Something went wrong. Try again.
[READ-ONLY] Mirror of https://github.com/andreijiroh-dev/dotenvx-action. Securely inject your dotenvx secrets without the leaks
dotenv github-actions hackclub-arcade hacktoberfest
Something went wrong. Try again.
dotenvx-action action.js
3.9 kB · 135 lines
JavaScript
at main
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136import * as core from "@actions/core";import dotenv from "dotenv";import dotenvx from "@dotenvx/dotenvx";
function getBoolInputEnv() { const bool = process.env["INPUT_INJECT_ENV_VARS"]; const trueValue = ["true", "True", "TRUE"]; const falseValue = ["false", "False", "FALSE"];
if (bool === undefined) { try { return core.getBooleanInput("inject-env-vars", { required: false }); } catch (err) { core.warning(err instanceof Error ? err : String(err)); return false; } }
if (trueValue.includes(bool)) return true; if (falseValue.includes(bool)) return false;
core.warning( `Invalid value for INPUT_INJECT_ENV_VARS: "${bool}". Expected one of true/false. Falling back to false.`, ); return false;}
const opts = { path: process.env["INPUT_PATH"] || core.getInput("path", { required: true }), key: process.env["INPUT_KEY"] || core.getInput("key", { required: true }), injectVars: getBoolInputEnv(),};
await core.group("options debug", async () => { core.debug(JSON.stringify(opts, null, 2));});
/* Placeholder object for parsed secrets after decryption */const secretsTmp = Object.create(null);const dotenvPlain = Object.create(null);let failCount = 0;
// Load up encryption key for CI secrets firstif (opts.key) { core.debug("loading dotenvx private key as env var"); process.env["DOTENV_PRIVATE_KEY_CI"] = opts.key; process.env["DOTENV_PRIVATE_KEY"] = opts.key;}
// do the secrets loaderdotenv.config({ path: opts.path, processEnv: dotenvPlain, debug: core.isDebug(),});dotenvx.config({ path: opts.path, processEnv: secretsTmp, debug: core.isDebug(),});
Object.keys(secretsTmp).forEach((key) => { const value = secretsTmp[key]; const plainValue = dotenvPlain[key]; const isEncryptedValue = typeof value === "string" && value.startsWith("encrypted:"); const isEncryptedPlainValue = typeof plainValue === "string" && plainValue.startsWith("encrypted:");
// warn user on failed-to-decrypt secrets if (isEncryptedValue) { core.warning( `decryption failed for key ${key}, check your inputs/secrets if key is correct`, ); failCount++; core.debug(`fail count now at ${failCount}`); }
// Automatically mask decrypted secrets when prefixed with "encrypted:" using plain old dotenv package if (isEncryptedPlainValue && !isEncryptedValue) { core.setSecret(value); }
core.setOutput(key, value);
if (opts.injectVars === true) { core.exportVariable(key, value); }});
core.group("Parsed data (w/o decryption)", async () => { core.info(JSON.stringify(dotenvPlain, null, 2)); core.endGroup();});
core.group("dotenv-keys meta configs", async () => { core.info( JSON.stringify( { loaded: true, loader: "github-actions", last_loaded_dir: process.cwd(), decryption_failure: failCount > 0 || false, decryption_fail_count: failCount, }, null, 2, ), ); core.endGroup();});
core.setOutput("DOTENV_KEYS_LOADER", "github-actions");core.setOutput("DOTENV_KEYS_LOADED", "true");core.setOutput("LAST_DOTENV_DIR", process.cwd());if (failCount > 0) { core.setOutput("DOTENV_DECRYPTION_FAILURE", "true"); core.setOutput("DOTENV_DECRYPTION_FAIL_COUNT", failCount);} else { core.setOutput("DOTENV_DECRYPTION_FAILURE", "false"); core.setOutput("DOTENV_DECRYPTION_FAIL_COUNT", "0");}
if (opts.injectVars === true) { core.exportVariable("DOTENV_KEYS_LOADER", "github-actions"); core.exportVariable("DOTENV_KEYS_LOADED", "true"); core.exportVariable("LAST_DOTENV_DIR", process.cwd()); if (failCount > 0) { core.exportVariable("DOTENV_DECRYPTION_FAILURE", "true"); core.exportVariable("DOTENV_DECRYPTION_FAIL_COUNT", failCount); } else { core.exportVariable("DOTENV_DECRYPTION_FAILURE", "false"); core.exportVariable("DOTENV_DECRYPTION_FAIL_COUNT", "0"); }}