chore: I really should PR changes

Adds the GitHub Authentication method

.github/FUNDING.yml

@@ -0,0 +1 @@
+ko_fi: richicoder

.github/workflows/build.yml

@@ -112,6 +112,7 @@ jobs:
         VAULT_PORT: ${{ job.services.vault.ports[8200] }}
     - name: use vault action (default K/V version 2)
       uses: ./
+      id: kv-secrets
       with:
         url: http://localhost:${{ job.services.vault.ports[8200] }}
         token: testtoken
@@ -130,8 +131,18 @@ jobs:
           test altSecret ;
           test altSecret | NAMED_ALTSECRET ;
           nested/test otherAltSecret ;
+    - name: use vault action (using cubbyhole engine)
+      uses: ./
+      with:
+        url: http://localhost:${{ job.services.vault.ports[8200] }}
+        token: testtoken
+        secrets: |
+          /cubbyhole/test foo ;
+          /cubbyhole/test zip | NAMED_CUBBYSECRET ;
     - name: verify
       run: npm run test:e2e
+      env:
+        OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
 
   publish:
     if: github.event_name	== 'push' && contains(github.ref, 'master')

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+    "markdown-toc.depthFrom": 2
+}

README.md

@@ -1,8 +1,26 @@
 # vault-action
 
-A helper action for easily pulling secrets from the K/V backend of vault.
+A helper action for easily pulling secrets from HashiCorp Vault™.
 
-Expects [Version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2/) of the KV Secrets Engine by default.
+By default, this action pulls from  [Version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2/) of the K/V Engine. See examples below for how to [use v1](#using-kv-version-1) as well as [other non-K/V engines](#other-secret-engines).
+
+<!-- TOC -->
+
+- [Example Usage](#example-usage)
+- [Authentication method](#authentication-method)
+- [Key Syntax](#key-syntax)
+    - [Simple Key](#simple-key)
+    - [Set Output Variable Name](#set-output-variable-name)
+    - [Multiple Secrets](#multiple-secrets)
+    - [Using K/V version 1](#using-kv-version-1)
+- [Custom K/V Engine Path](#custom-kv-engine-path)
+- [Other Secret Engines](#other-secret-engines)
+- [Adding Extra Headers](#adding-extra-headers)
+- [Vault Enterprise Features](#vault-enterprise-features)
+    - [Namespace](#namespace)
+- [Masking - Hidding Secrets from Logs](#masking---hidding-secrets-from-logs)
+
+<!-- /TOC -->
 
 ## Example Usage
 
@@ -26,15 +44,16 @@ jobs:
 
 ## Authentication method
 
-The `method` parameter can have these value :
+While most workflows will likely use a vault token, you can also use an `approle` to authenticate with vaule. You can configure which by using the `method` parameter:
-- **token**: (by default) you must provide a token parameter
+
+- **token**: (by default) you must provide a `token` parameter
 ```yaml
 ...
 with:
   url: https://vault.mycompany.com:8200
   token: ${{ secrets.VaultToken }}
 ```
-- **approle**: you must provide a roleId & secretId parameter
+- **approle**: you must provide a `roleId` & `secretId` parameter
 ```yaml
 ...
 with:
@@ -43,6 +62,14 @@ with:
   roleId: ${{ secrets.roleId }}
   secretId: ${{ secrets.secretId }}
 ```
+- **github**: you must provide the github token as `githubToken`
+```yaml
+...
+with:
+  url: https://vault.mycompany.com:8200
+  method: github
+  githubToken: ${{ secrets.GITHUB_TOKEN }}
+```
 
 ## Key Syntax
 
@@ -51,7 +78,7 @@ The `secrets` parameter is a set of multiple secret requests separated by the `;
 Each secret request is comprised of the `path` and the `key` of the desired secret, and optionally the desired Env Var output name.
 
 ```raw
-{{ Secret Path }} {{ Secret Key }} | {{ Output Environment Variable Name }}
+{{ Secret Path }} {{ Secret Key }} | {{ Output Variable Name }}
 ```
 
 ### Simple Key
@@ -63,15 +90,28 @@ with:
     secrets: ci npmToken
 ```
 
-`vault-action` will automatically normalize the given data key, and output:
+`vault-action` will automatically normalize the given secret selector key, and set the follow as environment variables for the following steps in the current job:
 
 ```bash
 NPMTOKEN=somelongtoken
 ```
 
-### Set Environment Variable Name
+You can also access the secret via ouputs:
 
-However, if you want to set it to a specific environmental variable, say `NPM_TOKEN`, you could do this instead:
+```yaml
+steps:
+    # ...
+    - name: Import Secrets
+      id: secrets
+      # Import config...
+    - name: Sensitive Operation
+      run: "my-cli --token '${{ steps.secrets.outputs.npmToken }}'"
+
+```
+
+### Set Output Variable Name
+
+However, if you want to set it to a specific name, say `NPM_TOKEN`, you could do this instead:
 
 ```yaml
 with:
@@ -84,6 +124,17 @@ With that, `vault-action` will now use your requested name and output:
 NPM_TOKEN=somelongtoken
 ```
 
+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.NPM_TOKEN }}'"
+
+```
+
 ### Multiple Secrets
 
 This action can take multi-line input, so say you had your AWS keys stored in a path and wanted to retrieve both of them. You can do:
@@ -106,7 +157,7 @@ with:
     kv-version: 1
 ```
 
-### Custom Engine Path
+## Custom K/V Engine Path
 
 When you enable the K/V Engine, by default it's placed at the path `secret`, so a secret named `ci` will be accessed from `secret/ci`. However, [if you enabled the secrets engine using a custom `path`](https://www.vaultproject.io/docs/commands/secrets/enable/#inlinecode--path-4), you
 can pass it as follows:
@@ -119,9 +170,85 @@ with:
 
 This way, the `ci` secret in the example above will be retrieved from `my-secrets/ci`.
 
+## Other Secret Engines
+
+While this action primarily supports the K/V engine, it is possible to request secrets from other engines in Vault.
+
+To do so when specifying the `Secret Path`, just append a leading formard slash (`/`) and specify the path as described in the Vault API documentation.
+
+For example, to retrieve a stored secret from the [`cubbyhole` engine](https://www.vaultproject.io/api-docs/secret/cubbyhole/), assuming you have a stored secret at the path `foo` with the contents:
+
+```json
+{
+  "foo": "bar",
+  "zip": "zap"
+}
+```
+
+You could request the contents like so:
+
+```yaml
+with:
+    secrets: |
+        /cubbyhole/foo foo ;
+        /cubbyhole/foo zip | MY_KEY ;
+```
+
+Resulting in:
+
+```bash
+FOO=bar
+MY_KEY=zap
+```
+
+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.foo }}'"
+  - name: Another Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.MY_KEY }}'"
+```
+
+Secrets pulled from the same `Secret Path` are cached by default. So if you, for example, are using the `aws` engine and retrieve a key, only a single key for a given path is returned.
+
+e.g.:
+
+```yaml
+with:
+    secrets: |
+        /aws/creds/ci access_key | AWS_ACCESS_KEY_ID ;
+        /aws/creds/ci secret_key | AWS_SECRET_ACCESS_KEY
+```
+
+would work fine.
+
+NOTE: The `Secret Key` is pulled from the `data` property of the response.
+
+## Adding Extra Headers
+
+If you ever need to add extra headers to the vault request, say if you need to authenticate with a firewall, all you need to do is set `extraHeaders`:
+
+```yaml
+with:
+    secrets: |
+        ci/aws accessKey | AWS_ACCESS_KEY_ID ;
+        ci/aws secretKey | AWS_SECRET_ACCESS_KEY
+    extraHeaders: |
+      X-Secure-Id: ${{ secrets.SECURE_ID }}
+      X-Secure-Secret: ${{ secrets.SECURE_SECRET }}
+```
+
+This will automatically add the `x-secure-id` and `x-secure-secret` headers to every request to vault.
+
+## Vault Enterprise Features
+
 ### Namespace
 
-This action could be use with namespace Vault Enterprise feature. You can specify namespace in request :
+If you need to retrieve secrets from a specific vault namespace, all that's required is an additional parameter specifying the namespace.
 
 ```yaml
 steps:
@@ -139,6 +266,7 @@ steps:
             ci npm_token
 ```
 
-## Masking
+## Masking - Hidding Secrets from Logs
 
-This action uses Github Action's built in masking, so all variables will automatically be masked if printed to the console or to logs.
+This action uses GitHub Action's built-in masking, so all variables will automatically be masked (aka hidden) if printed to the console or to logs.
+**This only obscures secrets from output logs.** If someone has the ability to edit your workflows, then they are able to read and therefore write secrets to somewhere else just like normal GitHub Secrets.

action.js

@@ -1,91 +1,118 @@
+// @ts-check
+
+// @ts-ignore
 const core = require('@actions/core');
+// @ts-ignore
 const command = require('@actions/core/lib/command');
 const got = require('got');
 
-const AUTH_METHODS = ['approle', 'token'];
+const AUTH_METHODS = ['approle', 'token', 'github'];
+const VALID_KV_VERSION = [-1, 1, 2];
+
 async function exportSecrets() {
     const vaultUrl = core.getInput('url', { required: true });
     const vaultNamespace = core.getInput('namespace', { required: false });
+    const extraHeaders = parseHeadersInput('extraHeaders', { required: false });
+    const exportEnv = core.getInput('exportEnv', { required: false }) != 'false';
 
     let enginePath = core.getInput('path', { required: false });
     let kvVersion = core.getInput('kv-version', { required: false });
 
     const secretsInput = core.getInput('secrets', { required: true });
-    const secrets = parseSecretsInput(secretsInput);
+    const secretRequests = parseSecretsInput(secretsInput);
 
-    const vaultMethod = core.getInput('method', { required: false }) || 'token';
+    const vaultMethod = (core.getInput('method', { required: false }) || 'token').toLowerCase();
     if (!AUTH_METHODS.includes(vaultMethod)) {
         throw Error(`Sorry, the authentication method ${vaultMethod} is not currently supported.`);
     }
 
-    let vaultToken = null;
+    const defaultOptions = {
-    switch (vaultMethod) {
+        prefixUrl: vaultUrl,
-        case 'approle':
+        headers: {}
-            const vaultRoleId = core.getInput('roleId', { required: true });
-            const vaultSecretId = core.getInput('secretId', { required: true });
-            core.debug('Try to retrieve Vault Token from approle');
-            var options = {
-                headers: {},
-                json: { role_id: vaultRoleId, secret_id: vaultSecretId },
-                responseType: 'json'
-            };
-
-            if (vaultNamespace != null) {
-                options.headers["X-Vault-Namespace"] = vaultNamespace;
-            }
-
-            const result = await got.post(`${vaultUrl}/v1/auth/approle/login`, options);
-            if (result && result.body && result.body.auth && result.body.auth.client_token) {
-                vaultToken = result.body.auth.client_token;
-                core.debug('✔ Vault Token has retrieved from approle');
-            } else {
-                throw Error(`No token was retrieved with the role_id and secret_id provided.`);
-            }
-            break;
-        default:
-            vaultToken = core.getInput('token', { required: true });
-            break;
     }
 
+    for (const [headerName, headerValue] of extraHeaders) {
+        defaultOptions.headers[headerName] = headerValue;
+    }
+
+    if (vaultNamespace != null) {
+        defaultOptions.headers["X-Vault-Namespace"] = vaultNamespace;
+    }
+
+    const client = got.extend(defaultOptions);
+    const vaultToken = await retrieveToken(vaultMethod, /** @type {any} */ (client));
+
     if (!enginePath) {
         enginePath = 'secret';
     }
 
     if (!kvVersion) {
-        kvVersion = '2';
+        kvVersion = 2;
+    }
+    kvVersion = +kvVersion;
+
+    if (Number.isNaN(kvVersion) || !VALID_KV_VERSION.includes(kvVersion)) {
+        throw Error(`You must provide a valid K/V version (${VALID_KV_VERSION.slice(1).join(', ')}). Input: "${kvVersion}"`);
     }
 
-    if (kvVersion !== '1' && kvVersion !== '2') {
+    const responseCache = new Map();
-        throw Error(`You must provide a valid K/V version (1 or 2). Input: "${kvVersion}"`);
+    for (const secretRequest of secretRequests) {
-    }
+        const { secretPath, outputVarName, envVarName, secretSelector, isJSONPath } = secretRequest;
-
-    kvVersion = parseInt(kvVersion);
-
-    for (const secret of secrets) {
-        const { secretPath, outputName, secretKey } = secret;
         const requestOptions = {
             headers: {
                 'X-Vault-Token': vaultToken
             },
         };
 
+        for (const [headerName, headerValue] of extraHeaders) {
+            requestOptions.headers[headerName] = headerValue;
+        }
+
         if (vaultNamespace != null) {
             requestOptions.headers["X-Vault-Namespace"] = vaultNamespace;
         }
 
-        const requestPath = (kvVersion === 1)
+        let requestPath = `v1`;
-                            ? `${vaultUrl}/v1/${enginePath}/${secretPath}`
+        const kvRequest = !secretPath.startsWith('/')
-                            : `${vaultUrl}/v1/${enginePath}/data/${secretPath}`;
+        if (!kvRequest) {
-        const result = await got(requestPath, requestOptions);
+            requestPath += secretPath;
+        } else {
+           requestPath += (kvVersion === 2)
+                    ? `/${enginePath}/data/${secretPath}`
+                    : `/${enginePath}/${secretPath}`;
+        }
 
-        const secretData = parseResponse(result.body, kvVersion);
+        let body;
-        const value = secretData[secretKey];
+        if (responseCache.has(requestPath)) {
+            body = responseCache.get(requestPath);
+            core.debug('ℹ using cached response');
+        } else {
+            const result = await client.get(requestPath, requestOptions);
+            body = result.body;
+            responseCache.set(requestPath, body);
+        }
+
+        let dataDepth = isJSONPath === true ? 0 : kvRequest === false ? 1 : kvVersion;
+
+        const secretData = getResponseData(body, dataDepth);
+        const value = selectData(secretData, secretSelector, isJSONPath);
         command.issue('add-mask', value);
-        core.exportVariable(outputName, `${value}`);
+        if (exportEnv) {
-        core.debug(`✔ ${secretPath} => ${outputName}`);
+            core.exportVariable(envVarName, `${value}`);
+        }
+        core.setOutput(outputVarName, `${value}`);
+        core.debug(`✔ ${secretPath} => outputs.${outputVarName}${exportEnv ? ` | env.${envVarName}` : ''}`);
     }
 };
 
+/** @typedef {Object} SecretRequest 
+ * @property {string} secretPath
+ * @property {string} envVarName
+ * @property {string} outputVarName
+ * @property {string} secretSelector
+ * @property {boolean} isJSONPath
+*/
+
 /**
  * Parses a secrets input string into key paths and their resulting environment variable name.
  * @param {string} secretsInput
@@ -97,18 +124,18 @@ function parseSecretsInput(secretsInput) {
         .map(key => key.trim())
         .filter(key => key.length !== 0);
 
-    /** @type {{ secretPath: string; outputName: string; dataKey: string; }[]} */
+    /** @type {SecretRequest[]} */
     const output = [];
     for (const secret of secrets) {
         let path = secret;
-        let outputName = null;
+        let outputVarName = null;
 
         const renameSigilIndex = secret.lastIndexOf('|');
         if (renameSigilIndex > -1) {
             path = secret.substring(0, renameSigilIndex).trim();
-            outputName = secret.substring(renameSigilIndex + 1).trim();
+            outputVarName = secret.substring(renameSigilIndex + 1).trim();
 
-            if (outputName.length < 1) {
+            if (outputVarName.length < 1) {
                 throw Error(`You must provide a value when mapping a secret to a name. Input: "${secret}"`);
             }
         }
@@ -119,46 +146,108 @@ function parseSecretsInput(secretsInput) {
             .filter(part => part.length !== 0);
 
         if (pathParts.length !== 2) {
-            throw Error(`You must provide a valid path and key. Input: "${secret}"`)
+            throw Error(`You must provide a valid path and key. Input: "${secret}"`);
         }
 
-        const [secretPath, secretKey] = pathParts;
+        const [secretPath, secretSelector] = pathParts;
 
-        // If we're not using a mapped name, normalize the key path into a variable name.
+        const isJSONPath = secretSelector.includes('.');
-        if (!outputName) {
+
-            outputName = normalizeOutputKey(secretKey);
+        if (isJSONPath && !outputVarName) {
+            throw Error(`You must provide a name for the output key when using json selectors. Input: "${secret}"`);
+        }
+
+        let envVarName = outputVarName;
+        if (!outputVarName) {
+            outputVarName = secretSelector;
+            envVarName = normalizeOutputKey(outputVarName);
         }
 
         output.push({
             secretPath,
-            outputName,
+            envVarName,
-            secretKey
+            outputVarName,
+            secretSelector,
+            isJSONPath
         });
     }
     return output;
 }
 
+/***
+ * Authentication with Vault and retrieve a vault token
+ * @param {string} method
+ * @param {import('got')} client
+ */
+async function retrieveToken(method, client) {
+    switch (method) {
+        case 'approle': {
+            const vaultRoleId = core.getInput('roleId', { required: true });
+            const vaultSecretId = core.getInput('secretId', { required: true });
+            core.debug('Try to retrieve Vault Token from approle');
+
+            /** @type {any} */
+            var options = {
+                json: { role_id: vaultRoleId, secret_id: vaultSecretId },
+                responseType: 'json'
+            };
+
+            const result = await client.post(`v1/auth/approle/login`, options);
+            if (result && result.body && result.body.auth && result.body.auth.client_token) {
+                core.debug('✔ Vault Token has retrieved from approle');
+                return result.body.auth.client_token;
+            } else {
+                throw Error(`No token was retrieved with the role_id and secret_id provided.`);
+            }
+        }
+        case 'github': {
+            const githubToken = core.getInput('githubToken', { required: true });
+            core.debug('Try to retrieve Vault Token from approle');
+
+            /** @type {any} */
+            var options = {
+                json: { token: githubToken },
+                responseType: 'json'
+            };
+
+            const result = await client.post(`v1/auth/github/login`, options);
+            if (result && result.body && result.body.auth && result.body.auth.client_token) {
+                core.debug('✔ Vault Token has retrieved from approle');
+                return result.body.auth.client_token;
+            } else {
+                throw Error(`No token was retrieved with the role_id and secret_id provided.`);
+            }
+        }
+        default:
+            return core.getInput('token', { required: true });
+    }
+}
+
 /**
  * Parses a JSON response and returns the secret data
  * @param {string} responseBody
- * @param {number} kvVersion
+ * @param {number} dataLevel
  */
-function parseResponse(responseBody, kvVersion) {
+function getResponseData(responseBody, dataLevel) {
-    const parsedResponse = JSON.parse(responseBody);
+    let secretData = JSON.parse(responseBody);
-    let secretData;
 
-    switch(kvVersion) {
+    for (let i = 0; i < dataLevel; i++) {
-        case 1: {
+        secretData = secretData['data'];
-            secretData = parsedResponse.data;
+    }
-        } break;
+    return secretData;
+}
 
-        case 2: {
+/**
-            const vaultKeyData = parsedResponse.data;
+ * Parses a JSON response and returns the secret data
-            secretData = vaultKeyData.data;
+ * @param {Object} data
-        } break;
+ * @param {string} selector
+ */
+function selectData(data, selector, isJSONPath) {
+    if (!isJSONPath) {
+        return data[selector];
     }
 
-    return secretData;
+    // TODO: JSONPath
 }
 
 /**
@@ -169,9 +258,46 @@ function normalizeOutputKey(dataKey) {
     return dataKey.replace('/', '__').replace(/[^\w-]/, '').toUpperCase();
 }
 
+// @ts-ignore
+/**
+ * @param {string} input
+ */
+function parseBoolInput(input) {
+    if (input === null || input === undefined || input.trim() === '') {
+        return null;
+    }
+    return Boolean(input);
+}
+
+/**
+ * @param {string} inputKey
+ * @param {any} inputOptions
+ */
+function parseHeadersInput(inputKey, inputOptions) {
+    /** @type {string}*/
+    const rawHeadersString = core.getInput(inputKey, inputOptions) || '';
+    const headerStrings = rawHeadersString
+        .split('\n')
+        .map(line => line.trim())
+        .filter(line => line !== '');
+    return headerStrings
+        .reduce((map, line) => {
+            const seperator = line.indexOf(':');
+            const key = line.substring(0, seperator).trim().toLowerCase();
+            const value = line.substring(seperator + 1).trim();
+            if (map.has(key)) {
+                map.set(key, [map.get(key), value].join(', '));
+            } else {
+                map.set(key, value);
+            }
+            return map;
+        }, new Map());
+}
+
 module.exports = {
     exportSecrets,
     parseSecretsInput,
-    parseResponse,
+    parseResponse: getResponseData,
-    normalizeOutputKey
+    normalizeOutputKey,
+    parseHeadersInput
 };

action.test.js

@@ -7,7 +7,8 @@ const got = require('got');
 const {
     exportSecrets,
     parseSecretsInput,
-    parseResponse
+    parseResponse,
+    parseHeadersInput
 } = require('./action');
 
 const { when } = require('jest-when');
@@ -17,8 +18,10 @@ describe('parseSecretsInput', () => {
         const output = parseSecretsInput('test key');
         expect(output).toContainEqual({
             secretPath: 'test',
-            secretKey: 'key',
+            secretSelector: 'key',
-            outputName: 'KEY',
+            outputVarName: 'key',
+            envVarName: 'KEY',
+            isJSONPath: false
         });
     });
 
@@ -26,7 +29,8 @@ describe('parseSecretsInput', () => {
         const output = parseSecretsInput('test key|testName');
         expect(output).toHaveLength(1);
         expect(output[0]).toMatchObject({
-            outputName: 'testName',
+            outputVarName: 'testName',
+            envVarName: 'testName',
         });
     });
 
@@ -57,10 +61,12 @@ describe('parseSecretsInput', () => {
 
         expect(output).toHaveLength(2);
         expect(output[0]).toMatchObject({
-            outputName: 'A',
+            outputVarName: 'a',
+            envVarName: 'A',
         });
         expect(output[1]).toMatchObject({
-            outputName: 'secondName',
+            outputVarName: 'secondName',
+            envVarName: 'secondName'
         });
     });
 
@@ -75,14 +81,56 @@ describe('parseSecretsInput', () => {
             secretPath: 'first',
         });
         expect(output[1]).toMatchObject({
-            outputName: 'B',
+            outputVarName: 'b',
+            envVarName: 'B'
         });
         expect(output[2]).toMatchObject({
-            outputName: 'SOME_C',
+            outputVarName: 'SOME_C',
+            envVarName: 'SOME_C',
         });
     })
 });
 
+describe('parseHeaders', () => {
+    it('parses simple header', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce('TEST: 1');
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toContainEqual(['test', '1']);
+    });
+
+    it('parses simple header with whitespace', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(`
+            TEST: 1
+            `);
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toContainEqual(['test', '1']);
+    });
+
+    it('parses multiple headers', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(`
+            TEST: 1
+            FOO: bAr
+            `);
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toContainEqual(['test', '1']);
+        expect(Array.from(result)).toContainEqual(['foo', 'bAr']);
+    });
+
+    it('parses null response', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(null);
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toHaveLength(0);
+    });
+})
+
 describe('parseResponse', () => {
     // https://www.vaultproject.io/api/secret/kv/kv-v1.html#sample-response
     it('parses K/V version 1 response', () => {
@@ -141,22 +189,24 @@ describe('exportSecrets', () => {
             .mockReturnValueOnce(version);
     }
 
+    function mockExtraHeaders(headerString) {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(headerString);
+    }
+
     function mockVaultData(data, version='2') {
         switch(version) {
             case '1':
-                got.mockResolvedValue({
+                got.extend.mockReturnValue({
-                    body: JSON.stringify({
+                    get: async () => ({ body: JSON.stringify({ data }) })
-                        data
-                    })
                 });
             break;
             case '2':
-                got.mockResolvedValue({
+                got.extend.mockReturnValue({
-                    body: JSON.stringify({
+                    get: async () => ({ body: JSON.stringify({ data: {
-                        data: {
+                        data
-                            data
+                    } }) })
-                        }
-                    })
                 });
             break;
         }
@@ -171,6 +221,7 @@ describe('exportSecrets', () => {
         await exportSecrets();
 
         expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
     });
 
     it('mapped secret retrieval', async () => {
@@ -182,11 +233,29 @@ describe('exportSecrets', () => {
         await exportSecrets();
 
         expect(core.exportVariable).toBeCalledWith('TEST_NAME', '1');
+        expect(core.setOutput).toBeCalledWith('TEST_NAME', '1');
     });
 
     it('simple secret retrieval from K/V v1', async () => {
         const version = '1';
 
+        mockInput('test key');
+        mockExtraHeaders(`
+        TEST: 1
+        `);
+        mockVaultData({
+            key: 1
+        });
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
+    });
+
+    it('simple secret retrieval with extra headers', async () => {
+        const version = '1';
+
         mockInput('test key');
         mockVersion(version);
         mockVaultData({
@@ -196,5 +265,6 @@ describe('exportSecrets', () => {
         await exportSecrets();
 
         expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
     });
 });

action.yml

@@ -4,15 +4,39 @@ inputs:
   url:
     description: 'The URL for the vault endpoint'
     required: true
-  token:
-    description: 'The Vault Token to be used to authenticate with Vault'
-    required: true
   secrets:
     description: 'A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details'
     required: true
   namespace:
     description: 'The Vault namespace from which to query secrets. Vault Enterprise only, unset by default'
     required: false
+  path:
+    description: 'The path of a non-default K/V engine'
+    required: false
+  kv-version:
+    description: 'The version of the K/V engine to use. Default: 2'
+    required: false
+  method:
+    description: 'The method to use to authenticate with Vault. Default: token'
+    required: false
+  token:
+    description: 'The Vault Token to be used to authenticate with Vault'
+    required: false
+  roleId:
+    description: 'The Role Id for App Role authentication'
+    required: false
+  secretId:
+    description: 'The Secret Id for App Role authentication'
+    required: false
+  githubToken:
+    description: 'The Github Token to be used to authenticate with Vault'
+    required: false
+  extraHeaders:
+    description: 'A string of newline separated extra headers to include on every request.'
+    required: false
+  exportEnv:
+    description: 'Whether or not export secrets as environment variables. Default: true'
+    required: false
 runs:
   using: 'node12'
   main: 'dist/index.js'

integrationTests/basic/integration.test.js

@@ -171,4 +171,40 @@ describe('integration', () => {
 
         expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERCUSTOMSECRET');
     });
+
+    describe('generic engines', () => {
+        beforeAll(async () => {
+            await got(`${vaultUrl}/v1/cubbyhole/test`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+                json: {
+                    foo: "bar",
+                    zip: "zap"
+                },
+            });
+        });
+
+        it('supports cubbyhole', async () => {            
+            mockInput('/cubbyhole/test foo');
+
+            await exportSecrets();
+
+            expect(core.exportVariable).toBeCalledWith('FOO', 'bar');
+        });
+
+        it('caches responses', async () => {            
+            mockInput(`
+            /cubbyhole/test foo ;
+            /cubbyhole/test zip`);
+
+            await exportSecrets();
+
+            expect(core.debug).toBeCalledWith('ℹ using cached response');
+
+            expect(core.exportVariable).toBeCalledWith('FOO', 'bar');
+            expect(core.exportVariable).toBeCalledWith('ZIP', 'zap');
+        });
+    })
 });

integrationTests/e2e/e2e.test.js

@@ -3,8 +3,11 @@ describe('e2e', () => {
         expect(process.env.SECRET).toBe("SUPERSECRET");
         expect(process.env.NAMED_SECRET).toBe("SUPERSECRET");
         expect(process.env.OTHERSECRET).toBe("OTHERSUPERSECRET");
+        expect(process.env.OTHER_SECRET_OUTPUT).toBe("OTHERSUPERSECRET");
         expect(process.env.ALTSECRET).toBe("CUSTOMSECRET");
         expect(process.env.NAMED_ALTSECRET).toBe("CUSTOMSECRET");
         expect(process.env.OTHERALTSECRET).toBe("OTHERCUSTOMSECRET");
+        expect(process.env.FOO).toBe("bar");
+        expect(process.env.NAMED_CUBBYSECRET).toBe("zap");
     });
 });

integrationTests/e2e/setup.js

@@ -64,6 +64,17 @@ const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
                 otherAltSecret: 'OTHERCUSTOMSECRET',
             },
         });
+
+        await got(`http://${vaultUrl}/v1/cubbyhole/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                foo: 'bar',
+                zip: 'zap',
+            },
+        });
     } catch (error) {
         console.log(error);
         process.exit(1);

integrationTests/enterprise/enterprise.test.js

@@ -212,7 +212,7 @@ describe('authenticate with approle', () => {
         jest.resetAllMocks();
 
         when(core.getInput)
-            .calledWith('method')
+            .calledWith('method', expect.anything())
             .mockReturnValueOnce('approle');
         when(core.getInput)
             .calledWith('roleId')
@@ -228,7 +228,7 @@ describe('authenticate with approle', () => {
             .mockReturnValueOnce('ns2');
     });
 
-    it('authenticate with approle', async()=> {
+    it('authenticate with approle', async() => {
         mockInput('test secret');
 
         await exportSecrets();

package.json

@@ -38,13 +38,14 @@
     },
     "homepage": "https://github.com/RichiCoder1/vault-action#readme",
     "dependencies": {
-        "@actions/core": "^1.1.1",
+        "@actions/core": "^1.2.2",
         "got": "^10.2.2"
     },
     "devDependencies": {
-        "@types/jest": "^24.0.18",
+        "@types/got": "^9.6.9",
-        "@zeit/ncc": "^0.20.5",
+        "@types/jest": "^25.1.3",
-        "jest": "^24.9.0",
+        "@zeit/ncc": "^0.22.0",
+        "jest": "^25.1.0",
         "jest-when": "^2.7.0",
         "semantic-release": "^15.13.24"
     }