chore: fix step output syntax

Bumps [got](https://github.com/sindresorhus/got) from 10.5.7 to 10.6.0.
- [Release notes](https://github.com/sindresorhus/got/releases)
- [Commits](https://github.com/sindresorhus/got/compare/v10.5.7...v10.6.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

.github/FUNDING.yml

@@ -0,0 +1 @@
+ko_fi: richicoder

.github/workflows/build.yml

@@ -112,6 +112,7 @@ jobs:
         VAULT_PORT: ${{ job.services.vault.ports[8200] }}
     - name: use vault action (default K/V version 2)
       uses: ./
+      id: kv-secrets
       with:
         url: http://localhost:${{ job.services.vault.ports[8200] }}
         token: testtoken
@@ -140,6 +141,8 @@ jobs:
           /cubbyhole/test zip | NAMED_CUBBYSECRET ;
     - name: verify
       run: npm run test:e2e
+      env:
+        OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
 
   publish:
     if: github.event_name	== 'push' && contains(github.ref, 'master')

README.md

@@ -2,7 +2,7 @@
 
 A helper action for easily pulling secrets from HashiCorp Vault™.
 
-By default, this action pulls from  [Version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2/) of the K/V Engine. See examples below for how to [use v1](#using-kv-version-1) as well as non-K/V engines.
+By default, this action pulls from  [Version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2/) of the K/V Engine. See examples below for how to [use v1](#using-kv-version-1) as well as [other non-K/V engines](#other-secret-engines).
 
 ## Example Usage
 
@@ -52,7 +52,7 @@ The `secrets` parameter is a set of multiple secret requests separated by the `;
 Each secret request is comprised of the `path` and the `key` of the desired secret, and optionally the desired Env Var output name.
 
 ```raw
-{{ Secret Path }} {{ Secret Key }} | {{ Output Environment Variable Name }}
+{{ Secret Path }} {{ Secret Key }} | {{ Output Variable Name }}
 ```
 
 ### Simple Key
@@ -64,15 +64,28 @@ with:
     secrets: ci npmToken
 ```
 
-`vault-action` will automatically normalize the given data key, and output:
+`vault-action` will automatically normalize the given secret selector key, and set the follow as environment variables for the following steps in the current job:
 
 ```bash
 NPMTOKEN=somelongtoken
 ```
 
-### Set Environment Variable Name
+You can also access the secret via ouputs:
 
-However, if you want to set it to a specific environmental variable, say `NPM_TOKEN`, you could do this instead:
+```yaml
+steps:
+    # ...
+    - name: Import Secrets
+      id: secrets
+      # Import config...
+    - name: Sensitive Operation
+      run: "my-cli --token '${{ steps.secrets.outputs.npmToken }}'"
+
+```
+
+### Set Output Variable Name
+
+However, if you want to set it to a specific name, say `NPM_TOKEN`, you could do this instead:
 
 ```yaml
 with:
@@ -85,6 +98,17 @@ With that, `vault-action` will now use your requested name and output:
 NPM_TOKEN=somelongtoken
 ```
 
+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.NPM_TOKEN }}'"
+
+```
+
 ### Multiple Secrets
 
 This action can take multi-line input, so say you had your AWS keys stored in a path and wanted to retrieve both of them. You can do:
@@ -147,7 +171,20 @@ with:
 Resulting in:
 
 ```bash
-FOO=bar MY_KEY=zap
+FOO=bar
+MY_KEY=zap
+```
+
+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.foo }}'"
+  - name: Another Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.MY_KEY }}'"
 ```
 
 Secrets pulled from the same `Secret Path` are cached by default. So if you, for example, are using the `aws` engine and retrieve a key, only a single key for a given path is returned.

action.js

@@ -1,4 +1,8 @@
+// @ts-check
+
+// @ts-ignore
 const core = require('@actions/core');
+// @ts-ignore
 const command = require('@actions/core/lib/command');
 const got = require('got');
 
@@ -36,6 +40,7 @@ async function exportSecrets() {
                 options.headers["X-Vault-Namespace"] = vaultNamespace;
             }
 
+            /** @type {any} */
             const result = await got.post(`${vaultUrl}/v1/auth/approle/login`, options);
             if (result && result.body && result.body.auth && result.body.auth.client_token) {
                 vaultToken = result.body.auth.client_token;
@@ -64,7 +69,7 @@ async function exportSecrets() {
 
     const responseCache = new Map();
     for (const secretRequest of secretRequests) {
-        const { secretPath, outputName, secretSelector, isJSONPath } = secretRequest;
+        const { secretPath, outputVarName, envVarName, secretSelector, isJSONPath } = secretRequest;
         const requestOptions = {
             headers: {
                 'X-Vault-Token': vaultToken
@@ -98,13 +103,22 @@ async function exportSecrets() {
         let dataDepth = isJSONPath === true ? 0 : kvRequest === false ? 1 : kvVersion;
 
         const secretData = getResponseData(body, dataDepth);
-        const value = selectData(secretData, secretSelector);
+        const value = selectData(secretData, secretSelector, isJSONPath);
         command.issue('add-mask', value);
-        core.exportVariable(outputName, `${value}`);
-        core.debug(`✔ ${secretPath} => ${outputName}`);
+        core.exportVariable(envVarName, `${value}`);
+        core.setOutput(outputVarName, `${value}`);
+        core.debug(`✔ ${secretPath} => outputs.${outputVarName} | env.${envVarName}`);
     }
 };
 
+/** @typedef {Object} SecretRequest 
+ * @property {string} secretPath
+ * @property {string} envVarName
+ * @property {string} outputVarName
+ * @property {string} secretSelector
+ * @property {boolean} isJSONPath
+*/
+
 /**
  * Parses a secrets input string into key paths and their resulting environment variable name.
  * @param {string} secretsInput
@@ -116,18 +130,18 @@ function parseSecretsInput(secretsInput) {
         .map(key => key.trim())
         .filter(key => key.length !== 0);
 
-    /** @type {{ secretPath: string; outputName: string; dataKey: string; }[]} */
+    /** @type {SecretRequest[]} */
     const output = [];
     for (const secret of secrets) {
         let path = secret;
-        let outputName = null;
+        let outputVarName = null;
 
         const renameSigilIndex = secret.lastIndexOf('|');
         if (renameSigilIndex > -1) {
             path = secret.substring(0, renameSigilIndex).trim();
-            outputName = secret.substring(renameSigilIndex + 1).trim();
+            outputVarName = secret.substring(renameSigilIndex + 1).trim();
 
-            if (outputName.length < 1) {
+            if (outputVarName.length < 1) {
                 throw Error(`You must provide a value when mapping a secret to a name. Input: "${secret}"`);
             }
         }
@@ -138,21 +152,29 @@ function parseSecretsInput(secretsInput) {
             .filter(part => part.length !== 0);
 
         if (pathParts.length !== 2) {
-            throw Error(`You must provide a valid path and key. Input: "${secret}"`)
+            throw Error(`You must provide a valid path and key. Input: "${secret}"`);
         }
 
         const [secretPath, secretSelector] = pathParts;
 
-        // If we're not using a mapped name, normalize the key path into a variable name.
-        if (!outputName) {
-            outputName = normalizeOutputKey(secretSelector);
+        const isJSONPath = secretSelector.includes('.');
+
+        if (isJSONPath && !outputVarName) {
+            throw Error(`You must provide a name for the output key when using json selectors. Input: "${secret}"`);
+        }
+
+        let envVarName = outputVarName;
+        if (!outputVarName) {
+            outputVarName = secretSelector;
+            envVarName = normalizeOutputKey(outputVarName);
         }
 
         output.push({
             secretPath,
-            outputName,
+            envVarName,
+            outputVarName,
             secretSelector,
-            isJSONPath: secretSelector.startsWith('$')
+            isJSONPath
         });
     }
     return output;
@@ -161,7 +183,7 @@ function parseSecretsInput(secretsInput) {
 /**
  * Parses a JSON response and returns the secret data
  * @param {string} responseBody
- * @param {number} kvVersion
+ * @param {number} dataLevel
  */
 function getResponseData(responseBody, dataLevel) {
     let secretData = JSON.parse(responseBody);
@@ -193,6 +215,7 @@ function normalizeOutputKey(dataKey) {
     return dataKey.replace('/', '__').replace(/[^\w-]/, '').toUpperCase();
 }
 
+// @ts-ignore
 function parseBoolInput(input) {
     if (input === null || input === undefined || input.trim() === '') {
         return null;

action.test.js

@@ -18,7 +18,8 @@ describe('parseSecretsInput', () => {
         expect(output).toContainEqual({
             secretPath: 'test',
             secretSelector: 'key',
-            outputName: 'KEY',
+            outputVarName: 'key',
+            envVarName: 'KEY',
             isJSONPath: false
         });
     });
@@ -27,7 +28,8 @@ describe('parseSecretsInput', () => {
         const output = parseSecretsInput('test key|testName');
         expect(output).toHaveLength(1);
         expect(output[0]).toMatchObject({
-            outputName: 'testName',
+            outputVarName: 'testName',
+            envVarName: 'testName',
         });
     });
 
@@ -58,10 +60,12 @@ describe('parseSecretsInput', () => {
 
         expect(output).toHaveLength(2);
         expect(output[0]).toMatchObject({
-            outputName: 'A',
+            outputVarName: 'a',
+            envVarName: 'A',
         });
         expect(output[1]).toMatchObject({
-            outputName: 'secondName',
+            outputVarName: 'secondName',
+            envVarName: 'secondName'
         });
     });
 
@@ -76,10 +80,12 @@ describe('parseSecretsInput', () => {
             secretPath: 'first',
         });
         expect(output[1]).toMatchObject({
-            outputName: 'B',
+            outputVarName: 'b',
+            envVarName: 'B'
         });
         expect(output[2]).toMatchObject({
-            outputName: 'SOME_C',
+            outputVarName: 'SOME_C',
+            envVarName: 'SOME_C',
         });
     })
 });
@@ -172,6 +178,7 @@ describe('exportSecrets', () => {
         await exportSecrets();
 
         expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
     });
 
     it('mapped secret retrieval', async () => {
@@ -183,6 +190,7 @@ describe('exportSecrets', () => {
         await exportSecrets();
 
         expect(core.exportVariable).toBeCalledWith('TEST_NAME', '1');
+        expect(core.setOutput).toBeCalledWith('TEST_NAME', '1');
     });
 
     it('simple secret retrieval from K/V v1', async () => {
@@ -197,5 +205,6 @@ describe('exportSecrets', () => {
         await exportSecrets();
 
         expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
     });
 });

integrationTests/e2e/e2e.test.js

@@ -3,6 +3,7 @@ describe('e2e', () => {
         expect(process.env.SECRET).toBe("SUPERSECRET");
         expect(process.env.NAMED_SECRET).toBe("SUPERSECRET");
         expect(process.env.OTHERSECRET).toBe("OTHERSUPERSECRET");
+        expect(process.env.OTHER_SECRET_OUTPUT).toBe("OTHERSUPERSECRET");
         expect(process.env.ALTSECRET).toBe("CUSTOMSECRET");
         expect(process.env.NAMED_ALTSECRET).toBe("CUSTOMSECRET");
         expect(process.env.OTHERALTSECRET).toBe("OTHERCUSTOMSECRET");

package.json

@@ -38,13 +38,13 @@
     },
     "homepage": "https://github.com/RichiCoder1/vault-action#readme",
     "dependencies": {
-        "@actions/core": "^1.1.1",
+        "@actions/core": "^1.2.2",
         "got": "^10.2.2"
     },
     "devDependencies": {
-        "@types/jest": "^24.0.18",
-        "@zeit/ncc": "^0.20.5",
-        "jest": "^24.9.0",
+        "@types/jest": "^25.1.3",
+        "@zeit/ncc": "^0.21.1",
+        "jest": "^25.1.0",
         "jest-when": "^2.7.0",
         "semantic-release": "^15.13.24"
     }