Update to v2.1.1 (#168)

Bumps [ini](https://github.com/isaacs/ini) from 1.3.5 to 1.3.8.
- [Release notes](https://github.com/isaacs/ini/releases)
- [Commits](https://github.com/isaacs/ini/compare/v1.3.5...v1.3.8)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/build.yml

@@ -2,9 +2,8 @@ on:
   push:
     branches:
       - master
-  pull_request:
-    branches:
-      - master
+  pull_request_target:
+    types: [opened, reopened, synchronize]
 
 jobs:
   build:

.github/workflows/jira.yaml

@@ -5,7 +5,6 @@ on:
     types: [opened, closed, reopened]
   issue_comment: # Also triggers when commenting on a PR from the conversation view
     types: [created]
-  workflow_dispatch:
 
 name: Jira Sync
 
@@ -36,26 +35,27 @@ jobs:
         JIRA_USER_EMAIL: ${{ secrets.JIRA_SYNC_USER_EMAIL }}
         JIRA_API_TOKEN: ${{ secrets.JIRA_SYNC_API_TOKEN }}
 
-    - name: Set ticket type
-      if: github.event.action == 'opened' && !steps.vault-team-role.outputs.role
-      id: set-ticket-type
+    - name: Preprocess
+      if: github.event.action == 'opened' || github.event.action == 'created'
+      id: preprocess
       run: |
         if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
           echo "::set-output name=type::PR"
         else
           echo "::set-output name=type::ISS"
         fi
+
     - name: Create ticket
       if: github.event.action == 'opened' && !steps.vault-team-role.outputs.role
-      uses: tomhjp/gh-action-jira-create@v0.1.3
+      uses: tomhjp/gh-action-jira-create@v0.2.0
       with:
         project: VAULT
         issuetype: "GH Issue"
-        summary: "${{ github.event.repository.name }} [${{ steps.set-ticket-type.outputs.type }} #${{ github.event.issue.number || github.event.pull_request.number }}]: ${{ github.event.issue.title || github.event.pull_request.title }}"
+        summary: "${{ github.event.repository.name }} [${{ steps.preprocess.outputs.type }} #${{ github.event.issue.number || github.event.pull_request.number }}]: ${{ github.event.issue.title || github.event.pull_request.title }}"
         description: "${{ github.event.issue.body || github.event.pull_request.body }}\n\n_Created from GitHub Action for ${{ github.event.issue.html_url || github.event.pull_request.html_url }} from ${{ github.actor }}_"
         # customfield_10089 is Issue Link custom field
         # customfield_10091 is team custom field
-        extraFields: '{"fixVersions": [{"name": "TBD"}], "customfield_10091": ["ecosystem"], "customfield_10089": "${{ github.event.issue.html_url || github.event.pull_request.html_url }}"}'
+        extraFields: '{"fixVersions": [{"name": "TBD"}], "customfield_10091": ["ecosystem", "runtime"], "customfield_10089": "${{ github.event.issue.html_url || github.event.pull_request.html_url }}"}'
 
     - name: Search
       if: github.event.action != 'opened'
@@ -67,7 +67,7 @@ jobs:
 
     - name: Sync comment
       if: github.event.action == 'created' && steps.search.outputs.issue
-      uses: tomhjp/gh-action-jira-comment@v0.1.0
+      uses: tomhjp/gh-action-jira-comment@v0.2.0
       with:
         issue: ${{ steps.search.outputs.issue }}
         comment: "${{ github.actor }} ${{ github.event.review.state || 'commented' }}:\n\n${{ github.event.comment.body || github.event.review.body }}\n\n${{ github.event.comment.html_url || github.event.review.html_url }}"

CHANGELOG.md

@@ -1,5 +1,22 @@
 ## Unreleased
 
+## 2.1.1 (December 15th, 2020)
+
+Improvements:
+* bump jest from 26.5.0 to 26.6.3 [GH-150](https://github.com/hashicorp/vault-action/pull/150)
+* bump semantic-release from 17.1.2 to 17.3.0 [GH-158](https://github.com/hashicorp/vault-action/pull/158)
+* bump got from 11.7.0 to 11.8.1 [GH-163](https://github.com/hashicorp/vault-action/pull/163)
+* bump @types/jest from 26.0.14 to 26.0.19 [GH-164](https://github.com/hashicorp/vault-action/pull/164)
+* bump ini from 1.3.5 to 1.3.8 [GH-167](https://github.com/hashicorp/vault-action/pull/167)
+
+## 2.1.0 (October 6th, 2020)
+
+Features:
+* Added `exportToken` to share the Vault token as an environment variable [GH-127](https://github.com/hashicorp/vault-action/pull/127)
+
+Security:
+* `action/core` updated to 1.2.6 to address minor CVE [GH-130](https://github.com/hashicorp/vault-action/pull/130)
+
 ## 2.0.1 (September 15th, 2020)
 
 Improvements:

README.md

@@ -36,7 +36,7 @@ jobs:
         steps:
             # ...
             - name: Import Secrets
-              uses: hashicorp/vault-action
+              uses: hashicorp/vault-action@v2.1.1
               with:
                 url: https://vault.mycompany.com:8200
                 token: ${{ secrets.VaultToken }}
@@ -161,9 +161,9 @@ with:
 
 ## Other Secret Engines
 
-Vault Action currently supports retrieving secrets from any engine where secrets 
-are retrieved via `GET` requests.  This means secret engines such as PKI are currently 
-not supported due to their requirement of sending parameters along with the request 
+Vault Action currently supports retrieving secrets from any engine where secrets
+are retrieved via `GET` requests.  This means secret engines such as PKI are currently
+not supported due to their requirement of sending parameters along with the request
 (such as `common_name`).
 
 For example, to request a secret from the `cubbyhole` secret engine:
@@ -250,10 +250,11 @@ Here are all the inputs available through `with`:
 | `authPayload`       | The JSON payload to be sent to Vault when using a custom authentication method.                                                                      |         |          |
 | `extraHeaders`      | A string of newline separated extra headers to include on every request.                                                                             |         |          |
 | `exportEnv`         | Whether or not export secrets as environment variables.                                                                                              | `true`  |          |
+| `exportToken`       | Whether or not export Vault token as environment variables (i.e VAULT_TOKEN).                                                                        | `false` |          |
 | `caCertificate`     | Base64 encoded CA certificate the server certificate was signed with.                                                                                |         |          |
 | `clientCertificate` | Base64 encoded client certificate the action uses to authenticate with Vault when mTLS is enabled.                                                   |         |          |
 | `clientKey`         | Base64 encoded client key the action uses to authenticate with Vault when mTLS is enabled.                                                           |         |          |
-| `tlsSkipVerify`     | When set to true, disables verification of server certificates when testing the action.                                                              | `false` |          | 
+| `tlsSkipVerify`     | When set to true, disables verification of server certificates when testing the action.                                                              | `false` |          |
 
 ## Masking - Hiding Secrets from Logs
 

action.yml

@@ -36,6 +36,10 @@ inputs:
     description: 'Whether or not export secrets as environment variables.'
     default: 'true'
     required: false
+  exportToken:
+    description: 'Whether or not export Vault token as environment variables.'
+    default: 'false'
+    required: false
   caCertificate:
     description: 'Base64 encoded CA certificate to verify the Vault server certificate.'
     required: false

dist/index.js

@@ -163,7 +163,7 @@ exports.default = (url) => {
         href: url.href,
         path: `${url.pathname || ''}${url.search || ''}`
     };
-    if (is_1.default.string(url.port) && url.port.length !== 0) {
+    if (is_1.default.string(url.port) && url.port.length > 0) {
         options.port = Number(url.port);
     }
     if (url.username || url.password) {
@@ -723,6 +723,32 @@ __exportStar(__webpack_require__(323), exports);
 __exportStar(__webpack_require__(577), exports);
 
 
+/***/ }),
+
+/***/ 82:
+/***/ (function(__unusedmodule, exports) {
+
+"use strict";
+
+// We use any as a valid input type
+/* eslint-disable @typescript-eslint/no-explicit-any */
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Sanitizes an input into a string so it can be passed into issueCommand safely
+ * @param input input to sanitize into a string
+ */
+function toCommandValue(input) {
+    if (input === null || input === undefined) {
+        return '';
+    }
+    else if (typeof input === 'string' || input instanceof String) {
+        return input;
+    }
+    return JSON.stringify(input);
+}
+exports.toCommandValue = toCommandValue;
+//# sourceMappingURL=utils.js.map
+
 /***/ }),
 
 /***/ 87:
@@ -812,6 +838,42 @@ class Response extends Readable {
 module.exports = Response;
 
 
+/***/ }),
+
+/***/ 102:
+/***/ (function(__unusedmodule, exports, __webpack_require__) {
+
+"use strict";
+
+// For internal use, subject to change.
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// We use any as a valid input type
+/* eslint-disable @typescript-eslint/no-explicit-any */
+const fs = __importStar(__webpack_require__(747));
+const os = __importStar(__webpack_require__(87));
+const utils_1 = __webpack_require__(82);
+function issueCommand(command, message) {
+    const filePath = process.env[`GITHUB_${command}`];
+    if (!filePath) {
+        throw new Error(`Unable to find environment variable for file command ${command}`);
+    }
+    if (!fs.existsSync(filePath)) {
+        throw new Error(`Missing file at path: ${filePath}`);
+    }
+    fs.appendFileSync(filePath, `${utils_1.toCommandValue(message)}${os.EOL}`, {
+        encoding: 'utf8'
+    });
+}
+exports.issueCommand = issueCommand;
+//# sourceMappingURL=file-command.js.map
+
 /***/ }),
 
 /***/ 121:
@@ -831,7 +893,7 @@ const parseBody = (response, responseType, parseJson, encoding) => {
             return rawBody.length === 0 ? '' : parseJson(rawBody.toString());
         }
         if (responseType === 'buffer') {
-            return Buffer.from(rawBody);
+            return rawBody;
         }
         throw new types_1.ParseError({
             message: `Unknown body type '${responseType}'`,
@@ -2447,7 +2509,7 @@ const create = (defaults) => {
         return result;
     }));
     // Got interface
-    const got = ((url, options, _defaults) => {
+    const got = ((url, options = {}, _defaults) => {
         var _a, _b;
         let iteration = 0;
         const iterateHandlers = (newOptions) => {
@@ -2468,7 +2530,7 @@ const create = (defaults) => {
             let initHookError;
             try {
                 callInitHooks(defaults.options.hooks.init, options);
-                callInitHooks((_a = options === null || options === void 0 ? void 0 : options.hooks) === null || _a === void 0 ? void 0 : _a.init, options);
+                callInitHooks((_a = options.hooks) === null || _a === void 0 ? void 0 : _a.init, options);
             }
             catch (error) {
                 initHookError = error;
@@ -2482,11 +2544,11 @@ const create = (defaults) => {
             return iterateHandlers(normalizedOptions);
         }
         catch (error) {
-            if (options === null || options === void 0 ? void 0 : options.isStream) {
+            if (options.isStream) {
                 throw error;
             }
             else {
-                return create_rejection_1.default(error, defaults.options.hooks.beforeError, (_b = options === null || options === void 0 ? void 0 : options.hooks) === null || _b === void 0 ? void 0 : _b.beforeError);
+                return create_rejection_1.default(error, defaults.options.hooks.beforeError, (_b = options.hooks) === null || _b === void 0 ? void 0 : _b.beforeError);
             }
         }
     });
@@ -10435,6 +10497,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const os = __importStar(__webpack_require__(87));
+const utils_1 = __webpack_require__(82);
 /**
  * Commands
  *
@@ -10488,28 +10551,14 @@ class Command {
         return cmdStr;
     }
 }
-/**
- * Sanitizes an input into a string so it can be passed into issueCommand safely
- * @param input input to sanitize into a string
- */
-function toCommandValue(input) {
-    if (input === null || input === undefined) {
-        return '';
-    }
-    else if (typeof input === 'string' || input instanceof String) {
-        return input;
-    }
-    return JSON.stringify(input);
-}
-exports.toCommandValue = toCommandValue;
 function escapeData(s) {
-    return toCommandValue(s)
+    return utils_1.toCommandValue(s)
         .replace(/%/g, '%25')
         .replace(/\r/g, '%0D')
         .replace(/\n/g, '%0A');
 }
 function escapeProperty(s) {
-    return toCommandValue(s)
+    return utils_1.toCommandValue(s)
         .replace(/%/g, '%25')
         .replace(/\r/g, '%0D')
         .replace(/\n/g, '%0A')
@@ -10688,7 +10737,9 @@ async function getSecrets(secretRequests, client) {
             body = result.body;
             responseCache.set(requestPath, body);
         }
-
+        if (!selector.match(/.*[\.].*/)) {
+            selector = '"' + selector + '"'
+        }
         selector = "data." + selector
         body = JSON.parse(body)
         if (body.data["data"] != undefined) {
@@ -10714,7 +10765,7 @@ function selectData(data, selector) {
     const ata = jsonata(selector);
     let result = JSON.stringify(ata.evaluate(data));
     // Compat for custom engines
-    if (!result && ata.ast().type === "path" && ata.ast()['steps'].length === 1 && selector !== 'data' && 'data' in data) {
+    if (!result && ((ata.ast().type === "path" && ata.ast()['steps'].length === 1) || ata.ast().type === "string") && selector !== 'data' && 'data' in data) {
         result = JSON.stringify(jsonata(`data.${selector}`).evaluate(data));
     } else if (!result) {
         throw Error(`Unable to retrieve result for ${selector}. No match data was found. Double check your Key or Selector.`);
@@ -10756,6 +10807,8 @@ var __importStar = (this && this.__importStar) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const command_1 = __webpack_require__(431);
+const file_command_1 = __webpack_require__(102);
+const utils_1 = __webpack_require__(82);
 const os = __importStar(__webpack_require__(87));
 const path = __importStar(__webpack_require__(622));
 /**
@@ -10782,9 +10835,17 @@ var ExitCode;
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function exportVariable(name, val) {
-    const convertedVal = command_1.toCommandValue(val);
+    const convertedVal = utils_1.toCommandValue(val);
     process.env[name] = convertedVal;
-    command_1.issueCommand('set-env', { name }, convertedVal);
+    const filePath = process.env['GITHUB_ENV'] || '';
+    if (filePath) {
+        const delimiter = '_GitHubActionsFileCommandDelimeter_';
+        const commandValue = `${name}<<${delimiter}${os.EOL}${convertedVal}${os.EOL}${delimiter}`;
+        file_command_1.issueCommand('ENV', commandValue);
+    }
+    else {
+        command_1.issueCommand('set-env', { name }, convertedVal);
+    }
 }
 exports.exportVariable = exportVariable;
 /**
@@ -10800,7 +10861,13 @@ exports.setSecret = setSecret;
  * @param inputPath
  */
 function addPath(inputPath) {
-    command_1.issueCommand('add-path', {}, inputPath);
+    const filePath = process.env['GITHUB_PATH'] || '';
+    if (filePath) {
+        file_command_1.issueCommand('PATH', inputPath);
+    }
+    else {
+        command_1.issueCommand('add-path', {}, inputPath);
+    }
     process.env['PATH'] = `${inputPath}${path.delimiter}${process.env['PATH']}`;
 }
 exports.addPath = addPath;
@@ -12016,7 +12083,11 @@ class CacheableLookup {
 				const newPromise = this.queryAndCache(hostname);
 				this._pending[hostname] = newPromise;
 
-				cached = await newPromise;
+				try {
+					cached = await newPromise;
+				} finally {
+					delete this._pending[hostname];
+				}
 			}
 		}
 
@@ -12130,29 +12201,21 @@ class CacheableLookup {
 			return this._dnsLookup(hostname, all);
 		}
 
-		try {
-			let query = await this._resolve(hostname);
+		let query = await this._resolve(hostname);
 
-			if (query.entries.length === 0 && this._fallback) {
-				query = await this._lookup(hostname);
+		if (query.entries.length === 0 && this._fallback) {
+			query = await this._lookup(hostname);
 
-				if (query.entries.length !== 0) {
-					// Use `dns.lookup(...)` for that particular hostname
-					this._hostnamesToFallback.add(hostname);
-				}
+			if (query.entries.length !== 0) {
+				// Use `dns.lookup(...)` for that particular hostname
+				this._hostnamesToFallback.add(hostname);
 			}
-
-			const cacheTtl = query.entries.length === 0 ? this.errorTtl : query.cacheTtl;
-			await this._set(hostname, query.entries, cacheTtl);
-
-			delete this._pending[hostname];
-
-			return query.entries;
-		} catch (error) {
-			delete this._pending[hostname];
-
-			throw error;
 		}
+
+		const cacheTtl = query.entries.length === 0 ? this.errorTtl : query.cacheTtl;
+		await this._set(hostname, query.entries, cacheTtl);
+
+		return query.entries;
 	}
 
 	_tick(ms) {
@@ -12391,9 +12454,10 @@ function asPromise(normalizedOptions) {
                 reject(error);
             };
             request.once('error', onError);
+            const previousBody = request.options.body;
             request.once('retry', (newRetryCount, error) => {
-                var _a;
-                if (is_1.default.nodeStream((_a = error.request) === null || _a === void 0 ? void 0 : _a.options.body)) {
+                var _a, _b;
+                if (previousBody === ((_a = error.request) === null || _a === void 0 ? void 0 : _a.options.body) && is_1.default.nodeStream((_b = error.request) === null || _b === void 0 ? void 0 : _b.options.body)) {
                     onError(error);
                     return;
                 }
@@ -12817,6 +12881,9 @@ exports.default = async (body, headers) => {
     }
     if (body instanceof fs_1.ReadStream) {
         const { size } = await statAsync(body.path);
+        if (size === 0) {
+            return undefined;
+        }
         return size;
     }
     return undefined;
@@ -14022,6 +14089,7 @@ async function exportSecrets() {
     const vaultNamespace = core.getInput('namespace', { required: false });
     const extraHeaders = parseHeadersInput('extraHeaders', { required: false });
     const exportEnv = core.getInput('exportEnv', { required: false }) != 'false';
+    const exportToken = (core.getInput('exportToken', { required: false }) || 'false').toLowerCase() != 'false';
 
     const secretsInput = core.getInput('secrets', { required: true });
     const secretRequests = parseSecretsInput(secretsInput);
@@ -14070,6 +14138,11 @@ async function exportSecrets() {
     defaultOptions.headers['X-Vault-Token'] = vaultToken;
     const client = got.extend(defaultOptions);
 
+    if (exportToken === true) {
+        command.issue('add-mask', vaultToken);
+        core.exportVariable('VAULT_TOKEN', `${vaultToken}`);
+    }
+
     const requests = secretRequests.map(request => {
         const { path, selector } = request;
         return request;
@@ -14134,12 +14207,13 @@ function parseSecretsInput(secretsInput) {
             throw Error(`You must provide a valid path and key. Input: "${secret}"`);
         }
 
-        const [path, selector] = pathParts;
+        const [path, selectorQuoted] = pathParts;
 
         /** @type {any} */
-        const selectorAst = jsonata(selector).ast();
+        const selectorAst = jsonata(selectorQuoted).ast();
+        const selector = selectorQuoted.replace(new RegExp('"', 'g'), '');
 
-        if ((selectorAst.type !== "path" || selectorAst.steps[0].stages) && !outputVarName) {
+        if ((selectorAst.type !== "path" || selectorAst.steps[0].stages) && selectorAst.type !== "string" && !outputVarName) {
             throw Error(`You must provide a name for the output key when using json selectors. Input: "${secret}"`);
         }
 
@@ -14166,7 +14240,7 @@ function parseSecretsInput(secretsInput) {
  */
 function normalizeOutputKey(dataKey, isEnvVar = false) {
     let outputKey = dataKey
-        .replace('.', '__').replace(/[^\p{L}\p{N}_-]/gu, '');
+        .replace('.', '__').replace(new RegExp('-', 'g'), '').replace(/[^\p{L}\p{N}_-]/gu, '');
     if (isEnvVar) {
         outputKey = outputKey.toUpperCase();
     }
@@ -14366,7 +14440,7 @@ class RequestError extends Error {
         }
         this.timings = (_a = this.request) === null || _a === void 0 ? void 0 : _a.timings;
         // Recover the original stacktrace
-        if (!is_1.default.undefined(error.stack)) {
+        if (is_1.default.string(error.stack) && is_1.default.string(this.stack)) {
             const indexOfMessage = this.stack.indexOf(this.message) + this.message.length;
             const thisStackTrace = this.stack.slice(indexOfMessage).split('\n').reverse();
             const errorStackTrace = error.stack.slice(error.stack.indexOf(error.message) + error.message.length).split('\n').reverse();
@@ -14509,18 +14583,28 @@ class Request extends stream_1.Duplex {
         if (json || body || form) {
             this._lockWrite();
         }
-        (async (nonNormalizedOptions) => {
+        if (exports.kIsNormalizedAlready in options) {
+            this.options = options;
+        }
+        else {
+            try {
+                // @ts-expect-error Common TypeScript bug saying that `this.constructor` is not accessible
+                this.options = this.constructor.normalizeArguments(url, options, defaults);
+            }
+            catch (error) {
+                // TODO: Move this to `_destroy()`
+                if (is_1.default.nodeStream(options.body)) {
+                    options.body.destroy();
+                }
+                this.destroy(error);
+                return;
+            }
+        }
+        (async () => {
             var _a;
             try {
-                if (nonNormalizedOptions.body instanceof fs_1.ReadStream) {
-                    await waitForOpenFile(nonNormalizedOptions.body);
-                }
-                if (exports.kIsNormalizedAlready in nonNormalizedOptions) {
-                    this.options = nonNormalizedOptions;
-                }
-                else {
-                    // @ts-expect-error Common TypeScript bug saying that `this.constructor` is not accessible
-                    this.options = this.constructor.normalizeArguments(url, nonNormalizedOptions, defaults);
+                if (this.options.body instanceof fs_1.ReadStream) {
+                    await waitForOpenFile(this.options.body);
                 }
                 const { url: normalizedURL } = this.options;
                 if (!normalizedURL) {
@@ -14552,7 +14636,7 @@ class Request extends stream_1.Duplex {
                     this.destroy(error);
                 }
             }
-        })(options);
+        })();
     }
     static normalizeArguments(url, options, defaults) {
         var _a, _b, _c, _d, _e;
@@ -14608,6 +14692,7 @@ class Request extends stream_1.Duplex {
             is_1.assert.any([is_1.default.string, is_1.default.object, is_1.default.array, is_1.default.undefined], options.https.key);
             is_1.assert.any([is_1.default.string, is_1.default.object, is_1.default.array, is_1.default.undefined], options.https.certificate);
             is_1.assert.any([is_1.default.string, is_1.default.undefined], options.https.passphrase);
+            is_1.assert.any([is_1.default.string, is_1.default.buffer, is_1.default.array, is_1.default.undefined], options.https.pfx);
         }
         is_1.assert.any([is_1.default.object, is_1.default.undefined], options.cacheOptions);
         // `options.method`
@@ -14686,6 +14771,9 @@ class Request extends stream_1.Duplex {
             options.url = options_to_url_1.default(options.prefixUrl, options);
         }
         if (options.url) {
+            if ('port' in options) {
+                delete options.port;
+            }
             // Make it possible to change `options.prefixUrl`
             let { prefixUrl } = options;
             Object.defineProperty(options, 'prefixUrl', {
@@ -14828,7 +14916,7 @@ class Request extends stream_1.Duplex {
         if (defaults && !areHooksDefault) {
             for (const event of exports.knownHookEvents) {
                 const defaultHooks = defaults.hooks[event];
-                if (defaultHooks.length !== 0) {
+                if (defaultHooks.length > 0) {
                     // See https://github.com/microsoft/TypeScript/issues/31445#issuecomment-576929044
                     options.hooks[event] = [
                         ...defaults.hooks[event],
@@ -14863,6 +14951,9 @@ class Request extends stream_1.Duplex {
         if ('passphrase' in options) {
             deprecation_warning_1.default('"options.passphrase" was never documented, please use "options.https.passphrase"');
         }
+        if ('pfx' in options) {
+            deprecation_warning_1.default('"options.pfx" was never documented, please use "options.https.pfx"');
+        }
         // Other options
         if ('followRedirects' in options) {
             throw new TypeError('The `followRedirects` option does not exist. Use `followRedirect` instead.');
@@ -15040,6 +15131,8 @@ class Request extends stream_1.Duplex {
                 if ('form' in options) {
                     delete options.form;
                 }
+                this[kBody] = undefined;
+                delete options.headers['content-length'];
             }
             if (this.redirects.length >= options.maxRedirects) {
                 this._beforeError(new MaxRedirectsError(this));
@@ -15064,16 +15157,14 @@ class Request extends stream_1.Duplex {
                         delete options.headers.authorization;
                     }
                     if (options.username || options.password) {
-                        // TODO: Fix this ignore.
-                        // @ts-expect-error
-                        delete options.username;
-                        // @ts-expect-error
-                        delete options.password;
-                    }
-                    if ('port' in options) {
-                        delete options.port;
+                        options.username = '';
+                        options.password = '';
                     }
                 }
+                else {
+                    redirectUrl.username = options.username;
+                    redirectUrl.password = options.password;
+                }
                 this.redirects.push(redirectString);
                 options.url = redirectUrl;
                 for (const hook of options.hooks.beforeRedirect) {
@@ -15147,12 +15238,7 @@ class Request extends stream_1.Duplex {
             request.destroy();
             // Node.js <= 12.18.2 mistakenly emits the response `end` first.
             (_a = request.res) === null || _a === void 0 ? void 0 : _a.removeAllListeners('end');
-            if (error instanceof timed_out_1.TimeoutError) {
-                error = new TimeoutError(error, this.timings, this);
-            }
-            else {
-                error = new RequestError(error.message, error, this);
-            }
+            error = error instanceof timed_out_1.TimeoutError ? new TimeoutError(error, this.timings, this) : new RequestError(error.message, error, this);
             this._beforeError(error);
         });
         this[kUnproxyEvents] = proxy_events_1.default(request, this, proxiedRequestEvents);
@@ -15240,6 +15326,9 @@ class Request extends stream_1.Duplex {
                 break;
             }
         }
+        if (options.body && this[kBody] !== options.body) {
+            this[kBody] = options.body;
+        }
         const { agent, request, timeout, url } = options;
         if (options.dnsCache && !('lookup' in options)) {
             options.lookup = options.dnsCache.lookup;
@@ -15312,6 +15401,9 @@ class Request extends stream_1.Duplex {
             if (options.https.passphrase) {
                 requestOptions.passphrase = options.https.passphrase;
             }
+            if (options.https.pfx) {
+                requestOptions.pfx = options.https.pfx;
+            }
         }
         try {
             let requestOrResponse = await fn(url, requestOptions);
@@ -15343,6 +15435,9 @@ class Request extends stream_1.Duplex {
                 if (options.https.passphrase) {
                     delete requestOptions.passphrase;
                 }
+                if (options.https.pfx) {
+                    delete requestOptions.pfx;
+                }
             }
             if (isClientRequest(requestOrResponse)) {
                 this._onRequest(requestOrResponse);
@@ -15507,7 +15602,7 @@ class Request extends stream_1.Duplex {
         });
         // TODO: What happens if it's from cache? Then this[kRequest] won't be defined.
         this[kRequest].write(chunk, encoding, (error) => {
-            if (!error && this._progressCallbacks.length !== 0) {
+            if (!error && this._progressCallbacks.length > 0) {
                 this._progressCallbacks.shift()();
             }
             callback(error);
@@ -15571,7 +15666,7 @@ class Request extends stream_1.Duplex {
     */
     get ip() {
         var _a;
-        return (_a = this[kRequest]) === null || _a === void 0 ? void 0 : _a.socket.remoteAddress;
+        return (_a = this.socket) === null || _a === void 0 ? void 0 : _a.remoteAddress;
     }
     /**
     Indicates whether the request has been aborted or not.
@@ -15581,8 +15676,8 @@ class Request extends stream_1.Duplex {
         return ((_b = (_a = this[kRequest]) === null || _a === void 0 ? void 0 : _a.destroyed) !== null && _b !== void 0 ? _b : this.destroyed) && !((_c = this[kOriginalResponse]) === null || _c === void 0 ? void 0 : _c.complete);
     }
     get socket() {
-        var _a;
-        return (_a = this[kRequest]) === null || _a === void 0 ? void 0 : _a.socket;
+        var _a, _b;
+        return (_b = (_a = this[kRequest]) === null || _a === void 0 ? void 0 : _a.socket) !== null && _b !== void 0 ? _b : undefined;
     }
     /**
     Progress event for downloading (receiving a response).

integrationTests/basic/integration.test.js

@@ -37,7 +37,7 @@ describe('integration', () => {
             },
             json: {
                 data: {
-                    otherSecret: 'OTHERSUPERSECRET',
+                    "other-Secret-dash": 'OTHERSUPERSECRET',
                 },
             }
         });
@@ -100,7 +100,7 @@ describe('integration', () => {
                 'X-Vault-Token': 'testtoken',
             },
             json: {
-                otherSecret: 'OTHERCUSTOMSECRET',
+                "other-Secret-dash": 'OTHERCUSTOMSECRET',
             },
         });
     });
@@ -140,18 +140,18 @@ describe('integration', () => {
     });
 
     it('get nested secret', async () => {
-        mockInput('secret/data/nested/test otherSecret');
+        mockInput(`secret/data/nested/test "other-Secret-dash"`);
 
         await exportSecrets();
 
-        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRETDASH', 'OTHERSUPERSECRET');
     });
 
     it('get multiple secrets', async () => {
         mockInput(`
         secret/data/test secret ;
         secret/data/test secret | NAMED_SECRET ;
-        secret/data/nested/test otherSecret ;`);
+        secret/data/nested/test "other-Secret-dash" ;`);
 
         await exportSecrets();
 
@@ -159,7 +159,7 @@ describe('integration', () => {
 
         expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET');
         expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET');
-        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRETDASH', 'OTHERSUPERSECRET');
     });
 
     it('leading slash kvv2', async () => {
@@ -179,11 +179,11 @@ describe('integration', () => {
     });
 
     it('get nested secret from K/V v1', async () => {
-        mockInput('secret-kv1/nested/test otherSecret');
+        mockInput('secret-kv1/nested/test "other-Secret-dash"');
 
         await exportSecrets();
 
-        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERCUSTOMSECRET');
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRETDASH', 'OTHERCUSTOMSECRET');
     });
 
     it('leading slash kvv1', async () => {

src/action.js

@@ -12,6 +12,7 @@ async function exportSecrets() {
     const vaultNamespace = core.getInput('namespace', { required: false });
     const extraHeaders = parseHeadersInput('extraHeaders', { required: false });
     const exportEnv = core.getInput('exportEnv', { required: false }) != 'false';
+    const exportToken = (core.getInput('exportToken', { required: false }) || 'false').toLowerCase() != 'false';
 
     const secretsInput = core.getInput('secrets', { required: true });
     const secretRequests = parseSecretsInput(secretsInput);
@@ -60,6 +61,11 @@ async function exportSecrets() {
     defaultOptions.headers['X-Vault-Token'] = vaultToken;
     const client = got.extend(defaultOptions);
 
+    if (exportToken === true) {
+        command.issue('add-mask', vaultToken);
+        core.exportVariable('VAULT_TOKEN', `${vaultToken}`);
+    }
+
     const requests = secretRequests.map(request => {
         const { path, selector } = request;
         return request;
@@ -124,12 +130,13 @@ function parseSecretsInput(secretsInput) {
             throw Error(`You must provide a valid path and key. Input: "${secret}"`);
         }
 
-        const [path, selector] = pathParts;
+        const [path, selectorQuoted] = pathParts;
 
         /** @type {any} */
-        const selectorAst = jsonata(selector).ast();
+        const selectorAst = jsonata(selectorQuoted).ast();
+        const selector = selectorQuoted.replace(new RegExp('"', 'g'), '');
 
-        if ((selectorAst.type !== "path" || selectorAst.steps[0].stages) && !outputVarName) {
+        if ((selectorAst.type !== "path" || selectorAst.steps[0].stages) && selectorAst.type !== "string" && !outputVarName) {
             throw Error(`You must provide a name for the output key when using json selectors. Input: "${secret}"`);
         }
 
@@ -156,7 +163,7 @@ function parseSecretsInput(secretsInput) {
  */
 function normalizeOutputKey(dataKey, isEnvVar = false) {
     let outputKey = dataKey
-        .replace('.', '__').replace(/[^\p{L}\p{N}_-]/gu, '');
+        .replace('.', '__').replace(new RegExp('-', 'g'), '').replace(/[^\p{L}\p{N}_-]/gu, '');
     if (isEnvVar) {
         outputKey = outputKey.toUpperCase();
     }

src/action.test.js

@@ -178,6 +178,12 @@ describe('exportSecrets', () => {
         }
     }
 
+    function mockExportToken(doExport) {
+        when(core.getInput)
+            .calledWith('exportToken')
+            .mockReturnValueOnce(doExport);
+    }
+
     it('simple secret retrieval', async () => {
         mockInput('test key');
         mockVaultData({
@@ -257,4 +263,35 @@ describe('exportSecrets', () => {
         expect(core.exportVariable).toBeCalledWith('KEY__VALUE', '1');
         expect(core.setOutput).toBeCalledWith('key__value', '1');
     });
+
+    it('export Vault token', async () => {
+        mockInput('test key');
+        mockVaultData({
+            key: 1
+        });
+        mockExportToken("true")
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledTimes(2);
+
+        expect(core.exportVariable).toBeCalledWith('VAULT_TOKEN', 'EXAMPLE');
+        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
+    });
+
+    it('not export Vault token', async () => {
+        mockInput('test key');
+        mockVaultData({
+            key: 1
+        });
+        mockExportToken("false")
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledTimes(1);
+
+        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
+    });
 });

src/secrets.js

@@ -38,7 +38,9 @@ async function getSecrets(secretRequests, client) {
             body = result.body;
             responseCache.set(requestPath, body);
         }
-
+        if (!selector.match(/.*[\.].*/)) {
+            selector = '"' + selector + '"'
+        }
         selector = "data." + selector
         body = JSON.parse(body)
         if (body.data["data"] != undefined) {
@@ -64,7 +66,7 @@ function selectData(data, selector) {
     const ata = jsonata(selector);
     let result = JSON.stringify(ata.evaluate(data));
     // Compat for custom engines
-    if (!result && ata.ast().type === "path" && ata.ast()['steps'].length === 1 && selector !== 'data' && 'data' in data) {
+    if (!result && ((ata.ast().type === "path" && ata.ast()['steps'].length === 1) || ata.ast().type === "string") && selector !== 'data' && 'data' in data) {
         result = JSON.stringify(jsonata(`data.${selector}`).evaluate(data));
     } else if (!result) {
         throw Error(`Unable to retrieve result for ${selector}. No match data was found. Double check your Key or Selector.`);