () => {
     });
 
     it('get nested secret', async () => {
-        mockInput('nested/test otherSecret');
+        mockInput('secret/data/nested/test otherSecret');
 
         await exportSecrets();
 
@@ -81,9 +81,9 @@ describe('integration', () => {
 
     it('get multiple secrets', async () => {
         mockInput(`
-        test secret ;
+        secret/data/test secret ;
-        test secret | NAMED_SECRET ;
+        secret/data/test secret | NAMED_SECRET ;
-        nested/test otherSecret ;`);
+        secret/data/nested/test otherSecret ;`);
 
         await exportSecrets();
 
@@ -95,9 +95,7 @@ describe('integration', () => {
     });
 
     it('get secret from K/V v1', async () => {
-        mockInput('test secret');
+        mockInput('my-secret/test secret');
-        mockEngineName('my-secret');
-        mockVersion('1');
 
         await exportSecrets();
 
@@ -105,9 +103,7 @@ describe('integration', () => {
     });
 
     it('get nested secret from K/V v1', async () => {
-        mockInput('nested/test otherSecret');
+        mockInput('my-secret/nested/test otherSecret');
-        mockEngineName('my-secret');
-        mockVersion('1');
 
         await exportSecrets();
 
@@ -229,7 +225,7 @@ describe('authenticate with approle', () => {
     });
 
     it('authenticate with approle', async() => {
-        mockInput('test secret');
+        mockInput('secret/data/test secret');
 
         await exportSecrets();
 

package-lock.json

@@ -7,7 +7,8 @@
     "@actions/core": {
       "version": "1.2.3",
       "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.3.tgz",
-      "integrity": "sha512-Wp4xnyokakM45Uuj4WLUxdsa8fJjKVl1fDTsPbTEcTcuu0Nb26IPQbOtjmnfaCPGcaoPOOqId8H9NapZ8gii4w=="
+      "integrity": "sha512-Wp4xnyokakM45Uuj4WLUxdsa8fJjKVl1fDTsPbTEcTcuu0Nb26IPQbOtjmnfaCPGcaoPOOqId8H9NapZ8gii4w==",
+      "dev": true
     },
     "@babel/code-frame": {
       "version": "7.5.5",
@@ -1411,14 +1412,14 @@
       }
     },
     "@octokit/core": {
-      "version": "2.4.3",
+      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-2.4.3.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-2.5.0.tgz",
-      "integrity": "sha512-9T91nYeBB7+PNK3oxOuA+6DXCPRvhJ80ke+NqhXirBjVtNepTKFJXoWPqguRSBQ+dkEVA8dZJMxfFzjz9yhiuA==",
+      "integrity": "sha512-uvzmkemQrBgD8xuGbjhxzJN1darJk9L2cS+M99cHrDG2jlSVpxNJVhoV86cXdYBqdHCc9Z995uLCczaaHIYA6Q==",
       "dev": true,
       "requires": {
         "@octokit/auth-token": "^2.4.0",
         "@octokit/graphql": "^4.3.1",
-        "@octokit/request": "^5.3.1",
+        "@octokit/request": "^5.4.0",
         "@octokit/types": "^2.0.0",
         "before-after-hook": "^2.1.0",
         "universal-user-agent": "^5.0.0"
@@ -1475,12 +1476,12 @@
       }
     },
     "@octokit/plugin-paginate-rest": {
-      "version": "2.0.2",
+      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-2.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-2.1.0.tgz",
-      "integrity": "sha512-HzODcSUt9mjErly26TlTOGZrhf9bmF/FEDQ2zln1izhgmIV6ulsjsHmgmR4VZ0wzVr/m52Eb6U2XuyS8fkcR1A==",
+      "integrity": "sha512-7+/7urDH8cy6DmTwkewysf7/Or9dFtwZK7aQOc/IImjyeHJy+C8CEKOPo7L5Qb+66HyAr/4p/zV76LMVMuiRtA==",
       "dev": true,
       "requires": {
-        "@octokit/types": "^2.0.1"
+        "@octokit/types": "^2.9.0"
       }
     },
     "@octokit/plugin-request-log": {
@@ -1490,9 +1491,9 @@
       "dev": true
     },
     "@octokit/plugin-rest-endpoint-methods": {
-      "version": "3.4.0",
+      "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-3.4.0.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-3.5.2.tgz",
-      "integrity": "sha512-Tvctk0u5SVrSLAzi8SLo0KrLSBl5biAHBgWy3L65vsbO/2fjzr62HVkoDPyr+WRT+eHhhqpKAERF3dQWOIUOvQ==",
+      "integrity": "sha512-i5GlEWm7k/SzBr7QrIOuas/1nNgr4JcmgM14TAKULVkv4L5mOY+pcVIUMU3qdYhFyblBFhigujav5seMnkqBnQ==",
       "dev": true,
       "requires": {
         "@octokit/types": "^2.0.1",
@@ -1500,14 +1501,14 @@
       }
     },
     "@octokit/request": {
-      "version": "5.3.4",
+      "version": "5.4.0",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-5.3.4.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-5.4.0.tgz",
-      "integrity": "sha512-qyj8G8BxQyXjt9Xu6NvfvOr1E0l35lsXtwm3SopsYg/JWXjlsnwqLc8rsD2OLguEL/JjLfBvrXr4az7z8Lch2A==",
+      "integrity": "sha512-uAJO6GI8z8VHBqtY7VTL9iFy1Y+UTp5ShpI97tY5z0qBfYKE9rZCRsCm23VmF00x+IoNJ7a0nuVITs/+wS9/mg==",
       "dev": true,
       "requires": {
         "@octokit/endpoint": "^6.0.0",
         "@octokit/request-error": "^2.0.0",
-        "@octokit/types": "^2.0.0",
+        "@octokit/types": "^2.8.2",
         "deprecation": "^2.0.0",
         "is-plain-object": "^3.0.0",
         "node-fetch": "^2.3.0",
@@ -1544,21 +1545,21 @@
       }
     },
     "@octokit/rest": {
-      "version": "17.1.4",
+      "version": "17.3.0",
-      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-17.1.4.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-17.3.0.tgz",
-      "integrity": "sha512-LGghhepxoXyvi7ew0OdedrlwXQog8gvTbcdXoQ6RDKnzoYW2rBpcqeWC4fTuPUp9K0UEykcMix8kFnQ5b+64JQ==",
+      "integrity": "sha512-zqvsnWUEldmF3sCmGGlQ2u+NDQMpF5O4gnwefnGt6yJcN6eGWDYJJvRD/wQ1/nALXU0XABhQElBgR/0wNoprsA==",
       "dev": true,
       "requires": {
         "@octokit/core": "^2.4.3",
-        "@octokit/plugin-paginate-rest": "^2.0.0",
+        "@octokit/plugin-paginate-rest": "^2.1.0",
         "@octokit/plugin-request-log": "^1.0.0",
-        "@octokit/plugin-rest-endpoint-methods": "3.4.0"
+        "@octokit/plugin-rest-endpoint-methods": "3.5.2"
       }
     },
     "@octokit/types": {
-      "version": "2.5.1",
+      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-2.5.1.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-2.10.0.tgz",
-      "integrity": "sha512-q4Wr7RexkPRrkQpXzUYF5Fj/14Mr65RyOHj6B9d/sQACpqGcStkHZj4qMEtlMY5SnD/69jlL9ItGPbDM0dR/dA==",
+      "integrity": "sha512-0/NN22MgQvNNgMjTwzWUzcIfFfks3faqiP1D1oQQz49KYeOWc+KkRG9ASbAPurrAnOaDiqnnuDYzhNT9cq4e8Q==",
       "dev": true,
       "requires": {
         "@types/node": ">= 8"
@@ -1708,9 +1709,9 @@
       },
       "dependencies": {
         "cross-spawn": {
-          "version": "7.0.1",
+          "version": "7.0.2",
-          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.1.tgz",
+          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.2.tgz",
-          "integrity": "sha512-u7v4o84SwFpD32Z8IIcPZ6z1/ie24O6RU3RbtL5Y316l3KuHVPx9ItBgWQ6VlfAFnRnTtMUrsQ9MUUTuEZjogg==",
+          "integrity": "sha512-PD6G8QG3S4FK/XCGFbEQrDqO2AnMMsy0meR7lerlIOHAAbkuavGU/pOqprrlvfTNjvowivTeBsjebAL0NSoMxw==",
           "dev": true,
           "requires": {
             "path-key": "^3.1.0",
@@ -1796,9 +1797,9 @@
           }
         },
         "semver": {
-          "version": "7.1.3",
+          "version": "7.3.2",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-7.1.3.tgz",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.2.tgz",
-          "integrity": "sha512-ekM0zfiA9SCBlsKa2X1hxyxiI4L3B6EbVJkkdgQXnSEEaHlGdvyodMruTiulSRWMMB4NeIuYNMC9rTKTz97GxA==",
+          "integrity": "sha512-OrOb32TeeambH6UrhtShmF7CRDqhL6/5XpPNp2DuRH6+9QLw/orhp72j87v8Qa1ScDkvrrBNpZcDejAirJmfXQ==",
           "dev": true
         },
         "shebang-command": {
@@ -1872,9 +1873,9 @@
       }
     },
     "@sindresorhus/is": {
-      "version": "2.1.0",
+      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-2.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-3.1.0.tgz",
-      "integrity": "sha512-lXKXfypKo644k4Da4yXkPCrwcvn6SlUW2X2zFbuflKHNjf0w9htru01bo26uMhleMXsDmnZ12eJLdrAZa9MANg=="
+      "integrity": "sha512-n4J+zu52VdY43kdi/XdI9DzuMr1Mur8zFL5ZRG2opCans9aiFwkPxHYFEb5Xgy7n1Z4K6WfI4FpqUqsh3E8BPQ=="
     },
     "@sinonjs/commons": {
       "version": "1.7.1",
@@ -2812,13 +2813,9 @@
       }
     },
     "cacheable-lookup": {
-      "version": "2.0.1",
+      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/cacheable-lookup/-/cacheable-lookup-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/cacheable-lookup/-/cacheable-lookup-5.0.3.tgz",
-      "integrity": "sha512-EMMbsiOTcdngM/K6gV/OxF2x0t07+vMOWxZNSCRQMjO2MY2nhZQ6OYhOOpyQrbhqsgtvKGI7hcq6xjnA92USjg==",
+      "integrity": "sha512-W+JBqF9SWe18A72XFzN/V/CULFzPm7sBXzzR6ekkE+3tLG72wFZrBiBZhrZuDoYexop4PHJVdFAKb/Nj9+tm9w=="
-      "requires": {
-        "@types/keyv": "^3.1.1",
-        "keyv": "^4.0.0"
-      }
     },
     "cacheable-request": {
       "version": "7.0.1",
@@ -2955,30 +2952,12 @@
         "colors": "1.0.3"
       }
     },
-    "cliui": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-5.0.0.tgz",
-      "integrity": "sha512-PYeGSEmmHM6zvoef2w8TPzlrnNpXIjTipYK780YswmIP9vjxmd6Y2a3CB2Ks6/AU8NHjZugXvo8w3oWM2qnwXA==",
-      "dev": true,
-      "requires": {
-        "string-width": "^3.1.0",
-        "strip-ansi": "^5.2.0",
-        "wrap-ansi": "^5.1.0"
-      }
-    },
     "clone-response": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/clone-response/-/clone-response-1.0.2.tgz",
       "integrity": "sha1-0dyXOSAxTfZ/vrlCI7TuNQI56Ws=",
       "requires": {
         "mimic-response": "^1.0.0"
-      },
-      "dependencies": {
-        "mimic-response": {
-          "version": "1.0.1",
-          "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-1.0.1.tgz",
-          "integrity": "sha512-j5EctnkH7amfV/q5Hgmoal1g2QHFJRraOtmx0JpIqkxhBhI/lJSl1nMpQ45hVarwNETOoWEimndZ4QK0RHxuxQ=="
-        }
       }
     },
     "co": {
@@ -3294,11 +3273,18 @@
       "dev": true
     },
     "decompress-response": {
-      "version": "5.0.0",
+      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-5.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
-      "integrity": "sha512-TLZWWybuxWgoW7Lykv+gq9xvzOsUjQ9tF09Tj6NSTYGMTCHNXzrPnD6Hi+TgZq19PyTAGH4Ll/NIM/eTGglnMw==",
+      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
       "requires": {
-        "mimic-response": "^2.0.0"
+        "mimic-response": "^3.1.0"
+      },
+      "dependencies": {
+        "mimic-response": {
+          "version": "3.1.0",
+          "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
+          "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ=="
+        }
       }
     },
     "deep-extend": {
@@ -3443,11 +3429,6 @@
         "readable-stream": "^2.0.2"
       }
     },
-    "duplexer3": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/duplexer3/-/duplexer3-0.1.4.tgz",
-      "integrity": "sha1-7gHdHKwO08vH/b6jfcCo8c4ALOI="
-    },
     "ecc-jsbn": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/ecc-jsbn/-/ecc-jsbn-0.1.2.tgz",
@@ -3458,12 +3439,6 @@
         "safer-buffer": "^2.1.0"
       }
     },
-    "emoji-regex": {
-      "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-7.0.3.tgz",
-      "integrity": "sha512-CwBLREIQ7LvYFB0WyRvwhq5N5qPhc6PMjD6bYggFlI5YyDgl+0vxq5VHbMOFqLg7hfWzmu8T5Z1QofhmTIhItA==",
-      "dev": true
-    },
     "end-of-stream": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.1.tgz",
@@ -3483,9 +3458,9 @@
       },
       "dependencies": {
         "cross-spawn": {
-          "version": "7.0.1",
+          "version": "7.0.2",
-          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.1.tgz",
+          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.2.tgz",
-          "integrity": "sha512-u7v4o84SwFpD32Z8IIcPZ6z1/ie24O6RU3RbtL5Y316l3KuHVPx9ItBgWQ6VlfAFnRnTtMUrsQ9MUUTuEZjogg==",
+          "integrity": "sha512-PD6G8QG3S4FK/XCGFbEQrDqO2AnMMsy0meR7lerlIOHAAbkuavGU/pOqprrlvfTNjvowivTeBsjebAL0NSoMxw==",
           "dev": true,
           "requires": {
             "path-key": "^3.1.0",
@@ -4136,40 +4111,21 @@
       }
     },
     "got": {
-      "version": "10.7.0",
+      "version": "11.5.1",
-      "resolved": "https://registry.npmjs.org/got/-/got-10.7.0.tgz",
+      "resolved": "https://registry.npmjs.org/got/-/got-11.5.1.tgz",
-      "integrity": "sha512-aWTDeNw9g+XqEZNcTjMMZSy7B7yE9toWOFYip7ofFTLleJhvZwUxxTxkTpKvF+p1SAA4VHmuEy7PiHTHyq8tJg==",
+      "integrity": "sha512-reQEZcEBMTGnujmQ+Wm97mJs/OK6INtO6HmLI+xt3+9CvnRwWjXutUvb2mqr+Ao4Lu05Rx6+udx9sOQAmExMxA==",
       "requires": {
-        "@sindresorhus/is": "^2.0.0",
+        "@sindresorhus/is": "^3.0.0",
-        "@szmarczak/http-timer": "^4.0.0",
+        "@szmarczak/http-timer": "^4.0.5",
         "@types/cacheable-request": "^6.0.1",
-        "cacheable-lookup": "^2.0.0",
+        "@types/responselike": "^1.0.0",
+        "cacheable-lookup": "^5.0.3",
         "cacheable-request": "^7.0.1",
-        "decompress-response": "^5.0.0",
+        "decompress-response": "^6.0.0",
-        "duplexer3": "^0.1.4",
+        "http2-wrapper": "^1.0.0-beta.5.0",
-        "get-stream": "^5.0.0",
         "lowercase-keys": "^2.0.0",
-        "mimic-response": "^2.1.0",
         "p-cancelable": "^2.0.0",
-        "p-event": "^4.0.0",
+        "responselike": "^2.0.0"
-        "responselike": "^2.0.0",
-        "to-readable-stream": "^2.0.0",
-        "type-fest": "^0.10.0"
-      },
-      "dependencies": {
-        "get-stream": {
-          "version": "5.1.0",
-          "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-5.1.0.tgz",
-          "integrity": "sha512-EXr1FOzrzTfGeL0gQdeFEvOMm2mzMOglyiOXSTpPC+iAjAKftbr3jpCMWynogwYnM+eSj9sHGc6wjIcDvYiygw==",
-          "requires": {
-            "pump": "^3.0.0"
-          }
-        },
-        "type-fest": {
-          "version": "0.10.0",
-          "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.10.0.tgz",
-          "integrity": "sha512-EUV9jo4sffrwlg8s0zDhP0T2WD3pru5Xi0+HTE3zTUmBaZNhfkite9PdSJwdXLwPVW0jnAHT56pZHIOYckPEiw=="
-        }
       }
     },
     "graceful-fs": {
@@ -4186,74 +4142,16 @@
       "optional": true
     },
     "handlebars": {
-      "version": "4.7.5",
+      "version": "4.7.6",
-      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.5.tgz",
+      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.6.tgz",
-      "integrity": "sha512-PiM2ZRLZ0X+CIRSX66u7tkQi3rzrlSHAuioMBI1XP8DsfDaXEA+sD7Iyyoz4QACFuhX5z+IimN+n3BFWvvgWrQ==",
+      "integrity": "sha512-1f2BACcBfiwAfStCKZNrUCgqNZkGsAT7UM3kkYtXuLo0KnaVfjKOyf7PRzB6++aK9STyT1Pd2ZCPe3EGOXleXA==",
       "dev": true,
       "requires": {
+        "minimist": "^1.2.5",
         "neo-async": "^2.6.0",
         "source-map": "^0.6.1",
         "uglify-js": "^3.1.4",
-        "yargs": "^14.2.3"
+        "wordwrap": "^1.0.0"
-      },
-      "dependencies": {
-        "find-up": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/find-up/-/find-up-3.0.0.tgz",
-          "integrity": "sha512-1yD6RmLI1XBfxugvORwlck6f75tYL+iR0jqwsOrOxMZyGYqUuDhJ0l4AXdO1iX/FTs9cBAMEk1gWSEx1kSbylg==",
-          "dev": true,
-          "requires": {
-            "locate-path": "^3.0.0"
-          }
-        },
-        "locate-path": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-3.0.0.tgz",
-          "integrity": "sha512-7AO748wWnIhNqAuaty2ZWHkQHRSNfPVIsPIfwEOWO22AmaoVrWavlOcMR5nzTLNYvp36X220/maaRsrec1G65A==",
-          "dev": true,
-          "requires": {
-            "p-locate": "^3.0.0",
-            "path-exists": "^3.0.0"
-          }
-        },
-        "p-locate": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-3.0.0.tgz",
-          "integrity": "sha512-x+12w/To+4GFfgJhBEpiDcLozRJGegY+Ei7/z0tSLkMmxGZNybVMSfWj9aJn8Z5Fc7dBUNJOOVgPv2H7IwulSQ==",
-          "dev": true,
-          "requires": {
-            "p-limit": "^2.0.0"
-          }
-        },
-        "yargs": {
-          "version": "14.2.3",
-          "resolved": "https://registry.npmjs.org/yargs/-/yargs-14.2.3.tgz",
-          "integrity": "sha512-ZbotRWhF+lkjijC/VhmOT9wSgyBQ7+zr13+YLkhfsSiTriYsMzkTUFP18pFhWwBeMa5gUc1MzbhrO6/VB7c9Xg==",
-          "dev": true,
-          "requires": {
-            "cliui": "^5.0.0",
-            "decamelize": "^1.2.0",
-            "find-up": "^3.0.0",
-            "get-caller-file": "^2.0.1",
-            "require-directory": "^2.1.1",
-            "require-main-filename": "^2.0.0",
-            "set-blocking": "^2.0.0",
-            "string-width": "^3.0.0",
-            "which-module": "^2.0.0",
-            "y18n": "^4.0.0",
-            "yargs-parser": "^15.0.1"
-          }
-        },
-        "yargs-parser": {
-          "version": "15.0.1",
-          "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-15.0.1.tgz",
-          "integrity": "sha512-0OAMV2mAZQrs3FkNpDQcBk1x5HXb8X4twADss4S0Iuk+2dGnLOE/fRHrsYm542GduMveyA77OF4wrNJuanRCWw==",
-          "dev": true,
-          "requires": {
-            "camelcase": "^5.0.0",
-            "decamelize": "^1.2.0"
-          }
-        }
       }
     },
     "har-schema": {
@@ -4384,6 +4282,22 @@
         "sshpk": "^1.7.0"
       }
     },
+    "http2-wrapper": {
+      "version": "1.0.0-beta.5.2",
+      "resolved": "https://registry.npmjs.org/http2-wrapper/-/http2-wrapper-1.0.0-beta.5.2.tgz",
+      "integrity": "sha512-xYz9goEyBnC8XwXDTuC/MZ6t+MrKVQZOk4s7+PaDkwIsQd8IwqvM+0M6bA/2lvG8GHXcPdf+MejTUeO2LCPCeQ==",
+      "requires": {
+        "quick-lru": "^5.1.1",
+        "resolve-alpn": "^1.0.0"
+      },
+      "dependencies": {
+        "quick-lru": {
+          "version": "5.1.1",
+          "resolved": "https://registry.npmjs.org/quick-lru/-/quick-lru-5.1.1.tgz",
+          "integrity": "sha512-WuyALRjWPDGtt/wzJiadO5AXY+8hZ80hVpe6MyivgraREW751X3SbhRvG3eLKOYN+8VEvqLcf3wdnt44Z4S4SA=="
+        }
+      }
+    },
     "https-proxy-agent": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.0.tgz",
@@ -4611,12 +4525,6 @@
       "integrity": "sha1-qIwCU1eR8C7TfHahueqXc8gz+MI=",
       "dev": true
     },
-    "is-fullwidth-code-point": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-2.0.0.tgz",
-      "integrity": "sha1-o7MKXE8ZkYMWeqq5O+764937ZU8=",
-      "dev": true
-    },
     "is-generator-fn": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/is-generator-fn/-/is-generator-fn-2.1.0.tgz",
@@ -7693,6 +7601,11 @@
         "minimist": "^1.2.5"
       }
     },
+    "jsonata": {
+      "version": "1.8.2",
+      "resolved": "https://registry.npmjs.org/jsonata/-/jsonata-1.8.2.tgz",
+      "integrity": "sha512-ma5F/Bs47dZfJfDZ0Dt37eIbzVBVKZIDqsZSqdCCAPNHxKn+s3+CfMA6ahVVlf8Y1hyIjXkVLFU7yv4XxRfihA=="
+    },
     "jsonfile": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.0.1.tgz",
@@ -7722,9 +7635,9 @@
       }
     },
     "keyv": {
-      "version": "4.0.0",
+      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.0.1.tgz",
-      "integrity": "sha512-U7ioE8AimvRVLfw4LffyOIRhL2xVgmE8T22L6i0BucSnBUyv4w+I7VN/zVZwRKHOI6ZRUcdMdWHQ8KSUvGpEog==",
+      "integrity": "sha512-xz6Jv6oNkbhrFCvCP7HQa8AaII8y8LRpoSm661NOKLr4uHuBwhX4epXrPQgF3+xdJnN4Esm5X0xwY4bOlALOtw==",
       "requires": {
         "json-buffer": "3.0.1"
       }
@@ -8129,9 +8042,9 @@
       "dev": true
     },
     "mimic-response": {
-      "version": "2.1.0",
+      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-2.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-1.0.1.tgz",
-      "integrity": "sha512-wXqjST+SLt7R009ySCglWBCFpjUygmCIfD790/kVbiGmUgfYGuB14PiTd5DwVxSV4NcYHjzMkoj5LjQZwTQLEA=="
+      "integrity": "sha512-j5EctnkH7amfV/q5Hgmoal1g2QHFJRraOtmx0JpIqkxhBhI/lJSl1nMpQ45hVarwNETOoWEimndZ4QK0RHxuxQ=="
     },
     "minimatch": {
       "version": "3.0.4",
@@ -8380,9 +8293,9 @@
       "dev": true
     },
     "normalize-url": {
-      "version": "4.4.1",
+      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-4.4.1.tgz",
+      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-4.5.0.tgz",
-      "integrity": "sha512-rjH3yRt0Ssx19mUwS0hrDUOdG9VI+oRLpLHJ7tXRdjcuQ7v7wo6qPvOZppHRrqfslTKr0L2yBhjj4UXd7c3cQg=="
+      "integrity": "sha512-2s47yzUxdexf1OhyRi4Em83iQk0aPvwTddtFz4hnSSw9dCEsLEGf6SwIO8ss/19S9iBb5sJaOuTvTGDeZI00BQ=="
     },
     "npm": {
       "version": "6.14.4",
@@ -10410,6 +10323,13 @@
           "dev": true,
           "requires": {
             "minimist": "^1.2.5"
+          },
+          "dependencies": {
+            "minimist": {
+              "version": "1.2.5",
+              "bundled": true,
+              "dev": true
+            }
           }
         },
         "move-concurrently": {
@@ -11045,6 +10965,13 @@
             "ini": "~1.3.0",
             "minimist": "^1.2.0",
             "strip-json-comments": "~2.0.1"
+          },
+          "dependencies": {
+            "minimist": {
+              "version": "1.2.5",
+              "bundled": true,
+              "dev": true
+            }
           }
         },
         "read": {
@@ -12033,14 +11960,6 @@
       "integrity": "sha512-ZuRs1miPT4HrjFa+9fRfOFXxGJfORgelKV9f9nNOWw2gl6gVsRaVDOQP0+MI0G0wGKns1Yacsu0GjOFbTK0JFQ==",
       "dev": true
     },
-    "p-event": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/p-event/-/p-event-4.1.0.tgz",
-      "integrity": "sha512-4vAd06GCsgflX4wHN1JqrMzBh/8QZ4j+rzp0cd2scXRwuBEv+QR3wrVA5aLhWDLw4y2WgDKvzWF3CCLmVM1UgA==",
-      "requires": {
-        "p-timeout": "^2.0.1"
-      }
-    },
     "p-filter": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/p-filter/-/p-filter-2.1.0.tgz",
@@ -12053,7 +11972,8 @@
     "p-finally": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/p-finally/-/p-finally-1.0.0.tgz",
-      "integrity": "sha1-P7z7FbiZpEEjs0ttzBi3JDNqLK4="
+      "integrity": "sha1-P7z7FbiZpEEjs0ttzBi3JDNqLK4=",
+      "dev": true
     },
     "p-is-promise": {
       "version": "3.0.0",
@@ -12101,14 +12021,6 @@
         "retry": "^0.12.0"
       }
     },
-    "p-timeout": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/p-timeout/-/p-timeout-2.0.1.tgz",
-      "integrity": "sha512-88em58dDVB/KzPEx1X0N3LwFfYZPyDc4B6eF38M1rk9VTZMbxXXgjugz8mmwpS9Ox4BDZ+t6t3QP5+/gazweIA==",
-      "requires": {
-        "p-finally": "^1.0.0"
-      }
-    },
     "p-try": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
@@ -12611,6 +12523,11 @@
         "path-parse": "^1.0.6"
       }
     },
+    "resolve-alpn": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-alpn/-/resolve-alpn-1.0.0.tgz",
+      "integrity": "sha512-rTuiIEqFmGxne4IovivKSDzld2lWW9QCjqv80SYjPgf+gS35eaCAjaP54CCwGAwBtnCsvNLYtqxe1Nw+i6JEmA=="
+    },
     "resolve-cwd": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/resolve-cwd/-/resolve-cwd-3.0.0.tgz",
@@ -12763,9 +12680,9 @@
       }
     },
     "semantic-release": {
-      "version": "17.0.4",
+      "version": "17.0.6",
-      "resolved": "https://registry.npmjs.org/semantic-release/-/semantic-release-17.0.4.tgz",
+      "resolved": "https://registry.npmjs.org/semantic-release/-/semantic-release-17.0.6.tgz",
-      "integrity": "sha512-5y9QRSrZtdvACmlpX5DvEVsvFuKRDUVn7JVJFxPVLGrGofDf1d0M/+hA1wFmCjiJZ+VCY8bYaSqVqF14KCF9rw==",
+      "integrity": "sha512-4djSoKUiq8ShAiKEzDKkcrzFyDREFJRMsY/efr/b48dcin2g+s4TsZUTniTg3Zvk+TM9G5rNBKyXfFgVO6wJNA==",
       "dev": true,
       "requires": {
         "@semantic-release/commit-analyzer": "^8.0.0",
@@ -12792,7 +12709,7 @@
         "p-reduce": "^2.0.0",
         "read-pkg-up": "^7.0.0",
         "resolve-from": "^5.0.0",
-        "semver": "^7.1.1",
+        "semver": "^7.3.2",
         "semver-diff": "^3.1.1",
         "signale": "^1.2.1",
         "yargs": "^15.0.1"
@@ -12808,9 +12725,9 @@
           }
         },
         "cross-spawn": {
-          "version": "7.0.1",
+          "version": "7.0.2",
-          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.1.tgz",
+          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.2.tgz",
-          "integrity": "sha512-u7v4o84SwFpD32Z8IIcPZ6z1/ie24O6RU3RbtL5Y316l3KuHVPx9ItBgWQ6VlfAFnRnTtMUrsQ9MUUTuEZjogg==",
+          "integrity": "sha512-PD6G8QG3S4FK/XCGFbEQrDqO2AnMMsy0meR7lerlIOHAAbkuavGU/pOqprrlvfTNjvowivTeBsjebAL0NSoMxw==",
           "dev": true,
           "requires": {
             "path-key": "^3.1.0",
@@ -12906,9 +12823,9 @@
           "dev": true
         },
         "semver": {
-          "version": "7.1.3",
+          "version": "7.3.2",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-7.1.3.tgz",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.2.tgz",
-          "integrity": "sha512-ekM0zfiA9SCBlsKa2X1hxyxiI4L3B6EbVJkkdgQXnSEEaHlGdvyodMruTiulSRWMMB4NeIuYNMC9rTKTz97GxA==",
+          "integrity": "sha512-OrOb32TeeambH6UrhtShmF7CRDqhL6/5XpPNp2DuRH6+9QLw/orhp72j87v8Qa1ScDkvrrBNpZcDejAirJmfXQ==",
           "dev": true
         },
         "shebang-command": {
@@ -13367,17 +13284,6 @@
         "strip-ansi": "^5.2.0"
       }
     },
-    "string-width": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-3.1.0.tgz",
-      "integrity": "sha512-vafcv6KjVZKSgz06oM/H6GDBrAtz8vdhQakGjFIvNrHA6y3HCF1CInLy+QLq8dTJPQ1b+KDUqDFctkdRW44e1w==",
-      "dev": true,
-      "requires": {
-        "emoji-regex": "^7.0.1",
-        "is-fullwidth-code-point": "^2.0.0",
-        "strip-ansi": "^5.1.0"
-      }
-    },
     "string_decoder": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
@@ -13622,11 +13528,6 @@
         }
       }
     },
-    "to-readable-stream": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/to-readable-stream/-/to-readable-stream-2.1.0.tgz",
-      "integrity": "sha512-o3Qa6DGg1CEXshSdvWNX2sN4QHqg03SPq7U6jPXRahlQdl5dK8oXjkU/2/sGrnOZKeGV1zLSO8qPwyKklPPE7w=="
-    },
     "to-regex": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/to-regex/-/to-regex-3.0.2.tgz",
@@ -13733,14 +13634,13 @@
       }
     },
     "uglify-js": {
-      "version": "3.8.1",
+      "version": "3.9.1",
-      "resolved": "https://registry.npmjs.org/uglify-js/-/uglify-js-3.8.1.tgz",
+      "resolved": "https://registry.npmjs.org/uglify-js/-/uglify-js-3.9.1.tgz",
-      "integrity": "sha512-W7KxyzeaQmZvUFbGj4+YFshhVrMBGSg2IbcYAjGWGvx8DHvJMclbTDMpffdxFUGPBHjIytk7KJUR/KUXstUGDw==",
+      "integrity": "sha512-JUPoL1jHsc9fOjVFHdQIhqEEJsQvfKDjlubcCilu8U26uZ73qOg8VsN8O1jbuei44ZPlwL7kmbAdM4tzaUvqnA==",
       "dev": true,
       "optional": true,
       "requires": {
-        "commander": "~2.20.3",
+        "commander": "~2.20.3"
-        "source-map": "~0.6.1"
       }
     },
     "union-value": {
@@ -13975,9 +13875,9 @@
       "dev": true
     },
     "windows-release": {
-      "version": "3.2.0",
+      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/windows-release/-/windows-release-3.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/windows-release/-/windows-release-3.3.0.tgz",
-      "integrity": "sha512-QTlz2hKLrdqukrsapKsINzqMgOUpQW268eJ0OaOpJN32h272waxR9fkB9VoWRtK7uKHG5EHJcTXQBD8XZVJkFA==",
+      "integrity": "sha512-2HetyTg1Y+R+rUgrKeUEhAG/ZuOmTrI1NBb3ZyAGQMYmOJjBBPe4MTodghRkmLJZHwkuPi02anbeGP+Zf401LQ==",
       "dev": true,
       "requires": {
         "execa": "^1.0.0"
@@ -13989,16 +13889,11 @@
       "integrity": "sha512-Hz/mrNwitNRh/HUAtM/VT/5VH+ygD6DV7mYKZAtHOrbs8U7lvPS6xf7EJKMF0uW1KJCl0H701g3ZGus+muE5vQ==",
       "dev": true
     },
-    "wrap-ansi": {
+    "wordwrap": {
-      "version": "5.1.0",
+      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-5.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/wordwrap/-/wordwrap-1.0.0.tgz",
-      "integrity": "sha512-QC1/iN/2/RPVJ5jYK8BGttj5z83LmSKmvbvrXPNCLZSEb32KKVDJDl/MOt2N01qU2H/FkzEa9PKto1BqDjtd7Q==",
+      "integrity": "sha1-J1hIEIkUVqQXHI0CJkQa3pDLyus=",
-      "dev": true,
+      "dev": true
-      "requires": {
-        "ansi-styles": "^3.2.0",
-        "string-width": "^3.0.0",
-        "strip-ansi": "^5.0.0"
-      }
     },
     "wrappy": {
       "version": "1.0.2",

package.json

@@ -4,24 +4,30 @@
     "description": "A Github Action that allows you to consume vault secrets as secure environment variables.",
     "main": "dist/index.js",
     "scripts": {
-        "build": "ncc build src/index.js -o dist",
+        "build": "ncc build src/entry.js -o dist",
         "test": "jest",
         "test:integration:basic": "jest -c integrationTests/basic/jest.config.js",
         "test:integration:enterprise": "jest -c integrationTests/enterprise/jest.config.js",
-        "test:e2e": "jest -c integrationTests/e2e/jest.config.js"
+        "test:e2e": "jest -c integrationTests/e2e/jest.config.js",
+        "test:e2e-tls": "jest -c integrationTests/e2e-tls/jest.config.js"
     },
+    "files": [
+        "src/**/*",
+        "dist/**/*"
+    ],
     "release": {
         "branch": "master",
         "plugins": [
             "@semantic-release/commit-analyzer",
             "@semantic-release/release-notes-generator",
-            "@semantic-release/github"
+            "@semantic-release/github",
+            "@semantic-release/npm"
         ],
         "ci": false
     },
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/RichiCoder1/vault-action.git"
+        "url": "git+https://github.com/hashicorp/vault-action.git"
     },
     "keywords": [
         "hashicorp",
@@ -31,17 +37,21 @@
         "github-actions",
         "javascript"
     ],
-    "author": "Richard Simpson <richardsimpson@outlook.com>",
+    "author": "HashiCorp",
     "license": "MIT",
     "bugs": {
-        "url": "https://github.com/RichiCoder1/vault-action/issues"
+        "url": "https://github.com/hashicorp/vault-action/issues"
     },
-    "homepage": "https://github.com/RichiCoder1/vault-action#readme",
+    "homepage": "https://github.com/hashicorp/vault-action#readme",
     "dependencies": {
-        "got": "^10.2.2",
+        "got": "^11.5.1",
-        "@actions/core": "^1.2.3"
+        "jsonata": "^1.8.2"
+    },
+    "peerDependencies": {
+        "@actions/core": ">=1 <2"
     },
     "devDependencies": {
+        "@actions/core": "^1.2.3",
         "@types/got": "^9.6.9",
         "@types/jest": "^25.1.3",
         "@zeit/ncc": "^0.22.0",

src/action.js

@@ -2,10 +2,10 @@
 const core = require('@actions/core');
 const command = require('@actions/core/lib/command');
 const got = require('got').default;
-const { retrieveToken } = require('./auth');
+const jsonata = require('jsonata');
+const { auth: { retrieveToken }, secrets: { getSecrets } } = require('./index');
 
 const AUTH_METHODS = ['approle', 'token', 'github'];
-const VALID_KV_VERSION = [-1, 1, 2];
 
 async function exportSecrets() {
     const vaultUrl = core.getInput('url', { required: true });
@@ -13,10 +13,6 @@ async function exportSecrets() {
     const extraHeaders = parseHeadersInput('extraHeaders', { required: false });
     const exportEnv = core.getInput('exportEnv', { required: false }) != 'false';
 
-    let enginePath = core.getInput('path', { required: false });
-    /** @type {number | string} */
-    let kvVersion = core.getInput('kv-version', { required: false });
-
     const secretsInput = core.getInput('secrets', { required: true });
     const secretRequests = parseSecretsInput(secretsInput);
 
@@ -28,7 +24,28 @@ async function exportSecrets() {
 
     const defaultOptions = {
         prefixUrl: vaultUrl,
-        headers: {}
+        headers: {},
+        https: {}
+    }
+
+    const tlsSkipVerify = (core.getInput('tlsSkipVerify', { required: false }) || 'false').toLowerCase() != 'false';
+    if (tlsSkipVerify === true) {
+        defaultOptions.https.rejectUnauthorized = false;
+    }
+
+    const caCertificateRaw = core.getInput('caCertificate', { required: false });
+    if (caCertificateRaw != null) {
+        defaultOptions.https.certificateAuthority = Buffer.from(caCertificateRaw, 'base64').toString();
+    }
+
+    const clientCertificateRaw = core.getInput('clientCertificate', { required: false });
+    if (clientCertificateRaw != null) {
+	    defaultOptions.https.certificate = Buffer.from(clientCertificateRaw, 'base64').toString();
+    }
+
+    const clientKeyRaw = core.getInput('clientKey', { required: false });
+    if (clientKeyRaw != null) {
+	    defaultOptions.https.key = Buffer.from(clientKeyRaw, 'base64').toString();
     }
 
     for (const [headerName, headerValue] of extraHeaders) {
@@ -39,78 +56,36 @@ async function exportSecrets() {
         defaultOptions.headers["X-Vault-Namespace"] = vaultNamespace;
     }
 
+    const vaultToken = await retrieveToken(vaultMethod, got.extend(defaultOptions));
+    defaultOptions.headers['X-Vault-Token'] = vaultToken;
     const client = got.extend(defaultOptions);
-    const vaultToken = await retrieveToken(vaultMethod, client);
 
-    if (!enginePath) {
+    const requests = secretRequests.map(request => {
-        enginePath = 'secret';
+        const { path, selector } = request;
-    }
+        return request;
+    });
 
-    if (!kvVersion) {
+    const results = await getSecrets(requests, client);
-        kvVersion = 2;
-    }
-    kvVersion = +kvVersion;
 
-    if (Number.isNaN(kvVersion) || !VALID_KV_VERSION.includes(kvVersion)) {
+    for (const result of results) {
-        throw Error(`You must provide a valid K/V version (${VALID_KV_VERSION.slice(1).join(', ')}). Input: "${kvVersion}"`);
+        const { value, request, cachedResponse } = result;
-    }
+        if (cachedResponse) {
-
-    const responseCache = new Map();
-    for (const secretRequest of secretRequests) {
-        const { secretPath, outputVarName, envVarName, secretSelector, isJSONPath } = secretRequest;
-        const requestOptions = {
-            headers: {
-                'X-Vault-Token': vaultToken
-            },
-        };
-
-        for (const [headerName, headerValue] of extraHeaders) {
-            requestOptions.headers[headerName] = headerValue;
-        }
-
-        if (vaultNamespace != null) {
-            requestOptions.headers["X-Vault-Namespace"] = vaultNamespace;
-        }
-
-        let requestPath = `v1`;
-        const kvRequest = !secretPath.startsWith('/')
-        if (!kvRequest) {
-            requestPath += secretPath;
-        } else {
-           requestPath += (kvVersion === 2)
-                    ? `/${enginePath}/data/${secretPath}`
-                    : `/${enginePath}/${secretPath}`;
-        }
-
-        let body;
-        if (responseCache.has(requestPath)) {
-            body = responseCache.get(requestPath);
             core.debug('ℹ using cached response');
-        } else {
+        }        
-            const result = await client.get(requestPath, requestOptions);
-            body = result.body;
-            responseCache.set(requestPath, body);
-        }
-
-        let dataDepth = isJSONPath === true ? 0 : kvRequest === false ? 1 : kvVersion;
-
-        const secretData = getResponseData(body, dataDepth);
-        const value = selectData(secretData, secretSelector, isJSONPath);
         command.issue('add-mask', value);
         if (exportEnv) {
-            core.exportVariable(envVarName, `${value}`);
+            core.exportVariable(request.envVarName, `${value}`);
         }
-        core.setOutput(outputVarName, `${value}`);
+        core.setOutput(request.outputVarName, `${value}`);
-        core.debug(`✔ ${secretPath} => outputs.${outputVarName}${exportEnv ? ` | env.${envVarName}` : ''}`);
+        core.debug(`✔ ${request.path} => outputs.${request.outputVarName}${exportEnv ? ` | env.${request.envVarName}` : ''}`);
     }
 };
 
 /** @typedef {Object} SecretRequest 
- * @property {string} secretPath
+ * @property {string} path
  * @property {string} envVarName
  * @property {string} outputVarName
- * @property {string} secretSelector
+ * @property {string} selector
- * @property {boolean} isJSONPath
 */
 
 /**
@@ -127,12 +102,12 @@ function parseSecretsInput(secretsInput) {
     /** @type {SecretRequest[]} */
     const output = [];
     for (const secret of secrets) {
-        let path = secret;
+        let pathSpec = secret;
         let outputVarName = null;
 
         const renameSigilIndex = secret.lastIndexOf('|');
         if (renameSigilIndex > -1) {
-            path = secret.substring(0, renameSigilIndex).trim();
+            pathSpec = secret.substring(0, renameSigilIndex).trim();
             outputVarName = secret.substring(renameSigilIndex + 1).trim();
 
             if (outputVarName.length < 1) {
@@ -140,7 +115,7 @@ function parseSecretsInput(secretsInput) {
             }
         }
 
-        const pathParts = path
+        const pathParts = pathSpec
             .split(/\s+/)
             .map(part => part.trim())
             .filter(part => part.length !== 0);
@@ -149,64 +124,43 @@ function parseSecretsInput(secretsInput) {
             throw Error(`You must provide a valid path and key. Input: "${secret}"`);
         }
 
-        const [secretPath, secretSelector] = pathParts;
+        const [path, selector] = pathParts;
 
-        const isJSONPath = secretSelector.includes('.');
+        /** @type {any} */
+        const selectorAst = jsonata(selector).ast();
 
-        if (isJSONPath && !outputVarName) {
+        if ((selectorAst.type !== "path" || selectorAst.steps[0].stages) && !outputVarName) {
             throw Error(`You must provide a name for the output key when using json selectors. Input: "${secret}"`);
         }
 
         let envVarName = outputVarName;
         if (!outputVarName) {
-            outputVarName = secretSelector;
+            outputVarName = normalizeOutputKey(selector);
-            envVarName = normalizeOutputKey(outputVarName);
+            envVarName = normalizeOutputKey(selector, true);
         }
 
         output.push({
-            secretPath,
+            path,
             envVarName,
             outputVarName,
-            secretSelector,
+            selector
-            isJSONPath
         });
     }
     return output;
 }
 
 /**
- * Parses a JSON response and returns the secret data
+ * Replaces any dot chars to __ and removes non-ascii charts
- * @param {string} responseBody
- * @param {number} dataLevel
- */
-function getResponseData(responseBody, dataLevel) {
-    let secretData = JSON.parse(responseBody);
-
-    for (let i = 0; i < dataLevel; i++) {
-        secretData = secretData['data'];
-    }
-    return secretData;
-}
-
-/**
- * Parses a JSON response and returns the secret data
- * @param {Object} data
- * @param {string} selector
- */
-function selectData(data, selector, isJSONPath) {
-    if (!isJSONPath) {
-        return data[selector];
-    }
-
-    // TODO: JSONPath
-}
-
-/**
- * Replaces any forward-slash characters to
  * @param {string} dataKey
+ * @param {boolean=} isEnvVar
  */
-function normalizeOutputKey(dataKey) {
+function normalizeOutputKey(dataKey, isEnvVar = false) {
-    return dataKey.replace('/', '__').replace(/[^\w-]/, '').toUpperCase();
+    let outputKey = dataKey
+        .replace('.', '__').replace(/[^\p{L}\p{N}_-]/gu, '');
+    if (isEnvVar) {
+        outputKey = outputKey.toUpperCase();
+    }
+    return outputKey;
 }
 
 /**
@@ -237,7 +191,6 @@ function parseHeadersInput(inputKey, inputOptions) {
 module.exports = {
     exportSecrets,
     parseSecretsInput,
-    parseResponse: getResponseData,
     normalizeOutputKey,
     parseHeadersInput
 };

src/action.test.js

@@ -17,11 +17,10 @@ describe('parseSecretsInput', () => {
     it('parses simple secret', () => {
         const output = parseSecretsInput('test key');
         expect(output).toContainEqual({
-            secretPath: 'test',
+            path: 'test',
-            secretSelector: 'key',
+            selector: 'key',
             outputVarName: 'key',
-            envVarName: 'KEY',
+            envVarName: 'KEY'
-            isJSONPath: false
         });
     });
 
@@ -49,10 +48,10 @@ describe('parseSecretsInput', () => {
 
         expect(output).toHaveLength(2);
         expect(output[0]).toMatchObject({
-            secretPath: 'first',
+            path: 'first',
         });
         expect(output[1]).toMatchObject({
-            secretPath: 'second',
+            path: 'second',
         });
     });
 
@@ -78,7 +77,7 @@ describe('parseSecretsInput', () => {
 
         expect(output).toHaveLength(3);
         expect(output[0]).toMatchObject({
-            secretPath: 'first',
+            path: 'first',
         });
         expect(output[1]).toMatchObject({
             outputVarName: 'b',
@@ -88,7 +87,7 @@ describe('parseSecretsInput', () => {
             outputVarName: 'SOME_C',
             envVarName: 'SOME_C',
         });
-    })
+    });
 });
 
 describe('parseHeaders', () => {
@@ -129,41 +128,8 @@ describe('parseHeaders', () => {
         const result = parseHeadersInput('extraHeaders');
         expect(Array.from(result)).toHaveLength(0);
     });
-})
-
-describe('parseResponse', () => {
-    // https://www.vaultproject.io/api/secret/kv/kv-v1.html#sample-response
-    it('parses K/V version 1 response', () => {
-        const response = JSON.stringify({
-            data: {
-                foo: 'bar'
-            }
-        })
-        const output = parseResponse(response, 1);
-
-        expect(output).toEqual({
-            foo: 'bar'
-        });
-    });
-
-    // https://www.vaultproject.io/api/secret/kv/kv-v2.html#read-secret-version
-    it('parses K/V version 2 response', () => {
-        const response = JSON.stringify({
-            data: {
-                data: {
-                    foo: 'bar'
-                }
-            }
-        })
-        const output = parseResponse(response, 2);
-
-        expect(output).toEqual({
-            foo: 'bar'
-        });
-    });
 });
 
-
 describe('exportSecrets', () => {
     beforeEach(() => {
         jest.resetAllMocks();
@@ -224,6 +190,18 @@ describe('exportSecrets', () => {
         expect(core.setOutput).toBeCalledWith('key', '1');
     });
 
+    it('intl secret retrieval', async () => {
+        mockInput('测试 测试');
+        mockVaultData({
+            测试: 1
+        });
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('测试', '1');
+        expect(core.setOutput).toBeCalledWith('测试', '1');
+    });
+
     it('mapped secret retrieval', async () => {
         mockInput('test key|TEST_NAME');
         mockVaultData({
@@ -267,4 +245,16 @@ describe('exportSecrets', () => {
         expect(core.exportVariable).toBeCalledWith('KEY', '1');
         expect(core.setOutput).toBeCalledWith('key', '1');
     });
+
+    it('nested secret retrieval', async () => {
+        mockInput('test key.value');
+        mockVaultData({
+            key: { value: 1 }
+        });
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('KEY__VALUE', '1');
+        expect(core.setOutput).toBeCalledWith('key__value', '1');
+    });
 });

src/entry.js

@@ -0,0 +1,10 @@
+const core = require('@actions/core');
+const { exportSecrets } = require('./action');
+
+(async () => {
+    try {
+        await core.group('Get Vault Secrets', exportSecrets);
+    } catch (error) {
+        core.setFailed(error.message);
+    }
+})();

src/index.js

@@ -1,10 +1,7 @@
-const core = require('@actions/core');
+const auth = require('./auth');
-const { exportSecrets } = require('./action');
+const secrets = require('./secrets');
 
-(async () => {
+module.exports = {
-    try {
+    auth,
-        await core.group('Get Vault Secrets', exportSecrets);
+    secrets
-    } catch (error) {
+};
-        core.setFailed(error.message);
-    }
-})();

src/secrets.js

@@ -0,0 +1,82 @@
+const jsonata = require("jsonata");
+
+
+/**
+ * @typedef {Object} SecretRequest
+ * @property {string} path
+ * @property {string} selector
+ */
+
+/**
+ * @template {SecretRequest} TRequest
+ * @typedef {Object} SecretResponse
+ * @property {TRequest} request
+ * @property {string} value
+ * @property {boolean} cachedResponse
+ */
+
+ /**
+  * @template TRequest
+  * @param {Array<TRequest>} secretRequests
+  * @param {import('got').Got} client
+  * @return {Promise<SecretResponse<TRequest>[]>}
+  */
+async function getSecrets(secretRequests, client) {
+    const responseCache = new Map();
+    const results = [];
+    for (const secretRequest of secretRequests) {
+        let { path, selector } = secretRequest;
+
+        const requestPath = `v1/${path}`;
+        let body;
+        let cachedResponse = false;
+        if (responseCache.has(requestPath)) {
+            body = responseCache.get(requestPath);
+            cachedResponse = true;
+        } else {
+            const result = await client.get(requestPath);
+            body = result.body;
+            responseCache.set(requestPath, body);
+        }
+
+        selector = "data." + selector
+        body = JSON.parse(body)
+        if (body.data["data"] != undefined) {
+            selector = "data." + selector
+        }
+
+        const value = selectData(body, selector);
+        results.push({
+            request: secretRequest,
+            value,
+            cachedResponse
+        });
+    }
+    return results;
+}
+
+/**
+ * Uses a Jsonata selector retrieve a bit of data from the result
+ * @param {object} data 
+ * @param {string} selector 
+ */
+function selectData(data, selector) {
+    const ata = jsonata(selector);
+    let result = JSON.stringify(ata.evaluate(data));
+    // Compat for custom engines
+    if (!result && ata.ast().type === "path" && ata.ast()['steps'].length === 1 && selector !== 'data' && 'data' in data) {
+        result = JSON.stringify(jsonata(`data.${selector}`).evaluate(data));
+    } else if (!result) {
+        throw Error(`Unable to retrieve result for ${selector}. No match data was found. Double check your Key or Selector.`);
+    }
+
+    if (result.startsWith(`"`)) {
+        result = result.substring(1, result.length - 1);
+    }
+    return result;
+}
+
+module.exports = {
+    getSecrets,
+    selectData
+}