mirror of
https://github.com/hashicorp/vault-action.git
synced 2026-07-26 00:13:16 +03:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Nicholas Farley
|
7b8899915e |
@@ -3,29 +3,21 @@ name: Bug report
|
||||
about: Create a report to help us improve
|
||||
title: "[BUG] "
|
||||
labels: bug
|
||||
assignees: RichiCoder1
|
||||
|
||||
---
|
||||
|
||||
## Vault server version
|
||||
v0.0.0
|
||||
|
||||
## vault-action version
|
||||
v0.0.0
|
||||
|
||||
## Describe the bug
|
||||
**Describe the bug**
|
||||
A clear and concise description of what the bug is.
|
||||
|
||||
## To Reproduce
|
||||
**To Reproduce**
|
||||
The yaml of the `vault-action` step, with any sensitive information masked or removed.
|
||||
|
||||
## Expected behavior
|
||||
**Expected behavior**
|
||||
A clear and concise description of what you expected to happen.
|
||||
|
||||
## Log Output
|
||||
For the most verbose logs, add a secret called
|
||||
[`ACTIONS_STEP_DEBUG`](https://github.com/actions/toolkit/blob/main/docs/action-debugging.md)
|
||||
with the value `true`. Then, re-run the workflow if possible and post the *raw
|
||||
logs* for the step here with any sensitive information masked or removed.
|
||||
**Log Output**
|
||||
For the most verbose logs, [add a secret called `ACTIONS_STEP_DEBUG` with the value `true`](https://github.com/actions/toolkit/blob/main/docs/action-debugging.md). Then, re-run the workflow if possible and post the *raw logs* for the step here with any sensitive information masked or removed.
|
||||
|
||||
## Additional context
|
||||
**Additional context**
|
||||
Add any other context about the problem here.
|
||||
|
||||
@@ -3,17 +3,18 @@ name: Feature request
|
||||
about: Suggest an idea for this project
|
||||
title: "[FEAT] "
|
||||
labels: enhancement
|
||||
assignees: RichiCoder1
|
||||
|
||||
---
|
||||
|
||||
## Is your feature request related to a problem? Please describe.
|
||||
**Is your feature request related to a problem? Please describe.**
|
||||
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
|
||||
|
||||
## Describe the solution you'd like
|
||||
**Describe the solution you'd like**
|
||||
A clear and concise description of what you want to happen.
|
||||
|
||||
## Describe alternatives you've considered
|
||||
**Describe alternatives you've considered**
|
||||
A clear and concise description of any alternative solutions or features you've considered.
|
||||
|
||||
## Additional context
|
||||
**Additional context**
|
||||
Add any other context or screenshots about the feature request here.
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
### Description
|
||||
<!--- Description of the change. For example: This PR updates ABC resource so that we can XYZ --->
|
||||
|
||||
|
||||
<!--- If your PR fully resolves and should automatically close the linked issue, use Closes. Otherwise, use Relates --->
|
||||
Relates OR Closes #0000
|
||||
|
||||
|
||||
### Checklist
|
||||
- [ ] Added [CHANGELOG](https://github.com/hashicorp/vault-action/blob/master/CHANGELOG.md) entry (only for user-facing changes)
|
||||
- [ ] Did not commit changes to `dist/index.js` (This is only done for releases by vault-action maintainers)
|
||||
|
||||
|
||||
### Community Note
|
||||
|
||||
* Please vote on this pull request by adding a 👍
|
||||
[reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/)
|
||||
to the original pull request comment to help the community and maintainers
|
||||
prioritize this request
|
||||
* Please do not leave "+1" comments, they generate extra noise for pull request
|
||||
followers and do not help prioritize the request
|
||||
@@ -2,12 +2,6 @@
|
||||
|
||||
* Add changes here
|
||||
|
||||
## 2.7.4 (October 26, 2023)
|
||||
|
||||
Features:
|
||||
|
||||
* Add ability to specify a wildcard for the key name to get all keys in the path [GH-488](https://github.com/hashicorp/vault-action/pull/488)
|
||||
|
||||
## 2.7.3 (July 13, 2023)
|
||||
|
||||
Bugs:
|
||||
|
||||
@@ -464,172 +464,34 @@ steps:
|
||||
|
||||
Here are all the inputs available through `with`:
|
||||
|
||||
### `url`
|
||||
|
||||
**Type: `string`**\
|
||||
**Required**
|
||||
|
||||
The URL for the Vault endpoint.
|
||||
|
||||
### `secrets`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
A semicolon-separated list of secrets to retrieve. These will automatically be
|
||||
converted to environmental variable keys. See [Key Syntax](#key-syntax) for
|
||||
more details.
|
||||
|
||||
### `namespace`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The Vault namespace from which to query secrets. Vault Enterprise only, unset by default.
|
||||
|
||||
### `method`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `token`**
|
||||
|
||||
The method to use to authenticate with Vault.
|
||||
|
||||
### `role`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Vault role for the specified auth method.
|
||||
|
||||
### `path`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The Vault path for the auth method.
|
||||
|
||||
### `token`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The Vault token to be used to authenticate with Vault.
|
||||
|
||||
### `roleId`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The role ID for App Role authentication.
|
||||
|
||||
### `secretId`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The secret ID for App Role authentication.
|
||||
|
||||
### `githubToken`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The Github Token to be used to authenticate with Vault.
|
||||
|
||||
### `jwtPrivateKey`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Base64 encoded private key to sign the JWT.
|
||||
|
||||
### `jwtKeyPassword`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Password for key stored in `jwtPrivateKey` (if needed).
|
||||
|
||||
### `jwtGithubAudience`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `sigstore`**
|
||||
|
||||
Identifies the recipient ("aud" claim) that the JWT is intended for.
|
||||
|
||||
### `jwtTtl`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `3600`**
|
||||
|
||||
Time in seconds, after which token expires.
|
||||
|
||||
### `kubernetesTokenPath`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `/var/run/secrets/kubernetes.io/serviceaccount/token`**
|
||||
|
||||
The path to the service-account secret with the jwt token for kubernetes based authentication.
|
||||
|
||||
### `username`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The username of the user to log in to Vault as. Available to both Userpass and LDAP auth methods.
|
||||
|
||||
### `password`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The password of the user to log in to Vault as. Available to both Userpass and LDAP auth methods.
|
||||
|
||||
### `authPayload`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
The JSON payload to be sent to Vault when using a custom authentication method.
|
||||
|
||||
### `extraHeaders`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
A string of newline separated extra headers to include on every request.
|
||||
|
||||
### `exportEnv`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `true`**
|
||||
|
||||
Whether or not to export secrets as environment variables.
|
||||
|
||||
### `exportToken`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `false`**
|
||||
|
||||
Whether or not export Vault token as environment variables (i.e VAULT_TOKEN).
|
||||
|
||||
### `outputToken`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `false`**
|
||||
|
||||
Whether or not to set the `vault_token` output to contain the Vault token after authentication.
|
||||
|
||||
### `caCertificate`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Base64 encoded CA certificate the server certificate was signed with. Defaults to CAs provided by Mozilla.
|
||||
|
||||
### `clientCertificate`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Base64 encoded client certificate the action uses to authenticate with Vault when mTLS is enabled.
|
||||
|
||||
### `clientKey`
|
||||
|
||||
**Type: `string`**
|
||||
|
||||
Base64 encoded client key the action uses to authenticate with Vault when mTLS is enabled.
|
||||
|
||||
### `tlsSkipVerify`
|
||||
|
||||
**Type: `string`**\
|
||||
**Default: `false`**
|
||||
|
||||
When set to true, disables verification of server certificates when testing the action.
|
||||
| Input | Description | Default | Required |
|
||||
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | -------- |
|
||||
| `url` | The URL for the vault endpoint | | ✔ |
|
||||
| `secrets` | A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details | | |
|
||||
| `namespace` | The Vault namespace from which to query secrets. Vault Enterprise only, unset by default | | |
|
||||
| `method` | The method to use to authenticate with Vault. | `token` | |
|
||||
| `role` | Vault role for specified auth method | | |
|
||||
| `path` | Custom vault path, if the auth method was enabled at a different path | | |
|
||||
| `token` | The Vault Token to be used to authenticate with Vault | | |
|
||||
| `roleId` | The Role Id for App Role authentication | | |
|
||||
| `secretId` | The Secret Id for App Role authentication | | |
|
||||
| `githubToken` | The Github Token to be used to authenticate with Vault | | |
|
||||
| `jwtPrivateKey` | Base64 encoded Private key to sign JWT | | |
|
||||
| `jwtKeyPassword` | Password for key stored in jwtPrivateKey (if needed) | | |
|
||||
| `jwtGithubAudience` | Identifies the recipient ("aud" claim) that the JWT is intended for |`sigstore`| |
|
||||
| `jwtTtl` | Time in seconds, after which token expires | | 3600 |
|
||||
| `kubernetesTokenPath` | The path to the service-account secret with the jwt token for kubernetes based authentication |`/var/run/secrets/kubernetes.io/serviceaccount/token` | |
|
||||
| `username` | The username of the user to log in to Vault as. Available to both Userpass and LDAP auth methods | | |
|
||||
| `password` | The password of the user to log in to Vault as. Available to both Userpass and LDAP auth methods | | |
|
||||
| `authPayload` | The JSON payload to be sent to Vault when using a custom authentication method. | | |
|
||||
| `extraHeaders` | A string of newline separated extra headers to include on every request. | | |
|
||||
| `exportEnv` | Whether or not export secrets as environment variables. | `true` | |
|
||||
| `exportToken` | Whether or not export Vault token as environment variables (i.e VAULT_TOKEN). | `false` | |
|
||||
| `outputToken` | Whether or not to set the `vault_token` output to contain the Vault token after authentication. | `false` | |
|
||||
| `caCertificate` | Base64 encoded CA certificate the server certificate was signed with. | | |
|
||||
| `clientCertificate` | Base64 encoded client certificate the action uses to authenticate with Vault when mTLS is enabled. | | |
|
||||
| `clientKey` | Base64 encoded client key the action uses to authenticate with Vault when mTLS is enabled. | | |
|
||||
| `tlsSkipVerify` | When set to true, disables verification of server certificates when testing the action. | `false` | |
|
||||
|
||||
## Masking - Hiding Secrets from Logs
|
||||
|
||||
|
||||
+5
-5
@@ -18,16 +18,16 @@ inputs:
|
||||
description: 'Vault role for specified auth method'
|
||||
required: false
|
||||
path:
|
||||
description: 'The Vault path for the auth method.'
|
||||
description: 'Custom Vault path, if the auth method was mounted at a different path'
|
||||
required: false
|
||||
token:
|
||||
description: 'The Vault token to be used to authenticate with Vault'
|
||||
description: 'The Vault Token to be used to authenticate with Vault'
|
||||
required: false
|
||||
roleId:
|
||||
description: 'The role ID for App Role authentication'
|
||||
description: 'The Role Id for App Role authentication'
|
||||
required: false
|
||||
secretId:
|
||||
description: 'The secret ID for App Role authentication'
|
||||
description: 'The Secret Id for App Role authentication'
|
||||
required: false
|
||||
githubToken:
|
||||
description: 'The Github Token to be used to authenticate with Vault'
|
||||
@@ -61,7 +61,7 @@ inputs:
|
||||
default: 'false'
|
||||
required: false
|
||||
caCertificate:
|
||||
description: 'Base64 encoded CA certificate the server certificate was signed with. Defaults to CAs provided by Mozilla.'
|
||||
description: 'Base64 encoded CA certificate to verify the Vault server certificate.'
|
||||
required: false
|
||||
clientCertificate:
|
||||
description: 'Base64 encoded client certificate for mTLS communication with the Vault server.'
|
||||
|
||||
Vendored
+1
@@ -3702,6 +3702,7 @@ function asPromise(normalizedOptions) {
|
||||
request._beforeError(new types_1.HTTPError(response));
|
||||
return;
|
||||
}
|
||||
request.destroy();
|
||||
resolve(request.options.resolveBodyOnly ? response.body : response);
|
||||
});
|
||||
const onError = (error) => {
|
||||
|
||||
Generated
+7
-7
@@ -9,7 +9,7 @@
|
||||
"version": "0.1.0",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"got": "^11.8.5",
|
||||
"got": "^11.8.6",
|
||||
"jsonata": "^2.0.3",
|
||||
"jsrsasign": "^10.8.6"
|
||||
},
|
||||
@@ -2150,9 +2150,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/got": {
|
||||
"version": "11.8.5",
|
||||
"resolved": "https://registry.npmjs.org/got/-/got-11.8.5.tgz",
|
||||
"integrity": "sha512-o0Je4NvQObAuZPHLFoRSkdG2lTgtcynqymzg2Vupdx6PorhaT5MCbIyXG6d4D94kk8ZG57QeosgdiqfJWhEhlQ==",
|
||||
"version": "11.8.6",
|
||||
"resolved": "https://registry.npmjs.org/got/-/got-11.8.6.tgz",
|
||||
"integrity": "sha512-6tfZ91bOr7bOXnK7PRDCGBLa1H4U080YHNaAQ2KsMGlLEzRbk44nsZF2E1IeRc3vtJHPVbKCYgdFbaGO2ljd8g==",
|
||||
"dependencies": {
|
||||
"@sindresorhus/is": "^4.0.0",
|
||||
"@szmarczak/http-timer": "^4.0.5",
|
||||
@@ -5975,9 +5975,9 @@
|
||||
"dev": true
|
||||
},
|
||||
"got": {
|
||||
"version": "11.8.5",
|
||||
"resolved": "https://registry.npmjs.org/got/-/got-11.8.5.tgz",
|
||||
"integrity": "sha512-o0Je4NvQObAuZPHLFoRSkdG2lTgtcynqymzg2Vupdx6PorhaT5MCbIyXG6d4D94kk8ZG57QeosgdiqfJWhEhlQ==",
|
||||
"version": "11.8.6",
|
||||
"resolved": "https://registry.npmjs.org/got/-/got-11.8.6.tgz",
|
||||
"integrity": "sha512-6tfZ91bOr7bOXnK7PRDCGBLa1H4U080YHNaAQ2KsMGlLEzRbk44nsZF2E1IeRc3vtJHPVbKCYgdFbaGO2ljd8g==",
|
||||
"requires": {
|
||||
"@sindresorhus/is": "^4.0.0",
|
||||
"@szmarczak/http-timer": "^4.0.5",
|
||||
|
||||
+1
-1
@@ -34,7 +34,7 @@
|
||||
},
|
||||
"homepage": "https://github.com/hashicorp/vault-action#readme",
|
||||
"dependencies": {
|
||||
"got": "^11.8.5",
|
||||
"got": "^11.8.6",
|
||||
"jsonata": "^2.0.3",
|
||||
"jsrsasign": "^10.8.6"
|
||||
},
|
||||
|
||||
Reference in New Issue
Block a user