Update action.yml

changelog++
Update doc for TLS (#103 )
2026-07-26 00:13:16 +03:00 · 2020-08-24 19:22:08 -04:00 · 2020-08-24 19:19:56 -04:00 · 2020-08-12 11:53:00 -04:00 · 2020-08-11 11:14:10 -04:00 · 2020-08-11 10:06:28 -04:00
43 changed files with 24017 additions and 2957 deletions
@@ -0,0 +1,23 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: "[BUG] "
+labels: bug
+assignees: RichiCoder1
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+The yaml of the `vault-action` step, with any sensitive information masked or removed.
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Log Output**
+For the most verbose logs, [add a secret called `ACTIONS_STEP_DEBUG` with the value `true`](https://github.com/actions/toolkit/blob/master/docs/action-debugging.md). Then, re-run the workflow if possible and post the *raw logs* for the step here with any sensitive information masked or removed.
+
+**Additional context**
+Add any other context about the problem here.
@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: "[FEAT] "
+labels: enhancement
+assignees: RichiCoder1
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.
@@ -1,88 +1,288 @@
-on: [push]
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master

 jobs:
-  test:
+  build:
    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v1

-    services:
-      vault:
-        image: vault:1.2.3
-        ports:
-          - 8200/tcp
-        env:
-          VAULT_DEV_ROOT_TOKEN_ID: testtoken
-        options: --cap-add=IPC_LOCK
+    - uses: actions/setup-node@v1
+      with:
+        node-version: ''
+
+    - name: Setup NPM Cache
+      uses: actions/cache@v1
+      with:
+        path: ~/.npm
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+
+    - name: NPM Install
+      run: npm ci
+
+    - name: NPM Build
+      run: npm run build
+
+    - name: NPM Run Test
+      run: npm run test
+
+  integrationOSS:
+    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v1
-    - name: Use Node.js 10.x
-      uses: actions/setup-node@v1
+
+    - name: Run docker-compose
+      run: docker-compose up -d vault
+
+    - uses: actions/setup-node@v1
      with:
-        node-version: 10.x
-    - name: npm install
+        node-version: ''
+
+    - name: Setup NPM Cache
+      uses: actions/cache@v1
+      with:
+        path: ~/.npm
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+
+    - name: NPM Install
      run: npm ci
-    - name: npm run test
-      run: npm run test
-      env:
-        CI: true
-    - name: npm run test:integration
-      run: npm run test:integration
+
+    - name: NPM Build
+      run: npm run build
+
+    - name: NPM Run test;integration:basic
+      run: npm run test:integration:basic
      env:
        VAULT_HOST: localhost
-        VAULT_PORT: ${{ job.services.vault.ports[8200] }}
+        VAULT_PORT: 8200
+        CI: true
+
+  integrationEnterprise:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v1
+
+    - name: Run docker-compose
+      run: docker-compose up -d vault-enterprise
+
+    - uses: actions/setup-node@v1
+      with:
+        node-version: ''
+
+    - name: Setup NPM Cache
+      uses: actions/cache@v1
+      with:
+        path: ~/.npm
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+
+    - name: NPM Install
+      run: npm ci
+
+    - name: NPM Build
+      run: npm run build
+
+    - name: NPM Run test:intergration:enterprise
+      run: npm run test:integration:enterprise
+      env:
+        VAULT_HOST: localhost
+        VAULT_PORT: 8200
        CI: true

  e2e:
    runs-on: ubuntu-latest

-    services:
-      vault:
-        image: vault:1.2.3
-        ports:
-          - 8200/tcp
-        env:
-          VAULT_DEV_ROOT_TOKEN_ID: testtoken
-        options: --cap-add=IPC_LOCK
-
    steps:
    - uses: actions/checkout@v1
-    - name: Use Node.js 10.x
-      uses: actions/setup-node@v1
+
+    - name: Run docker-compose
+      run: docker-compose up -d vault
+
+    - uses: actions/setup-node@v1
      with:
-        node-version: 10.x
-    - name: npm install
+        node-version: ''
+
+    - name: Setup NPM Cache
+      uses: actions/cache@v1
+      with:
+        path: ~/.npm
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+
+    - name: NPM Install
      run: npm ci
-    - name: setup vault
-      run: node ./e2e/setup.js
+
+    - name: NPM Build
+      run: npm run build
+
+    - name: Setup Vault
+      run: node ./integrationTests/e2e/setup.js
      env:
        VAULT_HOST: localhost
-        VAULT_PORT: ${{ job.services.vault.ports[8200] }}
-    - name: use vault action
+        VAULT_PORT: 8200
+
+    - name: Test Vault Action (default KV V2)
      uses: ./
+      id: kv-secrets
      with:
-        url: http://localhost:${{ job.services.vault.ports[8200] }}
+        url: http://localhost:8200
        token: testtoken
        secrets: |
-          test secret ;
-          test secret | NAMED_SECRET ;
-          nested/test otherSecret ;
-    - name: verify
-      run: npm run test:e2e
+          secret/data/test secret ;
+          secret/data/test secret | NAMED_SECRET ;
+          secret/data/nested/test otherSecret ;

-  publish:
+    - name: Test Vault Action (default KV V1)
+      uses: ./
+      with:
+        url: http://localhost:8200
+        token: testtoken
+        secrets: |
+          my-secret/test altSecret ;
+          my-secret/test altSecret | NAMED_ALTSECRET ;
+          my-secret/nested/test otherAltSecret ;
+
+    - name: Test Vault Action (cubbyhole)
+      uses: ./
+      with:
+        url: http://localhost:8200
+        token: testtoken
+        secrets: |
+          /cubbyhole/test foo ;
+          /cubbyhole/test zip | NAMED_CUBBYSECRET ;
+
+    - name: Verify Vault Action Outputs
+      run: npm run test:e2e
+      env:
+        OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
+
+  e2e-tls:
    runs-on: ubuntu-latest
-    needs: [test, e2e]
+
    steps:
    - uses: actions/checkout@v1
-    - name: Use Node.js 10.x
-      uses: actions/setup-node@v1
-      with:
-        node-version: 10.x
-    - name: npm install
-      run: npm ci
-    - name: release
-      if: success() && endsWith(github.ref, 'master')
-      run: npx semantic-release
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Run docker-compose
+      run: docker-compose up -d vault-tls
+
+    - uses: actions/setup-node@v1
+      with:
+        node-version: ''
+
+    - name: Setup NPM Cache
+      uses: actions/cache@v1
+      with:
+        path: ~/.npm
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+
+    - name: NPM Install
+      run: npm ci
+
+    - name: NPM Build
+      run: npm run build
+
+    - name: Setup Vault
+      run: node ./integrationTests/e2e-tls/setup.js
+      env:
+        VAULT_HOST: localhost
+        VAULT_PORT: 8200
+        VAULTCA: ${{ secrets.VAULTCA }}
+        VAULT_CLIENT_CERT: ${{ secrets.VAULT_CLIENT_CERT }}
+        VAULT_CLIENT_KEY: ${{ secrets.VAULT_CLIENT_KEY }}
+
+    - name: Test Vault Action (default KV V2)
+      uses: ./
+      id: kv-secrets
+      with:
+        url: https://localhost:8200
+        token: ${{ env.VAULT_TOKEN }}
+        caCertificate: ${{ secrets.VAULTCA }}
+        clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
+        clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
+        secrets: |
+          secret/data/test secret ;
+          secret/data/test secret | NAMED_SECRET ;
+          secret/data/nested/test otherSecret ;
+
+    - name: Test Vault Action (tlsSkipVerify)
+      uses: ./
+      with:
+        url: https://localhost:8200
+        token: ${{ env.VAULT_TOKEN }}
+        tlsSkipVerify: true
+        clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
+        clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
+        secrets: |
+          secret/data/tlsSkipVerify skip ;
+
+    - name: Test Vault Action (default KV V1)
+      uses: ./
+      with:
+        url: https://localhost:8200
+        token: ${{ env.VAULT_TOKEN }}
+        caCertificate: ${{ secrets.VAULTCA }}
+        clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
+        clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
+        secrets: |
+          my-secret/test altSecret ;
+          my-secret/test altSecret | NAMED_ALTSECRET ;
+          my-secret/nested/test otherAltSecret ;
+
+    - name: Test Vault Action (cubbyhole)
+      uses: ./
+      with:
+        url: https://localhost:8200
+        token: ${{ env.VAULT_TOKEN }}
+        secrets: |
+          /cubbyhole/test foo ;
+          /cubbyhole/test zip | NAMED_CUBBYSECRET ;
+        caCertificate: ${{ secrets.VAULTCA }}
+        clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
+        clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
+
+    - name: Verify Vault Action Outputs
+      run: npm run test:e2e-tls
+      env:
+        OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
+
+# Removing publish step for now.
+#  publish:
+#    if: github.event_name	== 'push' && contains(github.ref, 'master')
+#    runs-on: ubuntu-latest
+#    needs: [build, integration, e2e]
+#    steps:
+#    - uses: actions/checkout@v1
+#    - uses: actions/setup-node@v1
+#      with:
+#        node-version: ''
+#    - name: setup npm cache
+#      uses: actions/cache@v1
+#      with:
+#        path: ~/.npm
+#        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+#        restore-keys: |
+#          ${{ runner.os }}-node-
+#    - name: npm install
+#      run: npm ci
+#    - name: release
+#      if: success() && endsWith(github.ref, 'master')
+#      run: npx semantic-release
+#      env:
+#        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+#        NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

@@ -0,0 +1,35 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "type": "node",
+            "name": "vscode-jest-tests",
+            "request": "launch",
+            "args": [
+                "--runInBand"
+            ],
+            "cwd": "${workspaceFolder}",
+            "console": "integratedTerminal",
+            "internalConsoleOptions": "neverOpen",
+            "disableOptimisticBPs": true,
+            "program": "${workspaceFolder}/node_modules/jest/bin/jest"
+        },        
+        {
+            "type": "node",
+            "name": "vscode-integration-tests",
+            "request": "launch",
+            "args": [
+                "--runInBand",
+                "--config=${workspaceFolder}/integrationTests/basic/jest.config.js"
+            ],
+            "cwd": "${workspaceFolder}",
+            "console": "integratedTerminal",
+            "internalConsoleOptions": "neverOpen",
+            "disableOptimisticBPs": true,
+            "program": "${workspaceFolder}/node_modules/jest/bin/jest"
+        }
+    ]
+}
@@ -0,0 +1,3 @@
+{
+    "markdown-toc.depthFrom": 2
+}
@@ -0,0 +1,13 @@
+## Unreleased
+
+## 2.0.0 (August 24th, 2020)
+
+Features:
+
+* Added TLS and mTLS support [GH-97](https://github.com/hashicorp/vault-action/pull/97)
+
+Improvements:
+
+* Breaking change: removed KV specific parameters and generalized secret UX [GH-102](https://github.com/hashicorp/vault-action/pull/102)
+
+Bugs:
@@ -1,6 +1,31 @@
-# vault-action
+# Vault GitHub Action

-A helper action for easily pulling secrets from the v2 K/V backend of vault.
+---
+
+**Please note**: We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault or this Vault Action, _please responsibly disclose_ by contacting us at [security@hashicorp.com](mailto:security@hashicorp.com).
+
+---
+
+A helper action for easily pulling secrets from HashiCorp Vault™.
+
+<!-- TOC -->
+
+- [Example Usage](#example-usage)
+- [Authentication method](#authentication-method)
+- [Key Syntax](#key-syntax)
+    - [Simple Key](#simple-key)
+    - [Set Output Variable Name](#set-output-variable-name)
+    - [Multiple Secrets](#multiple-secrets)
+    - [Nested Secrets](#nested-secrets)
+- [Other Secret Engines](#other-secret-engines)
+- [Adding Extra Headers](#adding-extra-headers)
+- [Vault Enterprise Features](#vault-enterprise-features)
+    - [Namespace](#namespace)
+- [Reference](#reference)
+- [Masking - Hiding Secrets from Logs](#masking---hiding-secrets-from-logs)
+- [Normalization](#normalization)
+
+<!-- /TOC -->

 ## Example Usage

@@ -11,49 +36,99 @@ jobs:
        steps:
            # ...
            - name: Import Secrets
-              uses: RichiCoder1/vault-action
+              uses: hashicorp/vault-action
              with:
                url: https://vault.mycompany.com:8200
                token: ${{ secrets.VaultToken }}
+                caCertificate: ${{ secrets.VAULTCA }}
                secrets: |
-                    ci/aws accessKey | AWS_ACCESS_KEY_ID ;
-                    ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
-                    ci npm_token
+                    secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
+                    secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
+                    secret/data/ci npm_token
            # ...
 ```

+## Authentication method
+
+While most workflows will likely use a vault token, you can also use an `approle` to authenticate with Vault. You can configure which by using the `method` parameter:
+
+- **token**: (by default) you must provide a `token` parameter
+```yaml
+...
+with:
+  url: https://vault.mycompany.com:8200
+  token: ${{ secrets.VaultToken }}
+  caCertificate: ${{ secrets.VAULTCA }}
+```
+- **approle**: you must provide a `roleId` & `secretId` parameter
+```yaml
+...
+with:
+  url: https://vault.mycompany.com:8200
+  method: approle
+  roleId: ${{ secrets.roleId }}
+  secretId: ${{ secrets.secretId }}
+  caCertificate: ${{ secrets.VAULTCA }}
+```
+- **github**: you must provide the github token as `githubToken`
+```yaml
+...
+with:
+  url: https://vault.mycompany.com:8200
+  method: github
+  githubToken: ${{ secrets.GITHUB_TOKEN }}
+  caCertificate: ${{ secrets.VAULTCA }}
+```
+
+If any other method is specified and you provide an `authPayload`, the action will attempt to `POST` to `auth/${method}/login` with the provided payload and parse out the client token.
+
 ## Key Syntax

 The `secrets` parameter is a set of multiple secret requests separated by the `;` character.

-Each secret request is comprised of the `path` and the `key` of the desired secret, and optionally the desired Env Var output name.
+Each secret request consists of the `path` and the `key` of the desired secret, and optionally the desired Env Var output name.

 ```raw
-{{ Secret Path }} {{ Secret Key }} | {{ Output Environment Variable Name }}
+{{ Secret Path }} {{ Secret Key or Selector }} | {{ Env/Output Variable Name }}
 ```

 ### Simple Key

-To retrieve a key `npmToken` from path `ci` that has value `somelongtoken` from vault you could do:
+To retrieve a key `npmToken` from path `secret/data/ci` that has value `somelongtoken` from vault you could do:

 ```yaml
 with:
-    secrets: ci npmToken
+    secrets: secret/data/ci npmToken
 ```

-`vault-action` will automatically normalize the given data key, and output:
+`vault-action` will automatically normalize the given secret selector key, and set the follow as environment variables for the following steps in the current job:

 ```bash
 NPMTOKEN=somelongtoken
 ```

-### Set Environment Variable Name
+You can also access the secret via outputs:

-However, if you want to set it to a specific environmental variable, say `NPM_TOKEN`, you could do this instead:
+```yaml
+steps:
+    # ...
+    - name: Import Secrets
+      id: secrets
+      # Import config...
+    - name: Sensitive Operation
+      run: "my-cli --token '${{ steps.secrets.outputs.npmToken }}'"
+
+```
+
+_**Note:** If you'd like to only use outputs and disable automatic environment variables, you can set the `exportEnv` option to `false`._
+
+### Set Output Variable Name
+
+However, if you want to set it to a specific name, say `NPM_TOKEN`, you could do this instead:

 ```yaml
 with:
-    secrets: ci npmToken | NPM_TOKEN
+    secrets: secret/data/ci npmToken | NPM_TOKEN
 ```

 With that, `vault-action` will now use your requested name and output:
@@ -62,17 +137,129 @@ With that, `vault-action` will now use your requested name and output:
 NPM_TOKEN=somelongtoken
 ```

+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.NPM_TOKEN }}'"
+
+```
+
 ### Multiple Secrets

 This action can take multi-line input, so say you had your AWS keys stored in a path and wanted to retrieve both of them. You can do:

 ```yaml
 with:
-    keys: |
-        ci/aws accessKey | AWS_ACCESS_KEY_ID ;
-        ci/aws secretKey | AWS_SECRET_ACCESS_KEY
+    secrets: |
+        secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
+        secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY
 ```

-## Masking
+## Other Secret Engines

-This action uses Github Action's built in masking, so all variables will automatically be masked if printed to the console or to logs.
+Vault Action currently supports retrieving secrets from any engine where secrets 
+are retrieved via `GET` requests.  This means secret engines such as PKI are currently 
+not supported due to their requirement of sending parameters along with the request 
+(such as `common_name`).
+
+For example, to request a secret from the `cubbyhole` secret engine:
+
+```yaml
+with:
+    secrets: |
+        /cubbyhole/foo foo ;
+        /cubbyhole/foo zip | MY_KEY ;
+```
+
+Resulting in:
+
+```bash
+FOO=bar
+MY_KEY=zap
+```
+
+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.foo }}'"
+  - name: Another Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.MY_KEY }}'"
+```
+
+## Adding Extra Headers
+
+If you ever need to add extra headers to the vault request, say if you need to authenticate with a firewall, all you need to do is set `extraHeaders`:
+
+```yaml
+with:
+    secrets: |
+        secret/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
+        secret/ci/aws secretKey | AWS_SECRET_ACCESS_KEY
+    extraHeaders: |
+      X-Secure-Id: ${{ secrets.SECURE_ID }}
+      X-Secure-Secret: ${{ secrets.SECURE_SECRET }}
+```
+
+This will automatically add the `x-secure-id` and `x-secure-secret` headers to every request to Vault.
+
+## Vault Enterprise Features
+
+### Namespace
+
+If you need to retrieve secrets from a specific Vault namespace, all that's required is an additional parameter specifying the namespace.
+
+```yaml
+steps:
+    # ...
+    - name: Import Secrets
+      uses: hashicorp/vault-action
+      with:
+        url: https://vault-enterprise.mycompany.com:8200
+        method: token
+        caCertificate: ${{ secrets.VAULTCA }}
+        token: ${{ secrets.VaultToken }}
+        namespace: ns1
+        secrets: |
+            secret/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
+            secret/ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
+            secret/ci npm_token
+```
+
+## Reference
+
+Here are all the inputs available through `with`:
+
+| Input               | Description                                                                                                                                          | Default | Required |
+| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | -------- |
+| `url`               | The URL for the vault endpoint                                                                                                                       |         | ✔        |
+| `secrets`           | A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details |         | ✔        |
+| `namespace`         | The Vault namespace from which to query secrets. Vault Enterprise only, unset by default                                                             |         |          |
+| `method`            | The method to use to authenticate with Vault.                                                                                                        | `token` |          |
+| `token`             | The Vault Token to be used to authenticate with Vault                                                                                                |         |          |
+| `roleId`            | The Role Id for App Role authentication                                                                                                              |         |          |
+| `secretId`          | The Secret Id for App Role authentication                                                                                                            |         |          |
+| `githubToken`       | The Github Token to be used to authenticate with Vault                                                                                               |         |          |
+| `authPayload`       | The JSON payload to be sent to Vault when using a custom authentication method.                                                                      |         |          |
+| `extraHeaders`      | A string of newline separated extra headers to include on every request.                                                                             |         |          |
+| `exportEnv`         | Whether or not export secrets as environment variables.                                                                                              | `true`  |          |
+| `caCertificate`     | Base64 encoded CA certificate the server certificate was signed with.                                                                                |         |          |
+| `clientCertificate` | Base64 encoded client certificate the action uses to authenticate with Vault when mTLS is enabled.                                                   |         |          |
+| `clientKey`         | Base64 encoded client key the action uses to authenticate with Vault when mTLS is enabled.                                                           |         |          |
+| `tlsSkipVerify`     | When set to true, disables verification of server certificates when testing the action.                                                              | `false` |          | 
+
+## Masking - Hiding Secrets from Logs
+
+This action uses GitHub Action's built-in masking, so all variables will automatically be masked (aka hidden) if printed to the console or to logs.
+**This only obscures secrets from output logs.** If someone has the ability to edit your workflows, then they are able to read and therefore write secrets to somewhere else just like normal GitHub Secrets.
+
+## Normalization
+
+To make it simpler to consume certain secrets as env vars, if no Env/Output Var Name is specified `vault-action` will replace and `.` chars with `__`, remove any other non-letter or number characters. If you're concerned about the result, it's recommended to provide an explicit Output Var Key.
@@ -1,94 +0,0 @@
-const core = require('@actions/core');
-const command = require('@actions/core/lib/command');
-const got = require('got');
-
-async function exportSecrets() {
-    const vaultUrl = core.getInput('url', { required: true });
-    const vaultToken = core.getInput('token', { required: true });
-
-    const secretsInput = core.getInput('secrets', { required: true });
-    const secrets = parseSecretsInput(secretsInput);
-
-    for (const secret of secrets) {
-        const { secretPath, outputName, secretKey } = secret;
-        const result = await got(`${vaultUrl}/v1/secret/data/${secretPath}`, {
-            headers: {
-                'X-Vault-Token': vaultToken
-            }
-        });
-
-        const parsedResponse = JSON.parse(result.body);
-        const vaultKeyData = parsedResponse.data;
-        const versionData = vaultKeyData.data;
-        const value = versionData[secretKey];
-        command.issue('add-mask', value);
-        core.exportVariable(outputName, `${value}`);
-        core.debug(`✔ ${secretPath} => ${outputName}`);
-    }
-};
-
-/**
- * Parses a secrets input string into key paths and their resulting environment variable name.
- * @param {string} secretsInput 
- */
-function parseSecretsInput(secretsInput) {
-    const secrets = secretsInput
-        .split(';')
-        .filter(key => !!key)
-        .map(key => key.trim())
-        .filter(key => key.length !== 0);
-
-    /** @type {{ secretPath: string; outputName: string; dataKey: string; }[]} */
-    const output = [];
-    for (const secret of secrets) {
-        let path = secret;
-        let outputName = null;
-
-        const renameSigilIndex = secret.lastIndexOf('|');
-        if (renameSigilIndex > -1) {
-            path = secret.substring(0, renameSigilIndex).trim();
-            outputName = secret.substring(renameSigilIndex + 1).trim();
-
-            if (outputName.length < 1) {
-                throw Error(`You must provide a value when mapping a secret to a name. Input: "${secret}"`);
-            }
-        }
-
-        const pathParts = path
-            .split(/\s+/)
-            .map(part => part.trim())
-            .filter(part => part.length !== 0);
-
-        if (pathParts.length !== 2) {
-            throw Error(`You must provide a valid path and key. Input: "${secret}"`)
-        }
-
-        const [secretPath, secretKey] = pathParts;
-
-        // If we're not using a mapped name, normalize the key path into a variable name.
-        if (!outputName) {
-            outputName = normalizeOutputKey(secretKey);
-        }
-
-        output.push({
-            secretPath,
-            outputName,
-            secretKey
-        });
-    }
-    return output;
-}
-
-/**
- * Replaces any forward-slash characters to 
- * @param {string} dataKey
- */
-function normalizeOutputKey(dataKey) {
-    return dataKey.replace('/', '__').replace(/[^\w-]/, '').toUpperCase();
-}
-
-module.exports = {
-    exportSecrets,
-    parseSecretsInput,
-    normalizeOutputKey
-};
@@ -1,136 +0,0 @@
-jest.mock('got');
-jest.mock('@actions/core');
-jest.mock('@actions/core/lib/command');
-
-const core = require('@actions/core');
-const got = require('got');
-const {
-    exportSecrets,
-    parseSecretsInput,
-} = require('./action');
-
-const { when } = require('jest-when');
-
-describe('parseSecretsInput', () => {
-    it('parses simple secret', () => {
-        const output = parseSecretsInput('test key');
-        expect(output).toContainEqual({
-            secretPath: 'test',
-            secretKey: 'key',
-            outputName: 'KEY',
-        });
-    });
-
-    it('parses mapped secret', () => {
-        const output = parseSecretsInput('test key|testName');
-        expect(output).toHaveLength(1);
-        expect(output[0]).toMatchObject({
-            outputName: 'testName',
-        });
-    });
-
-    it('fails on invalid mapped name', () => {
-        expect(() => parseSecretsInput('test key|'))
-            .toThrowError(`You must provide a value when mapping a secret to a name. Input: "test key|"`)
-    });
-
-    it('fails on invalid path for mapped', () => {
-        expect(() => parseSecretsInput('|testName'))
-            .toThrowError(`You must provide a valid path and key. Input: "|testName"`)
-    });
-
-    it('parses multiple secrets', () => {
-        const output = parseSecretsInput('first a;second b;');
-
-        expect(output).toHaveLength(2);
-        expect(output[0]).toMatchObject({
-            secretPath: 'first',
-        });
-        expect(output[1]).toMatchObject({
-            secretPath: 'second',
-        });
-    });
-
-    it('parses multiple complex secret input', () => {
-        const output = parseSecretsInput('first a;second b|secondName');
-
-        expect(output).toHaveLength(2);
-        expect(output[0]).toMatchObject({
-            outputName: 'A',
-        });
-        expect(output[1]).toMatchObject({
-            outputName: 'secondName',
-        });
-    });
-
-    it('parses multiline input', () => {
-        const output = parseSecretsInput(`
-        first a;
-        second b;
-        third c | SOME_C;`);
-
-        expect(output).toHaveLength(3);
-        expect(output[0]).toMatchObject({
-            secretPath: 'first',
-        });
-        expect(output[1]).toMatchObject({
-            outputName: 'B',
-        });
-        expect(output[2]).toMatchObject({
-            outputName: 'SOME_C',
-        });
-    })
-});
-
-
-describe('exportSecrets', () => {
-    beforeEach(() => {
-        jest.resetAllMocks();
-
-        when(core.getInput)
-            .calledWith('url')
-            .mockReturnValue('http://vault:8200');
-
-        when(core.getInput)
-            .calledWith('token')
-            .mockReturnValue('EXAMPLE');
-    });
-
-    function mockInput(key) {
-        when(core.getInput)
-            .calledWith('secrets')
-            .mockReturnValue(key);
-    }
-
-    function mockVaultData(data) {
-        got.mockResolvedValue({
-            body: JSON.stringify({
-                data: {
-                    data
-                }
-            })
-        });
-    }
-
-    it('simple secret retrieval', async () => {
-        mockInput('test key');
-        mockVaultData({
-            key: 1
-        });
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledWith('KEY', '1');
-    });
-
-    it('mapped secret retrieval', async () => {
-        mockInput('test key|TEST_NAME');
-        mockVaultData({
-            key: 1
-        });
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledWith('TEST_NAME', '1');
-    });
-});
@@ -1,18 +1,57 @@
 name: 'Vault Secrets'
-description: 'A Github Action that allows you to consume the v2 K/V backend of HashiCorp Vault as secure environment variables'
+description: 'A Github Action that allows you to consume HashiCorp Vault™ secrets as secure environment variables'
 inputs:
  url:
    description: 'The URL for the vault endpoint'
    required: true
-  token:
-    description: 'The Vault Token to be used to authenticate with Vault'
-    required: true
  secrets:
    description: 'A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details'
    required: true
+  namespace:
+    description: 'The Vault namespace from which to query secrets. Vault Enterprise only, unset by default'
+    required: false
+  method:
+    description: 'The method to use to authenticate with Vault.'
+    default: 'token'
+    required: false
+  token:
+    description: 'The Vault Token to be used to authenticate with Vault'
+    required: false
+  roleId:
+    description: 'The Role Id for App Role authentication'
+    required: false
+  secretId:
+    description: 'The Secret Id for App Role authentication'
+    required: false
+  githubToken:
+    description: 'The Github Token to be used to authenticate with Vault'
+    required: false
+  authPayload:
+    description: 'The JSON payload to be sent to Vault when using a custom authentication method.'
+    required: false
+  extraHeaders:
+    description: 'A string of newline separated extra headers to include on every request.'
+    required: false
+  exportEnv:
+    description: 'Whether or not export secrets as environment variables.'
+    default: 'true'
+    required: false
+  caCertificate:
+    description: 'Base64 encoded CA certificate to verify the Vault server certificate.'
+    required: false
+  clientCertificate:
+    description: 'Base64 encoded client certificate for mTLS communication with the Vault server.'
+    required: false
+  clientKey:
+    description: 'Base64 encoded client key for mTLS communication with the Vault server.'
+    required: false
+  tlsSkipVerify:
+    description: 'When set to true, disables verification of the Vault server certificate.  Setting this to true in production is not recommended.'
+    required: false
+    default: "false"
 runs:
  using: 'node12'
-  main: 'index.js'
+  main: 'dist/index.js'
 branding:
  icon: 'unlock'
-  color: 'gray-dark'
+  color: 'gray-dark'
@@ -0,0 +1,32 @@
+# Start vault server locally for the purposes of integration tests.
+version: "3.0"
+services:
+  vault:
+    image: vault:latest
+    environment:
+      VAULT_DEV_ROOT_TOKEN_ID: testtoken
+    ports:
+      - 8200:8200
+    privileged: true
+  vault-enterprise:
+    image: hashicorp/vault-enterprise:latest
+    environment:
+      VAULT_DEV_ROOT_TOKEN_ID: testtoken
+    ports:
+      - 8200:8200
+    privileged: true
+  vault-tls:
+    image: vault:latest
+    hostname: vault-tls
+    environment:
+      VAULT_CAPATH: /etc/vault/ca.crt
+    ports:
+    - 8200:8200
+    privileged: true
+    volumes:
+    - ${PWD}/integrationTests/e2e-tls/configs:/etc/vault
+    - vault-data:/var/lib/vault:rw
+    entrypoint: vault server -config=/etc/vault/config.hcl
+
+volumes:
+  vault-data:
@@ -1,7 +0,0 @@
-describe('e2e', () => {
-    it('verify', () => {
-        expect(process.env.SECRET).toBe("SUPERSECRET");
-        expect(process.env.NAMED_SECRET).toBe("SUPERSECRET");
-        expect(process.env.OTHERSECRET).toBe("OTHERSUPERSECRET");
-    });
-});
@@ -1,41 +0,0 @@
-const got = require('got');
-
-(async () => {
-    try {
-        // Verify Connection
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/config`, {
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-        });
-
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/test`, {
-            method: 'POST',
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-            body: {
-                data: {
-                    secret: "SUPERSECRET",
-                },
-            },
-            json: true,
-        });
-
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/nested/test`, {
-            method: 'POST',
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-            body: {
-                data: {
-                    otherSecret: "OTHERSUPERSECRET",
-                },
-            },
-            json: true,
-        });
-    } catch (error) {
-        console.log(error);
-        process.exit(1);
-    }
-})();
@@ -1,103 +0,0 @@
-jest.mock('@actions/core');
-jest.mock('@actions/core/lib/command');
-const core = require('@actions/core');
-
-const got = require('got');
-const { when } = require('jest-when');
-
-const { exportSecrets } = require('../action');
-
-describe('integration', () => {
-
-    beforeAll(async () => {
-        // Verify Connection
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/config`, {
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-        });
-
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/test`, {
-            method: 'POST',
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-            body: {
-                data: {
-                    secret: "SUPERSECRET",
-                },
-            },
-            json: true,
-        });
-
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/nested/test`, {
-            method: 'POST',
-            headers: {
-                'X-Vault-Token': 'testtoken',
-            },
-            body: {
-                data: {
-                    otherSecret: "OTHERSUPERSECRET",
-                },
-            },
-            json: true,
-        });
-    })
-
-    beforeEach(() => {
-        jest.resetAllMocks();
-
-        when(core.getInput)
-            .calledWith('url')
-            .mockReturnValue(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`);
-
-        when(core.getInput)
-            .calledWith('token')
-            .mockReturnValue('testtoken');
-    });
-
-    function mockInput(secrets) {
-        when(core.getInput)
-            .calledWith('secrets')
-            .mockReturnValue(secrets);
-    }
-
-    it('get simple secret', async () => {
-        mockInput('test secret')
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
-    });
-
-    it('re-map secret', async () => {
-        mockInput('test secret | TEST_KEY')
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledWith('TEST_KEY', 'SUPERSECRET');
-    });
-
-    it('get nested secret', async () => {
-        mockInput('nested/test otherSecret')
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
-    });
-
-    it('get multiple secrets', async () => {
-        mockInput(`
-        test secret ;
-        test secret | NAMED_SECRET ;
-        nested/test otherSecret ;`);
-
-        await exportSecrets();
-
-        expect(core.exportVariable).toBeCalledTimes(3);
-
-        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
-        expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET');
-        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
-    });
-});
@@ -0,0 +1,232 @@
+jest.mock('@actions/core');
+jest.mock('@actions/core/lib/command');
+const core = require('@actions/core');
+
+const got = require('got');
+const { when } = require('jest-when');
+
+const { exportSecrets } = require('../../src/action');
+
+const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8200'}`;
+
+describe('integration', () => {
+    beforeAll(async () => {
+        // Verify Connection
+        await got(`${vaultUrl}/v1/secret/config`, {
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+        });
+
+        await got(`${vaultUrl}/v1/secret/data/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    secret: 'SUPERSECRET',
+                },
+            },
+        });
+
+        await got(`${vaultUrl}/v1/secret/data/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    otherSecret: 'OTHERSUPERSECRET',
+                },
+            }
+        });
+
+        await got(`${vaultUrl}/v1/secret/data/foobar`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    fookv2: 'bar',
+                },
+            }
+        });
+
+        // Enable custom secret engine
+        try {
+            await got(`${vaultUrl}/v1/sys/mounts/secret-kv1`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+                json: {
+                    type: 'kv'
+                }
+            });
+        } catch (error) {
+            const {response} = error;
+            if (response.statusCode === 400 && response.body.includes("path is already in use")) {
+                // Engine might already be enabled from previous test runs
+            } else {
+                throw error;
+            }
+        }
+
+        await got(`${vaultUrl}/v1/secret-kv1/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                secret: 'CUSTOMSECRET',
+            }
+        });
+
+        await got(`${vaultUrl}/v1/secret-kv1/foobar`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                fookv1: 'bar',
+            }
+        });
+
+        await got(`${vaultUrl}/v1/secret-kv1/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                otherSecret: 'OTHERCUSTOMSECRET',
+            },
+        });
+    });
+
+    beforeEach(() => {
+        jest.resetAllMocks();
+
+        when(core.getInput)
+            .calledWith('url')
+            .mockReturnValueOnce(`${vaultUrl}`);
+
+        when(core.getInput)
+            .calledWith('token')
+            .mockReturnValueOnce('testtoken');
+    });
+
+    function mockInput(secrets) {
+        when(core.getInput)
+            .calledWith('secrets')
+            .mockReturnValueOnce(secrets);
+    }
+
+    it('get simple secret', async () => {
+        mockInput('secret/data/test secret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
+    });
+
+    it('re-map secret', async () => {
+        mockInput('secret/data/test secret | TEST_KEY');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('TEST_KEY', 'SUPERSECRET');
+    });
+
+    it('get nested secret', async () => {
+        mockInput('secret/data/nested/test otherSecret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
+    });
+
+    it('get multiple secrets', async () => {
+        mockInput(`
+        secret/data/test secret ;
+        secret/data/test secret | NAMED_SECRET ;
+        secret/data/nested/test otherSecret ;`);
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledTimes(3);
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
+        expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET');
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
+    });
+
+    it('leading slash kvv2', async () => {
+        mockInput('/secret/data/foobar fookv2');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('FOOKV2', 'bar');
+    });
+
+    it('get secret from K/V v1', async () => {
+        mockInput('secret-kv1/test secret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'CUSTOMSECRET');
+    });
+
+    it('get nested secret from K/V v1', async () => {
+        mockInput('secret-kv1/nested/test otherSecret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERCUSTOMSECRET');
+    });
+
+    it('leading slash kvv1', async () => {
+        mockInput('/secret-kv1/foobar fookv1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('FOOKV1', 'bar');
+    });
+
+    describe('generic engines', () => {
+        beforeAll(async () => {
+            await got(`${vaultUrl}/v1/cubbyhole/test`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+                json: {
+                    foo: "bar",
+                    zip: "zap"
+                },
+            });
+        });
+
+        it('supports cubbyhole', async () => {            
+            mockInput('/cubbyhole/test foo');
+
+            await exportSecrets();
+
+            expect(core.exportVariable).toBeCalledWith('FOO', 'bar');
+        });
+
+        it('caches responses', async () => {            
+            mockInput(`
+            /cubbyhole/test foo ;
+            /cubbyhole/test zip`);
+
+            await exportSecrets();
+
+            expect(core.debug).toBeCalledWith('ℹ using cached response');
+
+            expect(core.exportVariable).toBeCalledWith('FOO', 'bar');
+            expect(core.exportVariable).toBeCalledWith('ZIP', 'zap');
+        });
+    })
+});
@@ -0,0 +1,4 @@
+# e2e tests
+
+This test suite runs `vault-action` as a GitHub Action in the context of a live build, and then verifies that the appropriate environmental variables are set.
+These tests are intended to mostly be very simple smoke tests to verify that the action is being compiled and run correctly in context.
@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIEFjCCAv6gAwIBAgIUe0i7/HGZKvbDb30L9mC99KXFwj8wDQYJKoZIhvcNAQEL
+BQAwgaIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
+Ew1TYW4gRnJhbmNpc2NvMRIwEAYDVQQKEwlIYXNoaUNvcnAxIzAhBgNVBAsTGlRl
+c3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MS0wKwYDVQQDEyRQcm90b3R5cGUgVGVz
+dCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMjAwODA1MTg1MjAwWhcNMjUwODA0
+MTg1MjAwWjCBojELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAU
+BgNVBAcTDVNhbiBGcmFuY2lzY28xEjAQBgNVBAoTCUhhc2hpQ29ycDEjMCEGA1UE
+CxMaVGVzdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxLTArBgNVBAMTJFByb3RvdHlw
+ZSBUZXN0IENlcnRpZmljYXRlIEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAMrRXuu2+zhBs0pLYEdXIaPc4KoWO3xm2RJdbzy3hfjFybQ8
+H/Y6Hi7txjGGSb45xSfXT/RF2srNfs235I+sfB8rrEizNpzkXqOgGa8LKvh2tgBT
+BK/jDWsEdDhxmkpFhE69wEW+D5ub7QGnx9jrqLKfwCmUA0utlzcFBk2nRNhRtsrp
+CI5YL1VN4coLpgXdvbodzbynPzGHe9R/o9K0Uiz2hgHooyKwhkVYwo0BIAQamLFz
+TS7lyeLf0thDOxV31NX8SpSucqRf50WHNk8T/YtKZ9EhlBDT4ybZwwvcC/ocxxcg
+1LvB0YweZNjSeO78S4CMh1TFGXnF/xOtGABlIbcCAwEAAaNCMEAwDgYDVR0PAQH/
+BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFABD/NxvYLpo5zVNeD01
+r8IIFYlBMA0GCSqGSIb3DQEBCwUAA4IBAQB7TfpIx53gf/oI3mgR6Ciz287WBzFR
+OzhJXwHk5J3mx8VC1W8tDRXih2lCLd/f9qDy6LyL/hZcoonev6w9oReuOMBiH6l4
+Pf3yq2aDXX0AoGgm75c1m34kY669JLMsHq5+xuUDeeFUMd60w9zVtZfBSumy/sgN
+PdjtvThh8sSByocYULs3tuxZDGyQ6GyQcn/xlMrGtmcD5IuX5IXqcKRVlZttykNx
+S2ltcR00fekw8WZyPSzMJaP+/Kcq3T2viN02MS6qEycQZoYfEAMdj+A0kjbsZG9D
+6J92z78b2DuLAUvZVpynNk/UbpDeqIDy40V3JDmtvrfGUMkMhMqgK/+J
+-----END CERTIFICATE-----
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIENTCCAx2gAwIBAgIUMu5h1ysA5DlM6lzZFliT2C2n4lEwDQYJKoZIhvcNAQEL
+BQAwgaIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
+Ew1TYW4gRnJhbmNpc2NvMRIwEAYDVQQKEwlIYXNoaUNvcnAxIzAhBgNVBAsTGlRl
+c3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MS0wKwYDVQQDEyRQcm90b3R5cGUgVGVz
+dCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwIBcNMjAwODA1MTg1MjAwWhgPMjEyMDA3
+MTIxODUyMDBaMIGMMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEW
+MBQGA1UEBxMNU2FuIEZyYW5jaXNjbzESMBAGA1UEChMJSGFzaGlDb3JwMSMwIQYD
+VQQLExpUZXN0IENlcnRpZmljYXRlIEF1dGhvcml0eTEXMBUGA1UEAxMOaGFzaGlj
+b3JwLnRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC/zYDKdDGo
+Qy7eJUNjOe6jpeGvK1lMu5T1Xka+h2ay6WH5gLyrPw5pi582iYpJdHVbplKMywx
+LxZv7mAbKNxqdp8UZKy0A3bCuHQqRF8ssXXHufQ8EGxNkLMLJP0e2q39OnrxXekS
+8Ct3aJm3V8qkcV3CpVdPNgJh4TSuneCXIxVWjFYSiyHi0/5TRd2D+aQPz12szg5F
+mBW4dLzYKHEMlWcjWG8mxtbLyt+jSR1+tSehQx7KndufdfniOWEDBdbeR3yDnZdn
+p8DnRWK4oaEI3Sl8tKlDd1Yp+R96aqOEn1tPW6Jy6Vdvk3fCefclbWZ6B9kiJ/1r
+gxq7AN7iKmHNAgMBAAGjdTBzMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggr
+BgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRn2mwyk+MPChnLg0iWy1r9
+b3JvwTAfBgNVHSMEGDAWgBQAQ/zcb2C6aOc1TXg9Na/CCBWJQTANBgkqhkiG9w0B
+AQsFAAOCAQEAOpCy0vHp1Kxgv0VBRrbrwSQLBGP8a1ubVWoeoZQ+EvX9ozqDrHxm
+gM4XPYUJlUOOEu0ZRgCW60YK33E1zNKnA1F0/3/rmqMkKnm0BBs/5WzMWtsIBPcU
+e0CeJmaRIXnERQMH/svD+RrFo1dcF8rUDIlWez7+xGqoIGBg7v4jEmkZ3HdckcE+
+/xvC61YSG8NsJwR/CEcQ8YCyVfgvuS0ukWs4dN15aVDL3Oe61h3bRcGAywOJBrdq
+9xaq7ezZp/+lUSkYnatWJBuC/aviH9g9s+gMT0I3fWHh8BB0Ne2txwJ15K/qz5he
+TjxFsumrh50aFqjSiEHndtY5UWuGAFLiSw==
+-----END CERTIFICATE-----
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAv82AynQxqPkMu3iVDYznuo6XhrytZTLuU9V5Gvodmsulh+YC
+8qz8OaYufNomKSXR1W6ZSjMsMS8Wb+5gGyjcanafFGSstAN2wrh0KkRfLLF1x7n0
+PBBsTZCzCyT9Htqt/Tp68V3pEvArd2iZt1fKpHFdwqVXTzYCYeE0rp3glyMVVoxW
+Eosh4tP+U0Xdg/mkD89drM4ORZgVuHS82ChxDJVnI1hvJsbWy8rfo0kdfrUnoUMe
+yp3bn3X54jlhAwXW3kd8g52XZ6fA50ViuKGhCN0pfLSpQ3dWKfkfemqjhJ9bT1ui
+culXb5N3wnn3JW1megfZIif9a4MauwDe4iphzQIDAQABAoIBAQCYHJuidAoaTwGZ
+ACV9rJzuqD1lvubpFj5KwEcebPPjmtQ5deIqoaQa+D9wBvYyteq3ENKDNRg8HXL2
+7B7OC1bbHB5HZxxMW17pSK3gA39Ti52z+zbGF+Q8k6BbG0efG6DW7nUoTOkWeuCN
+/6fA7uAoEDxirQwUJuo2xAsq3MyMLwcs95rke9Bly8ABFNaV1oMZq8YT/w8oSc2b
+/7WtxXmChHlVYXTcMqzVPqNFqPRixZRWQ+BSHoXmEDviuGd51L4s9D7iXp32TvUx
+DMHeS1DFA2en7ZF1uc9VXZeplkkDtVhUe4d6qOqCcUwDFEvMonnyVSa6/FkR5jYZ
+2yujTdfhAoGBAM0hGOnmnDnCjADUt4mZlr+Mf0XmdKzEV+hid4CQUvBoTXgjYMvv
+c397eNePce7SwSUE1/APERInGUPhRLVFW5q6/34WRtGBbQkT8ByeJANXes4UFZe3
+wdNLczWUlSl0G3jTf+Kh3+K5/PtmyxSrAS/9GIk+ibs1mlJOPyVnWqUJAoGBAO9e
+WlP9/ruXluvkQyM5ZlnAnZYMsFGzzPx4tkazUjurtqxQoyZ0z+pPItGQ7lOl+pDA
+EWiTun66g+Da9uBiBCJUeXiC1ge2p6bT6N194BrYyrWML9hcIL4mqVojUEUmhnSh
+6b9h1pC7vFmw5ZFMIIkS60cfBMgQMZxMJN8NuaulAoGBAJM5hwURg90c2ZkbEyPK
+PVz7fLlxnxoEzcc3LOf0LeLoKXnpgma8VJwRxXiJNs+fKgrkwAtG9QyfTU3f1412
+2zlhr1ASsv9ZMiXKzpHrmpNfbP+NgLXkqFN7mpPBMZGQCMuemPHTFrpGnODfNTB/
+T5newIZ4gSgBX+Jk0IOK+47pAoGAeKo6pK6ck9pV5TIbOg18b/AuQG7DD1yxD/CW
+CkvpP1VPb8vygrdN/FLKPZRu39IC3qdD31DhKXNCeb5Hx1MBvICS/1INLLRCDVIz
+yDvlFgOFJEG3+LxwcQqyQlMc6s8B5pecarKaZDmPODN5dmZG3HKiEicr1OJ878pe
+p+aWW1UCgYBmGFbCc1qqlqp+srYGsv3rIgNs5HSfrAjbgY8xh9foMgrYCRAm57gv
+01yVxMXWmKA6ReVEu8OTVy9fkuOL/vw2o+C6W4IPZYdvSQoPwd5Lf+AqxEQvFF1m
+tT3SZAM3EhQ7tIXdIQHY27SJ1KlUJMrvUq1CiRWiG/MOKf/87JXPog==
+-----END RSA PRIVATE KEY-----
@@ -0,0 +1,15 @@
+ui = false
+disable_mlock = true
+
+listener "tcp" {
+  address = "[::]:8200"
+  cluster_address = "[::]:8201"
+  tls_cert_file = "/etc/vault/server.crt"
+  tls_key_file = "/etc/vault/server.key"
+  tls_client_ca_file = "/etc/vault/ca.crt"
+  tls_require_and_verify_client_cert = "true"
+}
+
+storage "file" {
+  path = "/var/lib/vault"
+}
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEXjCCA0agAwIBAgIUAswquazrfsyDRvXZwn5718DUhU4wDQYJKoZIhvcNAQEL
+BQAwgaIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
+Ew1TYW4gRnJhbmNpc2NvMRIwEAYDVQQKEwlIYXNoaUNvcnAxIzAhBgNVBAsTGlRl
+c3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MS0wKwYDVQQDEyRQcm90b3R5cGUgVGVz
+dCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwIBcNMjAwODA1MTg1MjAwWhgPMjEyMDA3
+MTIxODUyMDBaMIGMMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEW
+MBQGA1UEBxMNU2FuIEZyYW5jaXNjbzESMBAGA1UEChMJSGFzaGlDb3JwMSMwIQYD
+VQQLExpUZXN0IENlcnRpZmljYXRlIEF1dGhvcml0eTEXMBUGA1UEAxMOaGFzaGlj
+b3JwLnRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0azdZsrPC
+5Rv8nRxVJnLi+oZgCJYgzhCDiEbYqt1QK1gqNXp0ml5ck6ycj0drwzHzrrX+xcPV
+5FcNKH3RFyon9XkzjwaXkMv6IkgvH6/jQ1dDW9kWBf3Io3Y59wnD/YaIzNK0CYJS
+fRNdsZb4InH8gh+RL33+FeysgJwXG1TVA4tTUj7DQxDE0cDd9UD+C9Yx7OWiUjC1
+IjqdFPusX1nziKYjeI5/UiCmOUGqJJRoMPonuzuGIj9GdmBKmga64OfeZFqn4f6a
+ay61VnGCwZ24VniUwYElsFbcF2Nv9WqnrOeQlHOsYN68VMqHzaYPqE6SPa6mO5mI
+/tmpXrDG3Y+RAgMBAAGjgZ0wgZowDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoG
+CCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFE03/UTs2ZmJpWHSmstt
+hDngW6F3MB8GA1UdIwQYMBaAFABD/NxvYLpo5zVNeD01r8IIFYlBMCUGA1UdEQQe
+MByCCWxvY2FsaG9zdIIJdmF1bHQtdGxzhwR/AAABMA0GCSqGSIb3DQEBCwUAA4IB
+AQCzarBGJium5oZDSSP5GqxpS13QP2onEen6I1k2eRdcOqtbfNdQ20RJrb4dfNkE
+Dc09KWVlZAn+hYge2KKTXJ+4ltIC9V1LvquyWipNczOT1ve0H9gt3Wm88LdESqI5
+HOx43pIaa3cWXBlbzrFmT1SASYm1V5Oo1mXzpUukGokHLLmAz36VVuJGbD0BxYke
+5MefG4tNT1SsMsIqVvGxI9NiVs7YTdJu81MctSYK5snsEKnYdi9N7CHOk3bdDpeC
+v2Vo7XBk3s4sBMGmnJO+1JOcRFJioooEFkqNyQmg3atfInysVbreKS5KtWNTaCPm
+yI55plW8ga5ucja2VX3WbwAO
+-----END CERTIFICATE-----
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAtGs3WbKzwuUb/J0cVSZy4vqGYAiWIM4Qg4hG2KrdUCtYKjV6
+dJpeXJOsnI9Ha8Mx8661/sXD1eRXDSh90RcqJ/V5M48Gl5DL+iJILx+v40NXQ1vZ
+FgX9yKN2OfcJw/2GiMzStAmCUn0TXbGW+CJx/IIfkS99/hXsrICcFxtU1QOLU1I+
+w0MQxNHA3fVA/gvWMezlolIwtSI6nRT7rF9Z84imI3iOf1IgpjlBqiSUaDD6J7s7
+hiI/RnZgSpoGuuDn3mRap+H+mmsutVZxgsGduFZ4lMGBJbBW3Bdjb/Vqp6znkJRz
+rGDevFTKh82mD6hOkj2upjuZiP7ZqV6wxt2PkQIDAQABAoIBAQCvK0HsVvLtkSCh
+HbF6gwAcnHyHFQ8d/rRN4KxYhVynD85j/NRODer8G20F/J6tZDFFlSWinUTMkQxr
+/BpcPg9yCIWKp50Q30cMLujCyBMvphw9jBmzplGG0h5hnRbgMXDDtYoFvw3HJST+
+XQRlGpxtO7GGdwPvBD5sJdpnHOQ6g7qIYKmlHM99kHU8vr0VghqZAYxEh8RpnYez
+NLra+7ep+Zp1pFIniU6B8ohyL3OArbQ65qYrZYriAEI5HeEk0RhjewcPsV56LwbS
+CncTVS/dNYgk1zRIvytmbDVD3v/4lLvnpIWeKVdk7p1aGJeCdpLeWNvDLX0Ws67r
+QeZQizwhAoGBAMwAIA6+HPsx+8dhNbN3ydX8YU6uUfSeshhshIFZPIYL2vrKyAHU
+/GAYVzYJH/cU0IvlLJlLdQuiZkOXEX87tgdfmM/o4Qdl12RR0BvU0Cae0txtzNrP
+yTdfZqDhTz/V8jOAXUNA5oQA45Y3rI7JES8hBd1F9WFOH2WINp344GzlAoGBAOJo
+SgmRE24VcnfUMqrBpwZBdBrTxDQyTagvd+MuGomIQfcE2Y4rr1eIuJJ0HF5/eYxc
+DZRO/LVP9tQ8ozXi2tdmgUdKC79O2edmdOCWW5of464R/TLcM5B4SmS36RtdE3qJ
+ig4fcUmsJ15MAGpkXLMh5YSD/N3TmcnURtx06Fk9AoGATi+mGcBnnybzFuF9EYHR
+y7/lE6DgLF8+ZvoAdwralY2pqgFaUslsyO/LTRyGMc66d0OoqkAvZfwiMbmOrTMX
+ew/6o4Tf6lPwD7UDjAcul/67VlyG7T5CIoTf8r0oAJFhOLf0BrizINiuYX6JFlid
+y3BerQYJG/gzNFjWhglDCrkCgYA+3wUISRAjNrN10ShMwL/3/b8XIA1RDVMBTEU3
+gfr+jCb9SIx9bWYgoafXi4TBPRbswjdHIvQMCWuankgYU6m/vQhTWp2Of4AFQS9d
+moNPdmGMWhR8xidPjAfklimWXq9lDMKYj2SvN64rAmHvKXWQjO4mcVyL4RHIuTkA
+STqoZQKBgQDKHd8F6tjZHEFolmjS5l682g7zVTpBhozezJ/RqYvhJh5ew1pXoD/O
+Zu9iMfHoDjR4ZUXq6aeLUj/oIt1AsjwaGChOLLAvFbvePgS9XkYkwIlaxS4efAya
+CQE/JmY/a1/c2MDLNMCEXvUqX68pv6iDF8pfn+i4tn0omYqgfUlCA==
+-----END RSA PRIVATE KEY-----
@@ -0,0 +1,14 @@
+describe('e2e-tls', () => {
+    it('verify', () => {
+        expect(process.env.SECRET).toBe("SUPERSECRET");
+        expect(process.env.NAMED_SECRET).toBe("SUPERSECRET");
+        expect(process.env.OTHERSECRET).toBe("OTHERSUPERSECRET");
+        expect(process.env.OTHER_SECRET_OUTPUT).toBe("OTHERSUPERSECRET");
+        expect(process.env.ALTSECRET).toBe("CUSTOMSECRET");
+        expect(process.env.NAMED_ALTSECRET).toBe("CUSTOMSECRET");
+        expect(process.env.OTHERALTSECRET).toBe("OTHERCUSTOMSECRET");
+        expect(process.env.FOO).toBe("bar");
+        expect(process.env.NAMED_CUBBYSECRET).toBe("zap");
+        expect(process.env.SKIP).toBe("true");
+    });
+});
@@ -0,0 +1,197 @@
+const got = require('got');
+const core = require('@actions/core');
+
+const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
+const caCertificateRaw = `${process.env.VAULTCA}`;
+const clientCertificateRaw = `${process.env.VAULT_CLIENT_CERT}`;
+const clientKeyRaw = `${process.env.VAULT_CLIENT_KEY}`;
+
+(async () => {
+    try {
+        var caCertificate = Buffer.from(caCertificateRaw, 'base64').toString();
+        if (caCertificate == null) {
+            throw Error("VAULTCA env not set.")
+        }
+
+        var clientCertificate = Buffer.from(clientCertificateRaw, 'base64').toString();
+        if (clientCertificate == null) {
+            throw Error("VAULT_CLIENT_CERT env not set.")
+        }
+
+        var clientKey = Buffer.from(clientKeyRaw, 'base64').toString();
+        if (clientKey == null) {
+            throw Error("VAULT_CLIENT_KEY env not set.")
+        }
+
+        // Init
+        const {body} = await got(`https://${vaultUrl}/v1/sys/init`, {
+            method: 'POST',
+            json: {
+                secret_shares: 1,
+                secret_threshold: 1,
+            },
+            responseType: 'json',
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            }
+        });
+
+        if (body.keys_base64.length != 1) {
+            throw Error("No unseal key found after init.")
+        }
+        var unseal = body.keys_base64[0];
+
+        if (body.root_token == "") {
+            throw Error("No root token found after init.")
+        }
+        var rootToken = body.root_token;
+
+        core.exportVariable('VAULT_TOKEN', rootToken);
+        core.setSecret(rootToken)
+
+        // Unseal 
+        await got(`https://${vaultUrl}/v1/sys/unseal`, {
+            method: 'POST',
+            json: {
+                key: unseal,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            }
+        });
+
+        await got(`https://${vaultUrl}/v1/sys/mounts/secret`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                type: 'kv-v2'
+            }
+        });
+
+        await got(`https://${vaultUrl}/v1/secret/data/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                data: {
+                    secret: 'SUPERSECRET',
+                },
+            },
+        });
+
+        await got(`https://${vaultUrl}/v1/secret/data/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                data: {
+                    otherSecret: 'OTHERSUPERSECRET',
+                },
+            }
+        });
+
+        await got(`https://${vaultUrl}/v1/secret/data/tlsSkipVerify`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                data: {
+                    skip: 'true',
+                },
+            }
+        });
+
+        await got(`https://${vaultUrl}/v1/sys/mounts/my-secret`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                type: 'kv'
+            }
+        });
+
+        await got(`https://${vaultUrl}/v1/my-secret/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                altSecret: 'CUSTOMSECRET',
+            }
+        });
+
+        await got(`https://${vaultUrl}/v1/my-secret/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                otherAltSecret: 'OTHERCUSTOMSECRET',
+            },
+        });
+
+        await got(`https://${vaultUrl}/v1/cubbyhole/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': rootToken,
+            },
+            https: {
+                certificateAuthority: caCertificate,
+                certificate: clientCertificate,
+                key: clientKey,
+            },
+            json: {
+                foo: 'bar',
+                zip: 'zap',
+            },
+        });
+    } catch (error) {
+        console.log(error);
+        process.exit(1);
+    }
+})();
@@ -0,0 +1,4 @@
+# e2e tests
+
+This test suite runs `vault-action` as a GitHub Action in the context of a live build, and then verifies that the appropriate environmental variables are set.
+These tests are intended to mostly be very simple smoke tests to verify that the action is being compiled and run correctly in context.
@@ -0,0 +1,13 @@
+describe('e2e', () => {
+    it('verify', () => {
+        expect(process.env.SECRET).toBe("SUPERSECRET");
+        expect(process.env.NAMED_SECRET).toBe("SUPERSECRET");
+        expect(process.env.OTHERSECRET).toBe("OTHERSUPERSECRET");
+        expect(process.env.OTHER_SECRET_OUTPUT).toBe("OTHERSUPERSECRET");
+        expect(process.env.ALTSECRET).toBe("CUSTOMSECRET");
+        expect(process.env.NAMED_ALTSECRET).toBe("CUSTOMSECRET");
+        expect(process.env.OTHERALTSECRET).toBe("OTHERCUSTOMSECRET");
+        expect(process.env.FOO).toBe("bar");
+        expect(process.env.NAMED_CUBBYSECRET).toBe("zap");
+    });
+});
@@ -0,0 +1,3 @@
+module.exports = {
+    verbose: true
+};
@@ -0,0 +1,82 @@
+const got = require('got');
+
+const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
+
+(async () => {
+    try {
+        // Verify Connection
+        await got(`http://${vaultUrl}/v1/secret/config`, {
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+        });
+
+        await got(`http://${vaultUrl}/v1/secret/data/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    secret: 'SUPERSECRET',
+                },
+            },
+        });
+
+        await got(`http://${vaultUrl}/v1/secret/data/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                data: {
+                    otherSecret: 'OTHERSUPERSECRET',
+                },
+            }
+        });
+
+        await got(`http://${vaultUrl}/v1/sys/mounts/my-secret`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                type: 'kv'
+            }
+        });
+
+        await got(`http://${vaultUrl}/v1/my-secret/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                altSecret: 'CUSTOMSECRET',
+            }
+        });
+
+        await got(`http://${vaultUrl}/v1/my-secret/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                otherAltSecret: 'OTHERCUSTOMSECRET',
+            },
+        });
+
+        await got(`http://${vaultUrl}/v1/cubbyhole/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                foo: 'bar',
+                zip: 'zap',
+            },
+        });
+    } catch (error) {
+        console.log(error);
+        process.exit(1);
+    }
+})();
@@ -0,0 +1,303 @@
+jest.mock('@actions/core');
+jest.mock('@actions/core/lib/command');
+const core = require('@actions/core');
+
+const got = require('got');
+const { when } = require('jest-when');
+
+const { exportSecrets } = require('../../src/action');
+
+const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8201'}`;
+
+describe('integration', () => {
+    beforeAll(async () => {
+        try {
+            // Verify Connection
+            await got(`${vaultUrl}/v1/secret/config`, {
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+            });
+
+            // Create namespace
+            await enableNamespace('ns1');
+
+            // Enable K/V v2 secret engine at 'secret/'
+            await enableEngine('secret', 'ns1', 2);
+
+            await writeSecret('secret', 'test', 'ns1', 2, {secret: 'SUPERSECRET_IN_NAMESPACE'})
+            await writeSecret('secret', 'nested/test', 'ns1', 2, {otherSecret: 'OTHERSUPERSECRET_IN_NAMESPACE'})
+
+            // Enable K/V v1 secret engine at 'my-secret/'
+            await enableEngine('my-secret', 'ns1', 1);
+
+            await writeSecret('my-secret', 'test', 'ns1', 1, {secret: 'CUSTOMSECRET_IN_NAMESPACE'})
+            await writeSecret('my-secret', 'nested/test', 'ns1', 1, {otherSecret: 'OTHERCUSTOMSECRET_IN_NAMESPACE'})
+        } catch (e) {
+            console.error('Failed to setup test', e);
+            throw e;
+        }
+    });
+
+    beforeEach(() => {
+        jest.resetAllMocks();
+
+        when(core.getInput)
+            .calledWith('url')
+            .mockReturnValueOnce(`${vaultUrl}`);
+
+        when(core.getInput)
+            .calledWith('token')
+            .mockReturnValueOnce('testtoken');
+
+        when(core.getInput)
+            .calledWith('namespace')
+            .mockReturnValueOnce('ns1');
+    });
+
+    it('get simple secret', async () => {
+        mockInput('secret/data/test secret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET_IN_NAMESPACE');
+    });
+
+    it('re-map secret', async () => {
+        mockInput('secret/data/test secret | TEST_KEY');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('TEST_KEY', 'SUPERSECRET_IN_NAMESPACE');
+    });
+
+    it('get nested secret', async () => {
+        mockInput('secret/data/nested/test otherSecret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET_IN_NAMESPACE');
+    });
+
+    it('get multiple secrets', async () => {
+        mockInput(`
+        secret/data/test secret ;
+        secret/data/test secret | NAMED_SECRET ;
+        secret/data/nested/test otherSecret ;`);
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledTimes(3);
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET_IN_NAMESPACE');
+        expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET_IN_NAMESPACE');
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET_IN_NAMESPACE');
+    });
+
+    it('get secret from K/V v1', async () => {
+        mockInput('my-secret/test secret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'CUSTOMSECRET_IN_NAMESPACE');
+    });
+
+    it('get nested secret from K/V v1', async () => {
+        mockInput('my-secret/nested/test otherSecret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERCUSTOMSECRET_IN_NAMESPACE');
+    });
+});
+
+describe('authenticate with approle', () => {
+    let roleId;
+    let secretId;
+    beforeAll(async () => {
+        try {
+            // Verify Connection
+            await got(`${vaultUrl}/v1/secret/config`, {
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+            });
+
+            // Create namespace
+            await enableNamespace("ns2");
+
+            // Enable K/V v2 secret engine at 'secret/'
+            await enableEngine("secret", "ns2", 2);
+
+            // Add secret
+            await writeSecret('secret', 'test', 'ns2', 2, {secret: 'SUPERSECRET_WITH_APPROLE'})
+
+            // Enable approle
+            try {
+                await got(`${vaultUrl}/v1/sys/auth/approle`, {
+                    method: 'POST',
+                    headers: {
+                        'X-Vault-Token': 'testtoken',
+                        'X-Vault-Namespace': 'ns2',
+                    },
+                    json: {
+                        type: 'approle'
+                    },
+                });
+            } catch (error) {
+                const {response} = error;
+                if (response.statusCode === 400 && response.body.includes("path is already in use")) {
+                    // Approle might already be enabled from previous test runs
+                } else {
+                    throw error;
+                }
+            }
+
+            // Create policies
+            await got(`${vaultUrl}/v1/sys/policies/acl/test`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                    'X-Vault-Namespace': 'ns2',
+                },
+                json: {
+                    "name":"test",
+                    "policy":"path \"auth/approle/*\" {\n    capabilities = [\"read\", \"list\"]\n}\npath \"auth/approle/role/my-role/role-id\"\n{\n    capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\n}\npath \"auth/approle/role/my-role/secret-id\"\n{\n    capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\n}\n\npath \"secret/data/*\" {\n    capabilities = [\"list\"]\n}\npath \"secret/metadata/*\" {\n    capabilities = [\"list\"]\n}\n\npath \"secret/data/test\" {\n    capabilities = [\"read\", \"list\"]\n}\npath \"secret/metadata/test\" {\n    capabilities = [\"read\", \"list\"]\n}\npath \"secret/data/test/*\" {\n    capabilities = [\"read\", \"list\"]\n}\npath \"secret/metadata/test/*\" {\n    capabilities = [\"read\", \"list\"]\n}\n"
+                },
+            });
+
+            // Create approle
+            await got(`${vaultUrl}/v1/auth/approle/role/my-role`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                    'X-Vault-Namespace': 'ns2',
+                },
+                json: {
+                    policies: 'test'
+                },
+            });
+
+            // Get role-id
+            const roldIdResponse = await got(`${vaultUrl}/v1/auth/approle/role/my-role/role-id`, {
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                    'X-Vault-Namespace': 'ns2',
+                },
+                responseType: 'json',
+            });
+            roleId = roldIdResponse.body.data.role_id;
+
+            // Get secret-id
+            const secretIdResponse = await got(`${vaultUrl}/v1/auth/approle/role/my-role/secret-id`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                    'X-Vault-Namespace': 'ns2',
+                },
+                responseType: 'json',
+            });
+            secretId = secretIdResponse.body.data.secret_id;
+        } catch(err) {
+            console.warn('Create approle', err.response.body);
+            throw err;
+        }
+    });
+
+    beforeEach(() => {
+        jest.resetAllMocks();
+
+        when(core.getInput)
+            .calledWith('method', expect.anything())
+            .mockReturnValueOnce('approle');
+        when(core.getInput)
+            .calledWith('roleId')
+            .mockReturnValueOnce(roleId);
+        when(core.getInput)
+            .calledWith('secretId')
+            .mockReturnValueOnce(secretId);
+        when(core.getInput)
+            .calledWith('url')
+            .mockReturnValueOnce(`${vaultUrl}`);
+        when(core.getInput)
+            .calledWith('namespace')
+            .mockReturnValueOnce('ns2');
+    });
+
+    it('authenticate with approle', async() => {
+        mockInput('secret/data/test secret');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET_WITH_APPROLE');
+    })
+});
+
+async function enableNamespace(name) {
+    try {
+        await got(`${vaultUrl}/v1/sys/namespaces/${name}`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            }
+        });
+    } catch (error) {
+        const {response} = error;
+        if (response.statusCode === 400 && response.body.includes("already exists")) {
+            // Namespace might already be enabled from previous test runs
+        } else {
+            throw error;
+        }
+    }
+}
+
+async function enableEngine(path, namespace, version) {
+    try {
+        await got(`${vaultUrl}/v1/sys/mounts/${path}`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+                'X-Vault-Namespace': namespace,
+            },
+            json: { type: 'kv', config: {}, options: { version }, generate_signing_key: true },
+        });
+    } catch (error) {
+        const {response} = error;
+        if (response.statusCode === 400 && response.body.includes("path is already in use")) {
+            // Engine might already be enabled from previous test runs
+        } else {
+            throw error;
+        }
+    }
+}
+
+async function writeSecret(engine, path, namespace, version, data) {
+    const secretPath = (version == 1) ? (`${engine}/${path}`) : (`${engine}/data/${path}`);
+    const secretPayload = (version == 1) ? (data) : ({data});
+    await got(`${vaultUrl}/v1/${secretPath}`, {
+        method: 'POST',
+        headers: {
+            'X-Vault-Token': 'testtoken',
+            'X-Vault-Namespace': namespace,
+        },
+        json: secretPayload
+    });
+}
+
+function mockInput(secrets) {
+    when(core.getInput)
+        .calledWith('secrets')
+        .mockReturnValueOnce(secrets);
+}
+
+function mockEngineName(name) {
+    when(core.getInput)
+        .calledWith('path')
+        .mockReturnValueOnce(name);
+}
+
+function mockVersion(version) {
+    when(core.getInput)
+        .calledWith('kv-version')
+        .mockReturnValueOnce(version);
+}
@@ -0,0 +1,3 @@
+module.exports = {
+    verbose: true
+};
@@ -1,3 +1,3 @@
 module.exports = {
-    testPathIgnorePatterns: ['/node_modules/', '<rootDir>/integration/', '<rootDir>/e2e/'],
+    testPathIgnorePatterns: ['/node_modules/', '<rootDir>/integrationTests/'],
 };
@@ -2,24 +2,32 @@
    "name": "vault-action",
    "version": "0.1.0",
    "description": "A Github Action that allows you to consume vault secrets as secure environment variables.",
-    "main": "index.js",
+    "main": "dist/index.js",
    "scripts": {
+        "build": "ncc build src/entry.js -o dist",
        "test": "jest",
-        "test:integration": "jest -c integration/jest.config.js",
-        "test:e2e": "jest -c e2e/jest.config.js"
+        "test:integration:basic": "jest -c integrationTests/basic/jest.config.js",
+        "test:integration:enterprise": "jest -c integrationTests/enterprise/jest.config.js",
+        "test:e2e": "jest -c integrationTests/e2e/jest.config.js",
+        "test:e2e-tls": "jest -c integrationTests/e2e-tls/jest.config.js"
    },
+    "files": [
+        "src/**/*",
+        "dist/**/*"
+    ],
    "release": {
        "branch": "master",
        "plugins": [
            "@semantic-release/commit-analyzer",
            "@semantic-release/release-notes-generator",
-            "@semantic-release/github"
+            "@semantic-release/github",
+            "@semantic-release/npm"
        ],
        "ci": false
    },
    "repository": {
        "type": "git",
-        "url": "git+https://github.com/RichiCoder1/vault-action.git"
+        "url": "git+https://github.com/hashicorp/vault-action.git"
    },
    "keywords": [
        "hashicorp",
@@ -29,20 +37,26 @@
        "github-actions",
        "javascript"
    ],
-    "author": "Richard Simpson <richardsimpson@outlook.com>",
+    "author": "HashiCorp",
    "license": "MIT",
    "bugs": {
-        "url": "https://github.com/RichiCoder1/vault-action/issues"
+        "url": "https://github.com/hashicorp/vault-action/issues"
    },
-    "homepage": "https://github.com/RichiCoder1/vault-action#readme",
+    "homepage": "https://github.com/hashicorp/vault-action#readme",
    "dependencies": {
-        "@actions/core": "^1.1.1",
-        "got": "^9.6.0"
+        "got": "^11.5.1",
+        "jsonata": "^1.8.2"
+    },
+    "peerDependencies": {
+        "@actions/core": ">=1 <2"
    },
    "devDependencies": {
-        "@types/jest": "^24.0.18",
-        "jest": "^24.9.0",
+        "@actions/core": "^1.2.3",
+        "@types/got": "^9.6.9",
+        "@types/jest": "^25.1.3",
+        "@zeit/ncc": "^0.22.0",
+        "jest": "^25.1.0",
        "jest-when": "^2.7.0",
-        "semantic-release": "^15.13.24"
+        "semantic-release": "^17.0.4"
    }
 }
@@ -0,0 +1,196 @@
+// @ts-check
+const core = require('@actions/core');
+const command = require('@actions/core/lib/command');
+const got = require('got').default;
+const jsonata = require('jsonata');
+const { auth: { retrieveToken }, secrets: { getSecrets } } = require('./index');
+
+const AUTH_METHODS = ['approle', 'token', 'github'];
+
+async function exportSecrets() {
+    const vaultUrl = core.getInput('url', { required: true });
+    const vaultNamespace = core.getInput('namespace', { required: false });
+    const extraHeaders = parseHeadersInput('extraHeaders', { required: false });
+    const exportEnv = core.getInput('exportEnv', { required: false }) != 'false';
+
+    const secretsInput = core.getInput('secrets', { required: true });
+    const secretRequests = parseSecretsInput(secretsInput);
+
+    const vaultMethod = (core.getInput('method', { required: false }) || 'token').toLowerCase();
+    const authPayload = core.getInput('authPayload', { required: false });
+    if (!AUTH_METHODS.includes(vaultMethod) && !authPayload) {
+        throw Error(`Sorry, the provided authentication method ${vaultMethod} is not currently supported and no custom authPayload was provided.`);
+    }
+
+    const defaultOptions = {
+        prefixUrl: vaultUrl,
+        headers: {},
+        https: {}
+    }
+
+    const tlsSkipVerify = (core.getInput('tlsSkipVerify', { required: false }) || 'false').toLowerCase() != 'false';
+    if (tlsSkipVerify === true) {
+        defaultOptions.https.rejectUnauthorized = false;
+    }
+
+    const caCertificateRaw = core.getInput('caCertificate', { required: false });
+    if (caCertificateRaw != null) {
+        defaultOptions.https.certificateAuthority = Buffer.from(caCertificateRaw, 'base64').toString();
+    }
+
+    const clientCertificateRaw = core.getInput('clientCertificate', { required: false });
+    if (clientCertificateRaw != null) {
+	    defaultOptions.https.certificate = Buffer.from(clientCertificateRaw, 'base64').toString();
+    }
+
+    const clientKeyRaw = core.getInput('clientKey', { required: false });
+    if (clientKeyRaw != null) {
+	    defaultOptions.https.key = Buffer.from(clientKeyRaw, 'base64').toString();
+    }
+
+    for (const [headerName, headerValue] of extraHeaders) {
+        defaultOptions.headers[headerName] = headerValue;
+    }
+
+    if (vaultNamespace != null) {
+        defaultOptions.headers["X-Vault-Namespace"] = vaultNamespace;
+    }
+
+    const vaultToken = await retrieveToken(vaultMethod, got.extend(defaultOptions));
+    defaultOptions.headers['X-Vault-Token'] = vaultToken;
+    const client = got.extend(defaultOptions);
+
+    const requests = secretRequests.map(request => {
+        const { path, selector } = request;
+        return request;
+    });
+
+    const results = await getSecrets(requests, client);
+
+    for (const result of results) {
+        const { value, request, cachedResponse } = result;
+        if (cachedResponse) {
+            core.debug('ℹ using cached response');
+        }        
+        command.issue('add-mask', value);
+        if (exportEnv) {
+            core.exportVariable(request.envVarName, `${value}`);
+        }
+        core.setOutput(request.outputVarName, `${value}`);
+        core.debug(`✔ ${request.path} => outputs.${request.outputVarName}${exportEnv ? ` | env.${request.envVarName}` : ''}`);
+    }
+};
+
+/** @typedef {Object} SecretRequest 
+ * @property {string} path
+ * @property {string} envVarName
+ * @property {string} outputVarName
+ * @property {string} selector
+*/
+
+/**
+ * Parses a secrets input string into key paths and their resulting environment variable name.
+ * @param {string} secretsInput
+ */
+function parseSecretsInput(secretsInput) {
+    const secrets = secretsInput
+        .split(';')
+        .filter(key => !!key)
+        .map(key => key.trim())
+        .filter(key => key.length !== 0);
+
+    /** @type {SecretRequest[]} */
+    const output = [];
+    for (const secret of secrets) {
+        let pathSpec = secret;
+        let outputVarName = null;
+
+        const renameSigilIndex = secret.lastIndexOf('|');
+        if (renameSigilIndex > -1) {
+            pathSpec = secret.substring(0, renameSigilIndex).trim();
+            outputVarName = secret.substring(renameSigilIndex + 1).trim();
+
+            if (outputVarName.length < 1) {
+                throw Error(`You must provide a value when mapping a secret to a name. Input: "${secret}"`);
+            }
+        }
+
+        const pathParts = pathSpec
+            .split(/\s+/)
+            .map(part => part.trim())
+            .filter(part => part.length !== 0);
+
+        if (pathParts.length !== 2) {
+            throw Error(`You must provide a valid path and key. Input: "${secret}"`);
+        }
+
+        const [path, selector] = pathParts;
+
+        /** @type {any} */
+        const selectorAst = jsonata(selector).ast();
+
+        if ((selectorAst.type !== "path" || selectorAst.steps[0].stages) && !outputVarName) {
+            throw Error(`You must provide a name for the output key when using json selectors. Input: "${secret}"`);
+        }
+
+        let envVarName = outputVarName;
+        if (!outputVarName) {
+            outputVarName = normalizeOutputKey(selector);
+            envVarName = normalizeOutputKey(selector, true);
+        }
+
+        output.push({
+            path,
+            envVarName,
+            outputVarName,
+            selector
+        });
+    }
+    return output;
+}
+
+/**
+ * Replaces any dot chars to __ and removes non-ascii charts
+ * @param {string} dataKey
+ * @param {boolean=} isEnvVar
+ */
+function normalizeOutputKey(dataKey, isEnvVar = false) {
+    let outputKey = dataKey
+        .replace('.', '__').replace(/[^\p{L}\p{N}_-]/gu, '');
+    if (isEnvVar) {
+        outputKey = outputKey.toUpperCase();
+    }
+    return outputKey;
+}
+
+/**
+ * @param {string} inputKey
+ * @param {any} inputOptions
+ */
+function parseHeadersInput(inputKey, inputOptions) {
+    /** @type {string}*/
+    const rawHeadersString = core.getInput(inputKey, inputOptions) || '';
+    const headerStrings = rawHeadersString
+        .split('\n')
+        .map(line => line.trim())
+        .filter(line => line !== '');
+    return headerStrings
+        .reduce((map, line) => {
+            const seperator = line.indexOf(':');
+            const key = line.substring(0, seperator).trim().toLowerCase();
+            const value = line.substring(seperator + 1).trim();
+            if (map.has(key)) {
+                map.set(key, [map.get(key), value].join(', '));
+            } else {
+                map.set(key, value);
+            }
+            return map;
+        }, new Map());
+}
+
+module.exports = {
+    exportSecrets,
+    parseSecretsInput,
+    normalizeOutputKey,
+    parseHeadersInput
+};
@@ -0,0 +1,260 @@
+jest.mock('got');
+jest.mock('@actions/core');
+jest.mock('@actions/core/lib/command');
+
+const core = require('@actions/core');
+const got = require('got');
+const {
+    exportSecrets,
+    parseSecretsInput,
+    parseResponse,
+    parseHeadersInput
+} = require('./action');
+
+const { when } = require('jest-when');
+
+describe('parseSecretsInput', () => {
+    it('parses simple secret', () => {
+        const output = parseSecretsInput('test key');
+        expect(output).toContainEqual({
+            path: 'test',
+            selector: 'key',
+            outputVarName: 'key',
+            envVarName: 'KEY'
+        });
+    });
+
+    it('parses mapped secret', () => {
+        const output = parseSecretsInput('test key|testName');
+        expect(output).toHaveLength(1);
+        expect(output[0]).toMatchObject({
+            outputVarName: 'testName',
+            envVarName: 'testName',
+        });
+    });
+
+    it('fails on invalid mapped name', () => {
+        expect(() => parseSecretsInput('test key|'))
+            .toThrowError(`You must provide a value when mapping a secret to a name. Input: "test key|"`)
+    });
+
+    it('fails on invalid path for mapped', () => {
+        expect(() => parseSecretsInput('|testName'))
+            .toThrowError(`You must provide a valid path and key. Input: "|testName"`)
+    });
+
+    it('parses multiple secrets', () => {
+        const output = parseSecretsInput('first a;second b;');
+
+        expect(output).toHaveLength(2);
+        expect(output[0]).toMatchObject({
+            path: 'first',
+        });
+        expect(output[1]).toMatchObject({
+            path: 'second',
+        });
+    });
+
+    it('parses multiple complex secret input', () => {
+        const output = parseSecretsInput('first a;second b|secondName');
+
+        expect(output).toHaveLength(2);
+        expect(output[0]).toMatchObject({
+            outputVarName: 'a',
+            envVarName: 'A',
+        });
+        expect(output[1]).toMatchObject({
+            outputVarName: 'secondName',
+            envVarName: 'secondName'
+        });
+    });
+
+    it('parses multiline input', () => {
+        const output = parseSecretsInput(`
+        first a;
+        second b;
+        third c | SOME_C;`);
+
+        expect(output).toHaveLength(3);
+        expect(output[0]).toMatchObject({
+            path: 'first',
+        });
+        expect(output[1]).toMatchObject({
+            outputVarName: 'b',
+            envVarName: 'B'
+        });
+        expect(output[2]).toMatchObject({
+            outputVarName: 'SOME_C',
+            envVarName: 'SOME_C',
+        });
+    });
+});
+
+describe('parseHeaders', () => {
+    it('parses simple header', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce('TEST: 1');
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toContainEqual(['test', '1']);
+    });
+
+    it('parses simple header with whitespace', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(`
+            TEST: 1
+            `);
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toContainEqual(['test', '1']);
+    });
+
+    it('parses multiple headers', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(`
+            TEST: 1
+            FOO: bAr
+            `);
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toContainEqual(['test', '1']);
+        expect(Array.from(result)).toContainEqual(['foo', 'bAr']);
+    });
+
+    it('parses null response', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(null);
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toHaveLength(0);
+    });
+});
+
+describe('exportSecrets', () => {
+    beforeEach(() => {
+        jest.resetAllMocks();
+
+        when(core.getInput)
+            .calledWith('url')
+            .mockReturnValueOnce('http://vault:8200');
+
+        when(core.getInput)
+            .calledWith('token')
+            .mockReturnValueOnce('EXAMPLE');
+    });
+
+    function mockInput(key) {
+        when(core.getInput)
+            .calledWith('secrets')
+            .mockReturnValueOnce(key);
+    }
+
+    function mockVersion(version) {
+        when(core.getInput)
+            .calledWith('kv-version')
+            .mockReturnValueOnce(version);
+    }
+
+    function mockExtraHeaders(headerString) {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(headerString);
+    }
+
+    function mockVaultData(data, version='2') {
+        switch(version) {
+            case '1':
+                got.extend.mockReturnValue({
+                    get: async () => ({ body: JSON.stringify({ data }) })
+                });
+            break;
+            case '2':
+                got.extend.mockReturnValue({
+                    get: async () => ({ body: JSON.stringify({ data: {
+                        data
+                    } }) })
+                });
+            break;
+        }
+    }
+
+    it('simple secret retrieval', async () => {
+        mockInput('test key');
+        mockVaultData({
+            key: 1
+        });
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
+    });
+
+    it('intl secret retrieval', async () => {
+        mockInput('测试 测试');
+        mockVaultData({
+            测试: 1
+        });
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('测试', '1');
+        expect(core.setOutput).toBeCalledWith('测试', '1');
+    });
+
+    it('mapped secret retrieval', async () => {
+        mockInput('test key|TEST_NAME');
+        mockVaultData({
+            key: 1
+        });
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('TEST_NAME', '1');
+        expect(core.setOutput).toBeCalledWith('TEST_NAME', '1');
+    });
+
+    it('simple secret retrieval from K/V v1', async () => {
+        const version = '1';
+
+        mockInput('test key');
+        mockExtraHeaders(`
+        TEST: 1
+        `);
+        mockVaultData({
+            key: 1
+        });
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
+    });
+
+    it('simple secret retrieval with extra headers', async () => {
+        const version = '1';
+
+        mockInput('test key');
+        mockVersion(version);
+        mockVaultData({
+            key: 1
+        }, version);
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
+    });
+
+    it('nested secret retrieval', async () => {
+        mockInput('test key.value');
+        mockVaultData({
+            key: { value: 1 }
+        });
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('KEY__VALUE', '1');
+        expect(core.setOutput).toBeCalledWith('key__value', '1');
+    });
+});
@@ -0,0 +1,81 @@
+// @ts-check
+const core = require('@actions/core');
+
+/***
+ * Authenticate with Vault and retrieve a Vault token that can be used for requests.
+ * @param {string} method
+ * @param {import('got').Got} client
+ */
+async function retrieveToken(method, client) {
+    switch (method) {
+        case 'approle': {
+            const vaultRoleId = core.getInput('roleId', { required: true });
+            const vaultSecretId = core.getInput('secretId', { required: true });
+            return await getClientToken(client, method, { role_id: vaultRoleId, secret_id: vaultSecretId });
+        }
+        case 'github': {
+            const githubToken = core.getInput('githubToken', { required: true });
+            return await getClientToken(client, method, { token: githubToken });
+        }
+        default: {
+            if (!method || method === 'token') {
+                return core.getInput('token', { required: true });
+            } else {
+                /** @type {string} */
+                const payload = core.getInput('authPayload', { required: true });
+                if (!payload) {
+                    throw Error('When using a custom authentication method, you must provide the payload');
+                }
+                return await getClientToken(client, method, JSON.parse(payload.trim()));
+            }
+        }
+    }
+}
+
+/***
+ * Call the appropriate login endpoint and parse out the token in the response.
+ * @param {import('got').Got} client
+ * @param {string} method
+ * @param {any} payload
+ */
+async function getClientToken(client, method, payload) {
+    /** @type {'json'} */
+    const responseType = 'json';
+    var options = {
+        json: payload,
+        responseType,
+    };
+
+    core.debug(`Retrieving Vault Token from v1/auth/${method}/login endpoint`);
+
+    /** @type {import('got').Response<VaultLoginResponse>} */
+    const response = await client.post(`v1/auth/${method}/login`, options);
+    if (response && response.body && response.body.auth && response.body.auth.client_token) {
+        core.debug('✔ Vault Token successfully retrieved');
+
+        core.startGroup('Token Info');
+        core.debug(`Operating under policies: ${JSON.stringify(response.body.auth.policies)}`);
+        core.debug(`Token Metadata: ${JSON.stringify(response.body.auth.metadata)}`);
+        core.endGroup();
+
+        return response.body.auth.client_token;
+    } else {
+        throw Error(`Unable to retrieve token from ${method}'s login endpoint.`);
+    }
+}
+
+/***
+ * @typedef {Object} VaultLoginResponse
+ * @property {{
+ *  client_token: string;
+ *  accessor: string;
+ *  policies: string[];
+ *  metadata: unknown;
+ *  lease_duration: number;
+ *  renewable: boolean;
+ * }} auth
+ */
+
+module.exports = {
+    retrieveToken,
+};
@@ -7,4 +7,4 @@ const { exportSecrets } = require('./action');
    } catch (error) {
        core.setFailed(error.message);
    }
-})();
+})();
@@ -0,0 +1,7 @@
+const auth = require('./auth');
+const secrets = require('./secrets');
+
+module.exports = {
+    auth,
+    secrets
+};
@@ -0,0 +1,82 @@
+const jsonata = require("jsonata");
+
+
+/**
+ * @typedef {Object} SecretRequest
+ * @property {string} path
+ * @property {string} selector
+ */
+
+/**
+ * @template {SecretRequest} TRequest
+ * @typedef {Object} SecretResponse
+ * @property {TRequest} request
+ * @property {string} value
+ * @property {boolean} cachedResponse
+ */
+
+ /**
+  * @template TRequest
+  * @param {Array<TRequest>} secretRequests
+  * @param {import('got').Got} client
+  * @return {Promise<SecretResponse<TRequest>[]>}
+  */
+async function getSecrets(secretRequests, client) {
+    const responseCache = new Map();
+    const results = [];
+    for (const secretRequest of secretRequests) {
+        let { path, selector } = secretRequest;
+
+        const requestPath = `v1/${path}`;
+        let body;
+        let cachedResponse = false;
+        if (responseCache.has(requestPath)) {
+            body = responseCache.get(requestPath);
+            cachedResponse = true;
+        } else {
+            const result = await client.get(requestPath);
+            body = result.body;
+            responseCache.set(requestPath, body);
+        }
+
+        selector = "data." + selector
+        body = JSON.parse(body)
+        if (body.data["data"] != undefined) {
+            selector = "data." + selector
+        }
+
+        const value = selectData(body, selector);
+        results.push({
+            request: secretRequest,
+            value,
+            cachedResponse
+        });
+    }
+    return results;
+}
+
+/**
+ * Uses a Jsonata selector retrieve a bit of data from the result
+ * @param {object} data 
+ * @param {string} selector 
+ */
+function selectData(data, selector) {
+    const ata = jsonata(selector);
+    let result = JSON.stringify(ata.evaluate(data));
+    // Compat for custom engines
+    if (!result && ata.ast().type === "path" && ata.ast()['steps'].length === 1 && selector !== 'data' && 'data' in data) {
+        result = JSON.stringify(jsonata(`data.${selector}`).evaluate(data));
+    } else if (!result) {
+        throw Error(`Unable to retrieve result for ${selector}. No match data was found. Double check your Key or Selector.`);
+    }
+
+    if (result.startsWith(`"`)) {
+        result = result.substring(1, result.length - 1);
+    }
+    return result;
+}
+
+module.exports = {
+    getSecrets,
+    selectData
+}
@@ -0,0 +1,12 @@
+{
+    "compilerOptions": {
+        "module": "commonjs",
+        "target": "es2019",
+        "moduleResolution": "node",
+        "allowJs": true,
+        "noEmit": true
+    },
+    "exclude": [
+        "node_modules"
+    ]
+}
Author	SHA1	Message	Date
Jason O'Donnell	e27b45646f	Update action.yml	2020-08-24 19:22:08 -04:00
Jason O'Donnell	76ca623af3	changelog++	2020-08-24 19:19:56 -04:00
Jason O'Donnell	c8b383ee4e	Update doc for TLS (#103 )	2020-08-12 11:53:00 -04:00
Jason O'Donnell	a214c8c65a	changelog++	2020-08-11 11:14:10 -04:00
Jason O'Donnell	f7f0d5a289	Simplify secret request UX (#102 ) * Simplify secret UX * Update doc * Fix tests	2020-08-11 10:06:28 -04:00
Jason O'Donnell	633de935e7	changelog++	2020-08-10 11:11:00 -04:00
Jason O'Donnell	5de67274a5	Merge pull request #101 from hashicorp/tlsSkipVerify Fix bug with tlsSkipVerify and add test coverage	2020-08-07 16:15:00 -04:00
Jason O'Donnell	e031fa076e	Add missing comment	2020-08-07 15:50:35 -04:00
Jason O'Donnell	e5ef6c9c11	Fix bug with tlsSkipVerify and add test coverage	2020-08-07 14:57:44 -04:00
Jason O'Donnell	6cf013b5c0	Merge pull request #100 from hashicorp/build Update build	2020-08-07 14:41:08 -04:00
Jason O'Donnell	098ee568ed	Update build	2020-08-07 14:11:20 -04:00
Jason O'Donnell	e055dfd1a4	Update build	2020-08-07 14:02:44 -04:00
Jason O'Donnell	b3a02289e7	Merge pull request #97 from hashicorp/tls Add TLS and mTLS	2020-08-06 14:30:53 -04:00
Jason O'Donnell	683c9b2557	Add toLower and type equality check	2020-08-06 11:10:44 -04:00
Jason O'Donnell	e59c94afbe	Add TLS and mTLS support	2020-08-05 16:36:27 -04:00
Jason O'Donnell	cd01494ae2	Merge pull request #96 from jweissig/patch-1 Updated README.md	2020-08-05 13:12:54 -04:00
Justin Weissig	a2d854da53	Updated README.md Minor spelling and grammar tweaks.	2020-07-31 14:33:00 -07:00
Jim Kalafut	d1321fc438	Update README.md	2020-07-31 14:17:53 -07:00
Jim Kalafut	5fb792e09f	Merge pull request #95 from hashicorp/readme Update repository	2020-07-31 14:13:29 -07:00
Jason O'Donnell	c63c61cd7e	Comment out publish workflow	2020-07-31 16:52:29 -04:00
Jason O'Donnell	944a2bea12	Add CHANGELOG	2020-07-31 16:45:59 -04:00
Jason O'Donnell	2f554c06ec	Update README	2020-07-31 16:45:04 -04:00
dependabot-preview[bot]	25ecb3dd46	chore(deps-dev): bump semantic-release from 17.0.4 to 17.0.6 (#46 ) Bumps [semantic-release](https://github.com/semantic-release/semantic-release) from 17.0.4 to 17.0.6. - [Release notes](https://github.com/semantic-release/semantic-release/releases) - [Commits](https://github.com/semantic-release/semantic-release/compare/v17.0.4...v17.0.6) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>	2020-04-17 10:40:23 -05:00
Richard Simpson	734d76c388	Update issue templates	2020-04-12 00:20:00 -05:00
Richard Simpson	22e3f3e09e	fix: mark actions dep as option	2020-04-12 00:10:54 -05:00
Richard Simpson	727494f451	feat: add npm publish and JSONata parsing BREAKING CHANGE: Switches Key retrieval to use JSONata for parsing. This allows for more powerful key retrieval and output, but resulted in a number of related changes to how both key retrieval is done and how "automatic" output & env keys are generated. Adds an NPM lib publish to allow consuming parts for other actions that may want to interact with Vault using vault-action's syntax or parts without being forced to use the action itself.	2020-04-12 00:00:18 -05:00
Richard Simpson	fa68886b06	chore(ci): use standard nodejs shipped with vms	2020-04-11 23:58:16 -05:00
Richard Simpson	a7527a3e8a	chore: make vault action consumable (#43 ) * chore: make vault action consumable * fix prefixless queries to default to data * fix the right build entrypoint * make output more forgiving and shore up selectors * clarify doc language * add npmtoken	2020-04-11 23:54:04 -05:00
Richard Simpson	9878eba70a	chore: rebuild action	2020-04-07 12:16:27 -05:00
Richard Simpson	83d944ba1a	fix: actually allow custom methods	2020-04-07 12:14:02 -05:00
Richard Simpson	567ec72c33	fix: document custom authentication method	2020-04-07 12:09:06 -05:00
Richard Simpson	5c464962be	feat: add generic auth (#39 ) * feat: add generic auth Adds the ability to authenticate against any normal Vault endpoint by added the `authPayload` input. When an unrecognized method is provided, the action will attempt to hit `v1/auth/<method>/login` with the provided `authPayload and parse out the token in the response	2020-04-04 13:19:48 -05:00
dependabot-preview[bot]	ea29244204	chore(deps): [security] bump minimist from 1.2.0 to 1.2.5 (#38 ) Bumps [minimist](https://github.com/substack/minimist) from 1.2.0 to 1.2.5. This update includes security fixes. - [Release notes](https://github.com/substack/minimist/releases) - [Commits](https://github.com/substack/minimist/compare/1.2.0...1.2.5) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>	2020-04-03 20:49:29 -05:00
Richard Simpson	5de02d5a14	docs: fix type	2020-04-03 12:34:34 -05:00
Richard Simpson	8845b5c724	docs: Actually mark required as required	2020-04-03 12:33:08 -05:00
Richard Simpson	c80d0b130c	docs: Clean up output a bit	2020-04-03 12:30:03 -05:00
Richard Simpson	01bb0f9bc9	docs: add reference	2020-04-03 12:24:42 -05:00
dependabot-preview[bot]	5a70924133	chore(deps-dev): bump semantic-release from 15.13.24 to 17.0.4 (#18 ) Bumps [semantic-release](https://github.com/semantic-release/semantic-release) from 15.13.24 to 17.0.4. - [Release notes](https://github.com/semantic-release/semantic-release/releases) - [Commits](https://github.com/semantic-release/semantic-release/compare/v15.13.24...v17.0.4) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>	2020-04-03 11:00:18 -05:00
dependabot-preview[bot]	b5fdbf352b	chore(deps-dev): bump jest-when from 2.7.0 to 2.7.1 (#34 ) Bumps [jest-when](https://github.com/timkindberg/jest-when) from 2.7.0 to 2.7.1. - [Release notes](https://github.com/timkindberg/jest-when/releases) - [Commits](https://github.com/timkindberg/jest-when/commits) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>	2020-04-03 10:53:49 -05:00
dependabot-preview[bot]	268a32f886	chore(deps-dev): bump @types/jest from 25.1.4 to 25.1.5 (#36 ) Bumps [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest) from 25.1.4 to 25.1.5. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>	2020-04-03 10:53:43 -05:00
dependabot-preview[bot]	f2b4d0b645	chore(deps-dev): bump jest from 25.2.1 to 25.2.7 (#37 ) Bumps [jest](https://github.com/facebook/jest) from 25.2.1 to 25.2.7. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/master/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/compare/v25.2.1...v25.2.7) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>	2020-04-03 10:53:38 -05:00
Richard Simpson	675d33e3da	docs: add note about exportEnv option	2020-04-03 10:52:40 -05:00
Richard Simpson	50ece41861	chore: I really should PR changes	2020-03-31 12:20:05 -05:00
Richard Simpson	ed8303ca53	fix: fix got not being use correctly and path prefix	2020-03-31 12:15:30 -05:00
Richard Simpson	0e719ef42a	chore: compile release	2020-03-31 12:01:15 -05:00
Richard Simpson	795c9eddca	feat: add github auth and cleanup docs a little Adds the GitHub Authentication method	2020-03-31 11:56:54 -05:00
dependabot-preview[bot]	9e8c0bad27	chore(deps): bump got from 10.6.0 to 10.7.0 (#30 ) Bumps [got](https://github.com/sindresorhus/got) from 10.6.0 to 10.7.0. - [Release notes](https://github.com/sindresorhus/got/releases) - [Commits](https://github.com/sindresorhus/got/compare/v10.6.0...v10.7.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>	2020-03-26 14:47:12 -05:00
dependabot-preview[bot]	751a3d19ad	chore(deps-dev): bump jest from 25.1.0 to 25.2.1 (#31 ) Bumps [jest](https://github.com/facebook/jest) from 25.1.0 to 25.2.1. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/master/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/compare/v25.1.0...v25.2.1) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>	2020-03-26 14:47:05 -05:00
dependabot-preview[bot]	cc7ceeef06	chore(deps-dev): bump @zeit/ncc from 0.21.1 to 0.22.0 (#29 ) Bumps [@zeit/ncc](https://github.com/zeit/ncc) from 0.21.1 to 0.22.0. - [Release notes](https://github.com/zeit/ncc/releases) - [Commits](https://github.com/zeit/ncc/compare/0.21.1...0.22.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>	2020-03-24 10:52:12 -05:00
dependabot-preview[bot]	fa23030c10	chore(deps): [security] bump acorn from 6.4.0 to 6.4.1 (#28 ) Bumps [acorn](https://github.com/acornjs/acorn) from 6.4.0 to 6.4.1. This update includes a security fix. - [Release notes](https://github.com/acornjs/acorn/releases) - [Commits](https://github.com/acornjs/acorn/compare/6.4.0...6.4.1) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>	2020-03-13 20:07:36 -05:00
Richard Simpson	4561f9e26e	docs: fix typo and clarify masking	2020-03-11 14:16:21 -05:00
Richard Simpson	cb2908ac94	docs: promote non-key syntax sections	2020-03-11 14:12:53 -05:00
Richard Simpson	198a7ed7d2	docs: add headers docs and toc	2020-03-11 14:11:13 -05:00
Richard Simpson	4ab6f6070f	fix: release new action bundle	2020-03-11 14:02:39 -05:00
Richard Simpson	bef2eb0b90	feat: add the ability to set extra headers (#27 ) * feat: add the ability to set extra headers * switch to more generic map solution for headers	2020-03-11 14:02:13 -05:00
dependabot-preview[bot]	0ece1da433	chore(deps-dev): bump @types/jest from 25.1.3 to 25.1.4 (#26 ) Bumps [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest) from 25.1.3 to 25.1.4. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>	2020-03-10 16:25:50 -05:00
dependabot-preview[bot]	7fb0d673d1	chore(deps): bump @actions/core from 1.2.2 to 1.2.3 (#25 ) Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 1.2.2 to 1.2.3. - [Release notes](https://github.com/actions/toolkit/releases) - [Changelog](https://github.com/actions/toolkit/blob/master/packages/core/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>	2020-03-04 10:20:55 -06:00
Richard Simpson	4edbc9a77a	chore: fix step output syntax	2020-02-20 11:38:11 -06:00
Richard Simpson	5357098084	fix(tests): fix unit tests and improve e2e	2020-02-20 11:24:04 -06:00
dependabot-preview[bot]	3dfe7ff808	chore(deps): bump got from 10.5.7 to 10.6.0 Bumps [got](https://github.com/sindresorhus/got) from 10.5.7 to 10.6.0. - [Release notes](https://github.com/sindresorhus/got/releases) - [Commits](https://github.com/sindresorhus/got/compare/v10.5.7...v10.6.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>	2020-02-20 17:14:12 +00:00
dependabot-preview[bot]	1049321b7a	chore(deps-dev): bump @types/jest from 24.0.18 to 25.1.3 Bumps [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest) from 24.0.18 to 25.1.3. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>	2020-02-20 17:14:05 +00:00
Richard Simpson	ec10b5e257	feat: add ability to retrieve secrets via ouputs	2020-02-20 11:13:47 -06:00
Richard Simpson	7d1d7d26ad	fix(build): bump build file	2020-02-20 01:48:49 -06:00
dependabot-preview[bot]	f9753d75ef	chore(deps-dev): bump jest from 24.9.0 to 25.1.0 Bumps [jest](https://github.com/facebook/jest) from 24.9.0 to 25.1.0. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/master/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/compare/v24.9.0...v25.1.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>	2020-02-20 07:45:21 +00:00
Richard Simpson	11b4c03a67	fix(deps): fix comma issue in export variables	2020-02-20 01:43:53 -06:00
dependabot-preview[bot]	bd26be00ff	chore(deps): bump @actions/core from 1.1.1 to 1.2.2 Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 1.1.1 to 1.2.2. - [Release notes](https://github.com/actions/toolkit/releases) - [Changelog](https://github.com/actions/toolkit/blob/master/packages/core/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>	2020-02-20 07:42:55 +00:00
dependabot-preview[bot]	452a071f5c	chore(deps): bump got from 10.2.2 to 10.5.7 Bumps [got](https://github.com/sindresorhus/got) from 10.2.2 to 10.5.7. - [Release notes](https://github.com/sindresorhus/got/releases) - [Commits](https://github.com/sindresorhus/got/compare/v10.2.2...v10.5.7) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>	2020-02-20 07:41:41 +00:00
dependabot-preview[bot]	a11e5a2e84	chore(deps-dev): bump @zeit/ncc from 0.20.5 to 0.21.1 Bumps [@zeit/ncc](https://github.com/zeit/ncc) from 0.20.5 to 0.21.1. - [Release notes](https://github.com/zeit/ncc/releases) - [Commits](https://github.com/zeit/ncc/compare/0.20.5...0.21.1) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>	2020-02-20 07:41:00 +00:00
dependabot-preview[bot]	7f552b0d14	chore(deps): [security] bump https-proxy-agent from 2.2.2 to 2.2.4 Bumps [https-proxy-agent](https://github.com/TooTallNate/node-https-proxy-agent) from 2.2.2 to 2.2.4. This update includes security fixes. - [Release notes](https://github.com/TooTallNate/node-https-proxy-agent/releases) - [Commits](https://github.com/TooTallNate/node-https-proxy-agent/compare/2.2.2...2.2.4) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>	2020-02-20 07:39:46 +00:00
Richard Simpson	20f954e024	chore: add place to buy me a coffee ☕	2020-02-06 09:19:22 -06:00
Richard Simpson	a884aa8e59	docs: clarify other engine support.	2020-02-05 16:37:16 -06:00
Richard Simpson	0188d9d223	feat: add support for (nearly) any engine (#15 ) * feat: add support for (nearly) any engine * cache response and fixup data depth logic * use starting slash as non-kv sentinel value * add tests for custom engines * improve docs and add descriptor of generic support * update dist	2020-02-05 16:33:12 -06:00
Giancarlo França	f229481670	feat: support for KV version 1 and custom-named engines (#12 ) * feat: kv v1 and engine path * doc: add custom version and engine path usage docs Co-authored-by: Richard Simpson <richardsimpson@outlook.com>	2020-02-04 09:40:55 -06:00
Antoine Méausoone	3b9239de79	feat(authenticate): add approle auth method (#10 ) * feat(authenticate): add approle auth method * docs(readme): update readme * fix: update index.js * fix: update got to 10.2.2 to fix ncc * chore: clean up code slightly * chore: update tests to use got correctly * chore(test): fix integration tests * chore: streamline method logic * chore: make role and secret required in approle Co-authored-by: Sébastien FAUVART <sebastien.fauvart@gmail.com> Co-authored-by: Richard Simpson <richardsimpson@outlook.com>	2020-01-28 19:10:19 -06:00
Richard Simpson	7a9634236c	chore(build): re-enable builds on PR and restrict publish to master	2020-01-09 10:45:52 -06:00
Richard Simpson	ab4dc55b2e	fix: actually build namespace changes	2020-01-09 10:31:15 -06:00
dependabot[bot]	e394527e23	chore(deps): bump handlebars from 4.2.1 to 4.5.3 (#9 ) Bumps [handlebars](https://github.com/wycats/handlebars.js) from 4.2.1 to 4.5.3. - [Release notes](https://github.com/wycats/handlebars.js/releases) - [Changelog](https://github.com/wycats/handlebars.js/blob/master/release-notes.md) - [Commits](https://github.com/wycats/handlebars.js/compare/v4.2.1...v4.5.3) Signed-off-by: dependabot[bot] <support@github.com>	2019-12-29 21:04:07 -06:00
dependabot[bot]	29150a8fd2	chore(deps): bump npm from 6.11.3 to 6.13.4 (#8 ) Bumps [npm](https://github.com/npm/cli) from 6.11.3 to 6.13.4. - [Release notes](https://github.com/npm/cli/releases) - [Changelog](https://github.com/npm/cli/blob/latest/CHANGELOG.md) - [Commits](https://github.com/npm/cli/compare/v6.11.3...v6.13.4) Signed-off-by: dependabot[bot] <support@github.com>	2019-12-13 13:56:22 -06:00
Richard Simpson	38c189f087	chore(test): organize tests a bit better (#7 ) * chore(test): organize tests a bit better * add caching	2019-11-24 16:00:31 -06:00
Antoine Méausoone	3747195c5f	feat(namespace): handle request on vault namespace (#5 ) * feat(namespace): handle request on vault namespace	2019-11-24 15:21:11 -06:00
Richard Simpson	0104a02854	doc: fix old docs	2019-10-16 10:23:36 -05:00
Richard Simpson	c81d6f1774	doc: add small clarification comment	2019-10-16 10:17:12 -05:00
Richard Simpson	da9a93f3f5	fix: package action (#3 ) Package action output per github docs.	2019-10-15 14:00:01 -05:00