chore: fix step output syntax

fix(tests): fix unit tests and improve e2e
chore(deps): bump got from 10.5.7 to 10.6.0
2026-07-26 00:13:16 +03:00 · 2020-02-20 11:38:11 -06:00 · 2020-02-20 11:24:04 -06:00 · 2020-02-20 17:14:12 +00:00 · 2020-02-20 17:14:05 +00:00 · 2020-02-20 11:13:47 -06:00
8 changed files with 1288 additions and 355 deletions
@@ -112,6 +112,7 @@ jobs:
        VAULT_PORT: ${{ job.services.vault.ports[8200] }}
    - name: use vault action (default K/V version 2)
      uses: ./
+      id: kv-secrets
      with:
        url: http://localhost:${{ job.services.vault.ports[8200] }}
        token: testtoken
@@ -140,6 +141,8 @@ jobs:
          /cubbyhole/test zip | NAMED_CUBBYSECRET ;
    - name: verify
      run: npm run test:e2e
+      env:
+        OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}

  publish:
    if: github.event_name	== 'push' && contains(github.ref, 'master')
@@ -52,7 +52,7 @@ The `secrets` parameter is a set of multiple secret requests separated by the `;
 Each secret request is comprised of the `path` and the `key` of the desired secret, and optionally the desired Env Var output name.

 ```raw
-{{ Secret Path }} {{ Secret Key }} | {{ Output Environment Variable Name }}
+{{ Secret Path }} {{ Secret Key }} | {{ Output Variable Name }}
 ```

 ### Simple Key
@@ -64,15 +64,28 @@ with:
    secrets: ci npmToken
 ```

-`vault-action` will automatically normalize the given data key, and output:
+`vault-action` will automatically normalize the given secret selector key, and set the follow as environment variables for the following steps in the current job:

 ```bash
 NPMTOKEN=somelongtoken
 ```

-### Set Environment Variable Name
+You can also access the secret via ouputs:

-However, if you want to set it to a specific environmental variable, say `NPM_TOKEN`, you could do this instead:
+```yaml
+steps:
+    # ...
+    - name: Import Secrets
+      id: secrets
+      # Import config...
+    - name: Sensitive Operation
+      run: "my-cli --token '${{ steps.secrets.outputs.npmToken }}'"
+
+```
+
+### Set Output Variable Name
+
+However, if you want to set it to a specific name, say `NPM_TOKEN`, you could do this instead:

 ```yaml
 with:
@@ -85,6 +98,17 @@ With that, `vault-action` will now use your requested name and output:
 NPM_TOKEN=somelongtoken
 ```

+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.NPM_TOKEN }}'"
+
+```
+
 ### Multiple Secrets

 This action can take multi-line input, so say you had your AWS keys stored in a path and wanted to retrieve both of them. You can do:
@@ -147,7 +171,20 @@ with:
 Resulting in:

 ```bash
-FOO=bar MY_KEY=zap
+FOO=bar
+MY_KEY=zap
+```
+
+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.foo }}'"
+  - name: Another Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.MY_KEY }}'"
 ```

 Secrets pulled from the same `Secret Path` are cached by default. So if you, for example, are using the `aws` engine and retrieve a key, only a single key for a given path is returned.
@@ -1,4 +1,8 @@
+// @ts-check
+
+// @ts-ignore
 const core = require('@actions/core');
+// @ts-ignore
 const command = require('@actions/core/lib/command');
 const got = require('got');

@@ -36,6 +40,7 @@ async function exportSecrets() {
                options.headers["X-Vault-Namespace"] = vaultNamespace;
            }

+            /** @type {any} */
            const result = await got.post(`${vaultUrl}/v1/auth/approle/login`, options);
            if (result && result.body && result.body.auth && result.body.auth.client_token) {
                vaultToken = result.body.auth.client_token;
@@ -64,7 +69,7 @@ async function exportSecrets() {

    const responseCache = new Map();
    for (const secretRequest of secretRequests) {
-        const { secretPath, outputName, secretSelector, isJSONPath } = secretRequest;
+        const { secretPath, outputVarName, envVarName, secretSelector, isJSONPath } = secretRequest;
        const requestOptions = {
            headers: {
                'X-Vault-Token': vaultToken
@@ -98,13 +103,22 @@ async function exportSecrets() {
        let dataDepth = isJSONPath === true ? 0 : kvRequest === false ? 1 : kvVersion;

        const secretData = getResponseData(body, dataDepth);
-        const value = selectData(secretData, secretSelector);
+        const value = selectData(secretData, secretSelector, isJSONPath);
        command.issue('add-mask', value);
-        core.exportVariable(outputName, `${value}`);
-        core.debug(`✔ ${secretPath} => ${outputName}`);
+        core.exportVariable(envVarName, `${value}`);
+        core.setOutput(outputVarName, `${value}`);
+        core.debug(`✔ ${secretPath} => outputs.${outputVarName} | env.${envVarName}`);
    }
 };

+/** @typedef {Object} SecretRequest 
+ * @property {string} secretPath
+ * @property {string} envVarName
+ * @property {string} outputVarName
+ * @property {string} secretSelector
+ * @property {boolean} isJSONPath
+*/
+
 /**
 * Parses a secrets input string into key paths and their resulting environment variable name.
 * @param {string} secretsInput
@@ -116,18 +130,18 @@ function parseSecretsInput(secretsInput) {
        .map(key => key.trim())
        .filter(key => key.length !== 0);

-    /** @type {{ secretPath: string; outputName: string; dataKey: string; }[]} */
+    /** @type {SecretRequest[]} */
    const output = [];
    for (const secret of secrets) {
        let path = secret;
-        let outputName = null;
+        let outputVarName = null;

        const renameSigilIndex = secret.lastIndexOf('|');
        if (renameSigilIndex > -1) {
            path = secret.substring(0, renameSigilIndex).trim();
-            outputName = secret.substring(renameSigilIndex + 1).trim();
+            outputVarName = secret.substring(renameSigilIndex + 1).trim();

-            if (outputName.length < 1) {
+            if (outputVarName.length < 1) {
                throw Error(`You must provide a value when mapping a secret to a name. Input: "${secret}"`);
            }
        }
@@ -138,21 +152,29 @@ function parseSecretsInput(secretsInput) {
            .filter(part => part.length !== 0);

        if (pathParts.length !== 2) {
-            throw Error(`You must provide a valid path and key. Input: "${secret}"`)
+            throw Error(`You must provide a valid path and key. Input: "${secret}"`);
        }

        const [secretPath, secretSelector] = pathParts;

-        // If we're not using a mapped name, normalize the key path into a variable name.
-        if (!outputName) {
-            outputName = normalizeOutputKey(secretSelector);
+        const isJSONPath = secretSelector.includes('.');
+
+        if (isJSONPath && !outputVarName) {
+            throw Error(`You must provide a name for the output key when using json selectors. Input: "${secret}"`);
+        }
+
+        let envVarName = outputVarName;
+        if (!outputVarName) {
+            outputVarName = secretSelector;
+            envVarName = normalizeOutputKey(outputVarName);
        }

        output.push({
            secretPath,
-            outputName,
+            envVarName,
+            outputVarName,
            secretSelector,
-            isJSONPath: secretSelector.startsWith('$')
+            isJSONPath
        });
    }
    return output;
@@ -161,7 +183,7 @@ function parseSecretsInput(secretsInput) {
 /**
 * Parses a JSON response and returns the secret data
 * @param {string} responseBody
- * @param {number} kvVersion
+ * @param {number} dataLevel
 */
 function getResponseData(responseBody, dataLevel) {
    let secretData = JSON.parse(responseBody);
@@ -193,6 +215,7 @@ function normalizeOutputKey(dataKey) {
    return dataKey.replace('/', '__').replace(/[^\w-]/, '').toUpperCase();
 }

+// @ts-ignore
 function parseBoolInput(input) {
    if (input === null || input === undefined || input.trim() === '') {
        return null;
@@ -18,7 +18,8 @@ describe('parseSecretsInput', () => {
        expect(output).toContainEqual({
            secretPath: 'test',
            secretSelector: 'key',
-            outputName: 'KEY',
+            outputVarName: 'key',
+            envVarName: 'KEY',
            isJSONPath: false
        });
    });
@@ -27,7 +28,8 @@ describe('parseSecretsInput', () => {
        const output = parseSecretsInput('test key|testName');
        expect(output).toHaveLength(1);
        expect(output[0]).toMatchObject({
-            outputName: 'testName',
+            outputVarName: 'testName',
+            envVarName: 'testName',
        });
    });

@@ -58,10 +60,12 @@ describe('parseSecretsInput', () => {

        expect(output).toHaveLength(2);
        expect(output[0]).toMatchObject({
-            outputName: 'A',
+            outputVarName: 'a',
+            envVarName: 'A',
        });
        expect(output[1]).toMatchObject({
-            outputName: 'secondName',
+            outputVarName: 'secondName',
+            envVarName: 'secondName'
        });
    });

@@ -76,10 +80,12 @@ describe('parseSecretsInput', () => {
            secretPath: 'first',
        });
        expect(output[1]).toMatchObject({
-            outputName: 'B',
+            outputVarName: 'b',
+            envVarName: 'B'
        });
        expect(output[2]).toMatchObject({
-            outputName: 'SOME_C',
+            outputVarName: 'SOME_C',
+            envVarName: 'SOME_C',
        });
    })
 });
@@ -172,6 +178,7 @@ describe('exportSecrets', () => {
        await exportSecrets();

        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
    });

    it('mapped secret retrieval', async () => {
@@ -183,6 +190,7 @@ describe('exportSecrets', () => {
        await exportSecrets();

        expect(core.exportVariable).toBeCalledWith('TEST_NAME', '1');
+        expect(core.setOutput).toBeCalledWith('TEST_NAME', '1');
    });

    it('simple secret retrieval from K/V v1', async () => {
@@ -197,5 +205,6 @@ describe('exportSecrets', () => {
        await exportSecrets();

        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
    });
 });
@@ -3,6 +3,7 @@ describe('e2e', () => {
        expect(process.env.SECRET).toBe("SUPERSECRET");
        expect(process.env.NAMED_SECRET).toBe("SUPERSECRET");
        expect(process.env.OTHERSECRET).toBe("OTHERSUPERSECRET");
+        expect(process.env.OTHER_SECRET_OUTPUT).toBe("OTHERSUPERSECRET");
        expect(process.env.ALTSECRET).toBe("CUSTOMSECRET");
        expect(process.env.NAMED_ALTSECRET).toBe("CUSTOMSECRET");
        expect(process.env.OTHERALTSECRET).toBe("OTHERCUSTOMSECRET");
@@ -1891,20 +1891,136 @@
      }
    },
    "@types/jest": {
-      "version": "24.0.18",
-      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-24.0.18.tgz",
-      "integrity": "sha512-jcDDXdjTcrQzdN06+TSVsPPqxvsZA/5QkYfIZlq1JMw7FdP5AZylbOc+6B/cuDurctRe+MziUMtQ3xQdrbjqyQ==",
+      "version": "25.1.3",
+      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-25.1.3.tgz",
+      "integrity": "sha512-jqargqzyJWgWAJCXX96LBGR/Ei7wQcZBvRv0PLEu9ZByMfcs23keUJrKv9FMR6YZf9YCbfqDqgmY+JUBsnqhrg==",
      "dev": true,
      "requires": {
-        "@types/jest-diff": "*"
+        "jest-diff": "^25.1.0",
+        "pretty-format": "^25.1.0"
+      },
+      "dependencies": {
+        "@jest/types": {
+          "version": "25.1.0",
+          "resolved": "https://registry.npmjs.org/@jest/types/-/types-25.1.0.tgz",
+          "integrity": "sha512-VpOtt7tCrgvamWZh1reVsGADujKigBUFTi19mlRjqEGsE8qH4r3s+skY33dNdXOwyZIvuftZ5tqdF1IgsMejMA==",
+          "dev": true,
+          "requires": {
+            "@types/istanbul-lib-coverage": "^2.0.0",
+            "@types/istanbul-reports": "^1.1.1",
+            "@types/yargs": "^15.0.0",
+            "chalk": "^3.0.0"
+          }
+        },
+        "@types/yargs": {
+          "version": "15.0.3",
+          "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-15.0.3.tgz",
+          "integrity": "sha512-XCMQRK6kfpNBixHLyHUsGmXrpEmFFxzMrcnSXFMziHd8CoNJo8l16FkHyQq4x+xbM7E2XL83/O78OD8u+iZTdQ==",
+          "dev": true,
+          "requires": {
+            "@types/yargs-parser": "*"
+          }
+        },
+        "ansi-regex": {
+          "version": "5.0.0",
+          "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz",
+          "integrity": "sha512-bY6fj56OUQ0hU1KjFNDQuJFezqKdrAyFdIevADiqrWHwSlbmBNMHp5ak2f40Pm8JTFyM2mqxkG6ngkHO11f/lg==",
+          "dev": true
+        },
+        "ansi-styles": {
+          "version": "4.2.1",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.2.1.tgz",
+          "integrity": "sha512-9VGjrMsG1vePxcSweQsN20KY/c4zN0h9fLjqAbwbPfahM3t+NL+M9HC8xeXG2I8pX5NoamTGNuomEUFI7fcUjA==",
+          "dev": true,
+          "requires": {
+            "@types/color-name": "^1.1.1",
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-3.0.0.tgz",
+          "integrity": "sha512-4D3B6Wf41KOYRFdszmDqMCGq5VV/uMAB273JILmO+3jAlh8X4qDtdtgCR3fxtbLEMzSx22QdhnDcJvu2u1fVwg==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "diff-sequences": {
+          "version": "25.1.0",
+          "resolved": "https://registry.npmjs.org/diff-sequences/-/diff-sequences-25.1.0.tgz",
+          "integrity": "sha512-nFIfVk5B/NStCsJ+zaPO4vYuLjlzQ6uFvPxzYyHlejNZ/UGa7G/n7peOXVrVNvRuyfstt+mZQYGpjxg9Z6N8Kw==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-diff": {
+          "version": "25.1.0",
+          "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-25.1.0.tgz",
+          "integrity": "sha512-nepXgajT+h017APJTreSieh4zCqnSHEJ1iT8HDlewu630lSJ4Kjjr9KNzm+kzGwwcpsDE6Snx1GJGzzsefaEHw==",
+          "dev": true,
+          "requires": {
+            "chalk": "^3.0.0",
+            "diff-sequences": "^25.1.0",
+            "jest-get-type": "^25.1.0",
+            "pretty-format": "^25.1.0"
+          }
+        },
+        "jest-get-type": {
+          "version": "25.1.0",
+          "resolved": "https://registry.npmjs.org/jest-get-type/-/jest-get-type-25.1.0.tgz",
+          "integrity": "sha512-yWkBnT+5tMr8ANB6V+OjmrIJufHtCAqI5ic2H40v+tRqxDmE0PGnIiTyvRWFOMtmVHYpwRqyazDbTnhpjsGvLw==",
+          "dev": true
+        },
+        "pretty-format": {
+          "version": "25.1.0",
+          "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-25.1.0.tgz",
+          "integrity": "sha512-46zLRSGLd02Rp+Lhad9zzuNZ+swunitn8zIpfD2B4OPCRLXbM87RJT2aBLBWYOznNUML/2l/ReMyWNC80PJBUQ==",
+          "dev": true,
+          "requires": {
+            "@jest/types": "^25.1.0",
+            "ansi-regex": "^5.0.0",
+            "ansi-styles": "^4.0.0",
+            "react-is": "^16.12.0"
+          }
+        },
+        "react-is": {
+          "version": "16.12.0",
+          "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.12.0.tgz",
+          "integrity": "sha512-rPCkf/mWBtKc97aLL9/txD8DZdemK0vkA3JMLShjlJB3Pj3s+lpf1KaBzMfQrAmhMQB0n1cU/SUGgKKBCe837Q==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.1.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.1.0.tgz",
+          "integrity": "sha512-oRSIpR8pxT1Wr2FquTNnGet79b3BWljqOuoW/h4oBhxJ/HUbX5nX6JSruTkvXDCFMwDPvsaTTbvMLKZWSy0R5g==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
      }
    },
-    "@types/jest-diff": {
-      "version": "20.0.1",
-      "resolved": "https://registry.npmjs.org/@types/jest-diff/-/jest-diff-20.0.1.tgz",
-      "integrity": "sha512-yALhelO3i0hqZwhjtcr6dYyaLoCHbAMshwtj6cGxTvHZAKXHsYGdff6E8EPw3xLKY0ELUTQ69Q1rQiJENnccMA==",
-      "dev": true
-    },
    "@types/keyv": {
      "version": "3.1.1",
      "resolved": "https://registry.npmjs.org/@types/keyv/-/keyv-3.1.1.tgz",
@@ -3836,9 +3952,9 @@
      }
    },
    "got": {
-      "version": "10.5.7",
-      "resolved": "https://registry.npmjs.org/got/-/got-10.5.7.tgz",
-      "integrity": "sha512-ZDu27XJw4XuOM3wOjOfHPLQiyE0h/+CqX5DkfptEJD2bnn2idqua6uQl9HUGwgQE3Ogv8uOvE2W8jUTrTVrRbw==",
+      "version": "10.6.0",
+      "resolved": "https://registry.npmjs.org/got/-/got-10.6.0.tgz",
+      "integrity": "sha512-3LIdJNTdCFbbJc+h/EH0V5lpNpbJ6Bfwykk21lcQvQsEcrzdi/ltCyQehFHLzJ/ka0UMH4Slg0hkYvAZN9qUDg==",
      "requires": {
        "@sindresorhus/is": "^2.0.0",
        "@szmarczak/http-timer": "^4.0.0",
@@ -3849,7 +3965,7 @@
        "duplexer3": "^0.1.4",
        "get-stream": "^5.0.0",
        "lowercase-keys": "^2.0.0",
-        "mimic-response": "^2.0.0",
+        "mimic-response": "^2.1.0",
        "p-cancelable": "^2.0.0",
        "p-event": "^4.0.0",
        "responselike": "^2.0.0",
@@ -42,7 +42,7 @@
        "got": "^10.2.2"
    },
    "devDependencies": {
-        "@types/jest": "^24.0.18",
+        "@types/jest": "^25.1.3",
        "@zeit/ncc": "^0.21.1",
        "jest": "^25.1.0",
        "jest-when": "^2.7.0",
Author	SHA1	Message	Date
Richard Simpson	4edbc9a77a	chore: fix step output syntax	2020-02-20 11:38:11 -06:00
Richard Simpson	5357098084	fix(tests): fix unit tests and improve e2e	2020-02-20 11:24:04 -06:00
dependabot-preview[bot]	3dfe7ff808	chore(deps): bump got from 10.5.7 to 10.6.0 Bumps [got](https://github.com/sindresorhus/got) from 10.5.7 to 10.6.0. - [Release notes](https://github.com/sindresorhus/got/releases) - [Commits](https://github.com/sindresorhus/got/compare/v10.5.7...v10.6.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>	2020-02-20 17:14:12 +00:00
dependabot-preview[bot]	1049321b7a	chore(deps-dev): bump @types/jest from 24.0.18 to 25.1.3 Bumps [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest) from 24.0.18 to 25.1.3. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>	2020-02-20 17:14:05 +00:00
Richard Simpson	ec10b5e257	feat: add ability to retrieve secrets via ouputs	2020-02-20 11:13:47 -06:00
Richard Simpson	7d1d7d26ad	fix(build): bump build file	2020-02-20 01:48:49 -06:00