mirror of
https://github.com/game-ci/unity-builder.git
synced 2026-06-01 06:16:14 -07:00
Compare commits
3 Commits
feature/pr
...
ci/macos-c
| Author | SHA1 | Date | |
|---|---|---|---|
|
8f732b3590 | ||
|
|
32fb3960d3 | ||
|
|
08b1c17c01 |
1
.github/workflows/build-tests-mac.yml
vendored
1
.github/workflows/build-tests-mac.yml
vendored
@@ -12,7 +12,6 @@ jobs:
|
||||
buildForAllPlatformsMacOS:
|
||||
name: ${{ matrix.targetPlatform }} on ${{ matrix.unityVersion }}
|
||||
runs-on: macos-latest
|
||||
continue-on-error: true
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
|
||||
@@ -54,7 +54,7 @@ jobs:
|
||||
# AWS_STACK_NAME: game-ci-github-pipelines
|
||||
CHECKS_UPDATE: ${{ github.event.inputs.checksObject }}
|
||||
run: |
|
||||
git clone -b main https://github.com/game-ci/unity-builder
|
||||
git clone -b orchestrator-develop https://github.com/game-ci/unity-builder
|
||||
cd unity-builder
|
||||
yarn
|
||||
ls
|
||||
|
||||
@@ -194,15 +194,6 @@ inputs:
|
||||
description:
|
||||
'[Orchestrator] Either local, k8s or aws can be used to run builds on a remote cluster. Additional parameters must
|
||||
be configured.'
|
||||
secretSource:
|
||||
default: ''
|
||||
required: false
|
||||
description:
|
||||
'[Orchestrator] Premade secret source for pulling build secrets. Supported values: aws-secrets-manager,
|
||||
aws-parameter-store, gcp-secret-manager, azure-key-vault, hashicorp-vault, hashicorp-vault-kv1,
|
||||
vault (alias for hashicorp-vault), env. Can also be a custom shell command with {0} placeholder
|
||||
for the key, or a path to a YAML file defining custom sources. Takes precedence over
|
||||
inputPullCommand when set.'
|
||||
resourceTracking:
|
||||
default: 'false'
|
||||
required: false
|
||||
|
||||
403
dist/index.js
generated
vendored
403
dist/index.js
generated
vendored
@@ -2243,9 +2243,6 @@ class OrchestratorOptions {
|
||||
static get pullInputList() {
|
||||
return OrchestratorOptions.getInput('pullInputList')?.split(`,`) || [];
|
||||
}
|
||||
static get secretSource() {
|
||||
return OrchestratorOptions.getInput('secretSource') || '';
|
||||
}
|
||||
static get inputPullCommand() {
|
||||
const value = OrchestratorOptions.getInput('inputPullCommand');
|
||||
if (value === 'gcp-secret-manager') {
|
||||
@@ -2367,39 +2364,13 @@ exports["default"] = OrchestratorOptions;
|
||||
|
||||
"use strict";
|
||||
|
||||
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
||||
if (k2 === undefined) k2 = k;
|
||||
var desc = Object.getOwnPropertyDescriptor(m, k);
|
||||
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
||||
desc = { enumerable: true, get: function() { return m[k]; } };
|
||||
}
|
||||
Object.defineProperty(o, k2, desc);
|
||||
}) : (function(o, m, k, k2) {
|
||||
if (k2 === undefined) k2 = k;
|
||||
o[k2] = m[k];
|
||||
}));
|
||||
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
||||
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
||||
}) : function(o, v) {
|
||||
o["default"] = v;
|
||||
});
|
||||
var __importStar = (this && this.__importStar) || function (mod) {
|
||||
if (mod && mod.__esModule) return mod;
|
||||
var result = {};
|
||||
if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
|
||||
__setModuleDefault(result, mod);
|
||||
return result;
|
||||
};
|
||||
var __importDefault = (this && this.__importDefault) || function (mod) {
|
||||
return (mod && mod.__esModule) ? mod : { "default": mod };
|
||||
};
|
||||
Object.defineProperty(exports, "__esModule", ({ value: true }));
|
||||
const core = __importStar(__nccwpck_require__(42186));
|
||||
const input_1 = __importDefault(__nccwpck_require__(91933));
|
||||
const generic_input_reader_1 = __nccwpck_require__(2263);
|
||||
const orchestrator_options_1 = __importDefault(__nccwpck_require__(82473));
|
||||
const secret_source_service_1 = __nccwpck_require__(79089);
|
||||
const orchestrator_logger_1 = __importDefault(__nccwpck_require__(32549));
|
||||
const formatFunction = (value, arguments_) => {
|
||||
for (const element of arguments_) {
|
||||
value = value.replace(`{${element.key}}`, element.value);
|
||||
@@ -2407,6 +2378,7 @@ const formatFunction = (value, arguments_) => {
|
||||
return value;
|
||||
};
|
||||
class OrchestratorQueryOverride {
|
||||
// TODO accept premade secret sources or custom secret source definition yamls
|
||||
static query(key, alternativeKey) {
|
||||
if (OrchestratorQueryOverride.queryOverrides && OrchestratorQueryOverride.queryOverrides[key] !== undefined) {
|
||||
return OrchestratorQueryOverride.queryOverrides[key];
|
||||
@@ -2434,49 +2406,11 @@ class OrchestratorQueryOverride {
|
||||
if (!this.shouldUseOverride(query)) {
|
||||
throw new Error(`Should not be trying to run override query on ${query}`);
|
||||
}
|
||||
// Validate the query key before interpolating it into a shell command
|
||||
(0, secret_source_service_1.validateSecretKey)(query);
|
||||
const result = await generic_input_reader_1.GenericInputReader.Run(formatFunction(orchestrator_options_1.default.inputPullCommand, [{ key: 0, value: query }]));
|
||||
// Mask the fetched secret value so it does not appear in GitHub Actions logs
|
||||
if (result && result.trim().length > 0) {
|
||||
core.setSecret(result);
|
||||
}
|
||||
return result;
|
||||
return await generic_input_reader_1.GenericInputReader.Run(formatFunction(orchestrator_options_1.default.inputPullCommand, [{ key: 0, value: query }]));
|
||||
}
|
||||
/**
|
||||
* Populate query overrides using either:
|
||||
* 1. Premade/custom secret sources (via secretSource input), or
|
||||
* 2. Shell command (via inputPullCommand, legacy approach)
|
||||
*
|
||||
* The secretSource input takes precedence if set. It supports:
|
||||
* - Premade names: 'aws-secrets-manager', 'aws-parameter-store', 'gcp-secret-manager', 'azure-key-vault', 'env'
|
||||
* - Custom commands: any string containing {0} placeholder
|
||||
* - YAML file path: a path ending in .yml or .yaml containing custom source definitions
|
||||
*/
|
||||
static async PopulateQueryOverrideInput() {
|
||||
const queries = orchestrator_options_1.default.pullInputList;
|
||||
OrchestratorQueryOverride.queryOverrides = {};
|
||||
const secretSource = orchestrator_options_1.default.secretSource;
|
||||
// Use SecretSourceService if secretSource is configured
|
||||
if (secretSource) {
|
||||
orchestrator_logger_1.default.log(`Using secret source: ${secretSource}`);
|
||||
// YAML file: load definitions and use the first source
|
||||
if (secretSource.endsWith('.yml') || secretSource.endsWith('.yaml')) {
|
||||
const definitions = secret_source_service_1.SecretSourceService.loadFromYaml(secretSource);
|
||||
if (definitions.length > 0) {
|
||||
orchestrator_logger_1.default.log(`Loaded ${definitions.length} secret source(s) from ${secretSource}`);
|
||||
for (const key of queries) {
|
||||
OrchestratorQueryOverride.queryOverrides[key] = await secret_source_service_1.SecretSourceService.fetchSecret(definitions[0], key);
|
||||
}
|
||||
}
|
||||
return;
|
||||
}
|
||||
// Premade or custom command source
|
||||
const results = await secret_source_service_1.SecretSourceService.fetchAll(secretSource, queries);
|
||||
Object.assign(OrchestratorQueryOverride.queryOverrides, results);
|
||||
return;
|
||||
}
|
||||
// Legacy: use inputPullCommand if set
|
||||
for (const element of queries) {
|
||||
if (OrchestratorQueryOverride.shouldUseOverride(element)) {
|
||||
OrchestratorQueryOverride.queryOverrides[element] = await OrchestratorQueryOverride.queryOverride(element);
|
||||
@@ -9698,333 +9632,6 @@ class ContainerHookService {
|
||||
exports.ContainerHookService = ContainerHookService;
|
||||
|
||||
|
||||
/***/ }),
|
||||
|
||||
/***/ 79089:
|
||||
/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
|
||||
|
||||
"use strict";
|
||||
|
||||
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
||||
if (k2 === undefined) k2 = k;
|
||||
var desc = Object.getOwnPropertyDescriptor(m, k);
|
||||
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
||||
desc = { enumerable: true, get: function() { return m[k]; } };
|
||||
}
|
||||
Object.defineProperty(o, k2, desc);
|
||||
}) : (function(o, m, k, k2) {
|
||||
if (k2 === undefined) k2 = k;
|
||||
o[k2] = m[k];
|
||||
}));
|
||||
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
||||
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
||||
}) : function(o, v) {
|
||||
o["default"] = v;
|
||||
});
|
||||
var __importStar = (this && this.__importStar) || function (mod) {
|
||||
if (mod && mod.__esModule) return mod;
|
||||
var result = {};
|
||||
if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
|
||||
__setModuleDefault(result, mod);
|
||||
return result;
|
||||
};
|
||||
var __importDefault = (this && this.__importDefault) || function (mod) {
|
||||
return (mod && mod.__esModule) ? mod : { "default": mod };
|
||||
};
|
||||
Object.defineProperty(exports, "__esModule", ({ value: true }));
|
||||
exports.SecretSourceService = exports.validateSecretKey = void 0;
|
||||
const node_fs_1 = __importDefault(__nccwpck_require__(87561));
|
||||
const core = __importStar(__nccwpck_require__(42186));
|
||||
const orchestrator_logger_1 = __importDefault(__nccwpck_require__(32549));
|
||||
const orchestrator_system_1 = __nccwpck_require__(9744);
|
||||
/**
|
||||
* Validate that a secret key name contains only safe characters.
|
||||
* Prevents shell injection when keys are interpolated into commands.
|
||||
*
|
||||
* Allowed characters: alphanumeric, hyphens, underscores, dots, forward slashes.
|
||||
*
|
||||
* @param key - The secret key name to validate
|
||||
* @returns The validated key (unchanged)
|
||||
* @throws Error if the key contains disallowed characters
|
||||
*/
|
||||
function validateSecretKey(key) {
|
||||
if (!/^[a-zA-Z0-9\-_./]+$/.test(key)) {
|
||||
throw new Error(`Invalid secret key name: "${key}". Keys may only contain alphanumeric characters, hyphens, underscores, dots, and forward slashes.`);
|
||||
}
|
||||
return key;
|
||||
}
|
||||
exports.validateSecretKey = validateSecretKey;
|
||||
/**
|
||||
* Mask a secret value so it does not appear in GitHub Actions logs.
|
||||
* Empty or whitespace-only values are skipped (core.setSecret would be a no-op).
|
||||
*/
|
||||
function maskSecretValue(value) {
|
||||
if (value.trim().length > 0) {
|
||||
core.setSecret(value);
|
||||
}
|
||||
}
|
||||
/**
|
||||
* Premade secret sources and custom YAML-based secret source definitions.
|
||||
*
|
||||
* Premade sources are string shortcuts that expand to shell commands:
|
||||
* - `aws-secrets-manager` -- AWS Secrets Manager
|
||||
* - `aws-parameter-store` -- AWS Systems Manager Parameter Store
|
||||
* - `gcp-secret-manager` -- Google Cloud Secret Manager
|
||||
* - `azure-key-vault` -- Azure Key Vault (requires AZURE_VAULT_NAME env var)
|
||||
* - `hashicorp-vault` -- HashiCorp Vault KV v2 (requires VAULT_ADDR, optionally VAULT_MOUNT)
|
||||
* - `hashicorp-vault-kv1` -- HashiCorp Vault KV v1 (requires VAULT_ADDR, optionally VAULT_MOUNT)
|
||||
* - `env` -- Read from environment variables (no shell command needed)
|
||||
*
|
||||
* Custom YAML format:
|
||||
* sources:
|
||||
* - name: my-vault
|
||||
* command: 'vault kv get -field=value secret/{0}'
|
||||
* - name: my-api
|
||||
* command: 'curl -s https://secrets.example.com/api/{0}'
|
||||
* parseOutput: json-field
|
||||
* jsonField: value
|
||||
*/
|
||||
class SecretSourceService {
|
||||
/**
|
||||
* Check if a source name is a known premade source.
|
||||
*/
|
||||
static isPremadeSource(sourceName) {
|
||||
return sourceName in SecretSourceService.premadeSources;
|
||||
}
|
||||
/**
|
||||
* Get the list of available premade source names.
|
||||
*/
|
||||
static getAvailableSources() {
|
||||
return Object.keys(SecretSourceService.premadeSources);
|
||||
}
|
||||
/**
|
||||
* Resolve a source name to a SecretSourceDefinition.
|
||||
*
|
||||
* - If the name matches a premade source, returns that definition.
|
||||
* - If it looks like a shell command (contains spaces or {0}), wraps it as a custom command.
|
||||
* - Otherwise, returns undefined.
|
||||
*/
|
||||
static resolveSource(sourceName) {
|
||||
// Check premade sources
|
||||
if (SecretSourceService.isPremadeSource(sourceName)) {
|
||||
return SecretSourceService.premadeSources[sourceName];
|
||||
}
|
||||
// If it contains a placeholder or spaces, treat it as a raw command
|
||||
if (sourceName.includes('{0}') || sourceName.includes(' ')) {
|
||||
return {
|
||||
name: 'custom-command',
|
||||
command: sourceName,
|
||||
parseOutput: 'raw',
|
||||
};
|
||||
}
|
||||
return undefined;
|
||||
}
|
||||
/**
|
||||
* Load custom secret source definitions from a YAML file.
|
||||
*
|
||||
* Expected format:
|
||||
* sources:
|
||||
* - name: my-source
|
||||
* command: 'my-tool get-secret {0}'
|
||||
* - name: my-api
|
||||
* command: 'curl -s https://api.example.com/secrets/{0}'
|
||||
* parseOutput: json-field
|
||||
* jsonField: value
|
||||
*/
|
||||
static loadFromYaml(filePath) {
|
||||
if (!node_fs_1.default.existsSync(filePath)) {
|
||||
orchestrator_logger_1.default.logWarning(`Secret source YAML not found: ${filePath}`);
|
||||
return [];
|
||||
}
|
||||
try {
|
||||
const content = node_fs_1.default.readFileSync(filePath, 'utf8');
|
||||
const parsed = SecretSourceService.parseSimpleYaml(content);
|
||||
return parsed;
|
||||
}
|
||||
catch (error) {
|
||||
orchestrator_logger_1.default.logWarning(`Failed to parse secret source YAML: ${error.message}`);
|
||||
return [];
|
||||
}
|
||||
}
|
||||
/**
|
||||
* Fetch a secret value using the given source definition.
|
||||
*
|
||||
* Validates the key against an allowlist pattern before interpolating it
|
||||
* into the command string to prevent shell injection. The fetched secret
|
||||
* value is masked via core.setSecret() so it does not leak in logs.
|
||||
*
|
||||
* @param source - The secret source definition to use
|
||||
* @param key - The secret key to fetch
|
||||
* @returns The secret value, or empty string on failure
|
||||
*/
|
||||
static async fetchSecret(source, key) {
|
||||
// Validate the key to prevent shell injection
|
||||
validateSecretKey(key);
|
||||
const command = source.command.replace(/\{0\}/g, key);
|
||||
try {
|
||||
const output = await orchestrator_system_1.OrchestratorSystem.Run(command, false, true);
|
||||
let value;
|
||||
if (source.parseOutput === 'json-field' && source.jsonField) {
|
||||
try {
|
||||
const parsed = JSON.parse(output);
|
||||
value = parsed[source.jsonField] || '';
|
||||
}
|
||||
catch {
|
||||
orchestrator_logger_1.default.logWarning(`Failed to parse JSON output from ${source.name} for key ${key}`);
|
||||
value = output.trim();
|
||||
}
|
||||
}
|
||||
else {
|
||||
value = output.trim();
|
||||
}
|
||||
// Mask the secret value so it does not appear in GitHub Actions logs
|
||||
maskSecretValue(value);
|
||||
return value;
|
||||
}
|
||||
catch (error) {
|
||||
orchestrator_logger_1.default.logWarning(`Failed to fetch secret '${key}' from ${source.name}: ${error.message}`);
|
||||
return '';
|
||||
}
|
||||
}
|
||||
/**
|
||||
* Fetch a secret from an environment variable. No shell command needed.
|
||||
* The value is masked via core.setSecret() so it does not leak in logs.
|
||||
*/
|
||||
static fetchFromEnv(key) {
|
||||
const value = process.env[key] || '';
|
||||
maskSecretValue(value);
|
||||
return value;
|
||||
}
|
||||
/**
|
||||
* Resolve a source name and fetch all secrets from it.
|
||||
*
|
||||
* @param sourceName - Premade source name, shell command, or 'env'
|
||||
* @param keys - List of secret keys to fetch
|
||||
* @returns Map of key -> value
|
||||
*/
|
||||
static async fetchAll(sourceName, keys) {
|
||||
const results = {};
|
||||
if (sourceName === 'env') {
|
||||
for (const key of keys) {
|
||||
results[key] = SecretSourceService.fetchFromEnv(key);
|
||||
}
|
||||
return results;
|
||||
}
|
||||
const source = SecretSourceService.resolveSource(sourceName);
|
||||
if (!source) {
|
||||
orchestrator_logger_1.default.logWarning(`Unknown secret source '${sourceName}'. Available sources: ${SecretSourceService.getAvailableSources().join(', ')}`);
|
||||
return results;
|
||||
}
|
||||
orchestrator_logger_1.default.log(`Fetching ${keys.length} secret(s) from ${source.name}`);
|
||||
for (const key of keys) {
|
||||
results[key] = await SecretSourceService.fetchSecret(source, key);
|
||||
}
|
||||
return results;
|
||||
}
|
||||
/**
|
||||
* Simple YAML parser for secret source definitions.
|
||||
* Handles the specific structure we expect without requiring a YAML library.
|
||||
*/
|
||||
static parseSimpleYaml(content) {
|
||||
const definitions = [];
|
||||
const lines = content.split('\n');
|
||||
let current = null;
|
||||
for (const rawLine of lines) {
|
||||
const line = rawLine.replace(/\r$/, '');
|
||||
const trimmed = line.trim();
|
||||
if (trimmed === '' || trimmed.startsWith('#'))
|
||||
continue;
|
||||
if (trimmed === '- name:' || trimmed.startsWith('- name:')) {
|
||||
if (current?.name && current?.command) {
|
||||
definitions.push(current);
|
||||
}
|
||||
current = {
|
||||
name: trimmed
|
||||
.replace('- name:', '')
|
||||
.trim()
|
||||
.replace(/^['"]|['"]$/g, ''),
|
||||
parseOutput: 'raw',
|
||||
};
|
||||
continue;
|
||||
}
|
||||
if (current && trimmed.startsWith('command:')) {
|
||||
current.command = trimmed
|
||||
.replace('command:', '')
|
||||
.trim()
|
||||
.replace(/^['"]|['"]$/g, '');
|
||||
}
|
||||
else if (current && trimmed.startsWith('parseOutput:')) {
|
||||
const value = trimmed
|
||||
.replace('parseOutput:', '')
|
||||
.trim()
|
||||
.replace(/^['"]|['"]$/g, '');
|
||||
current.parseOutput = value;
|
||||
}
|
||||
else if (current && trimmed.startsWith('jsonField:')) {
|
||||
current.jsonField = trimmed
|
||||
.replace('jsonField:', '')
|
||||
.trim()
|
||||
.replace(/^['"]|['"]$/g, '');
|
||||
}
|
||||
}
|
||||
if (current?.name && current?.command) {
|
||||
definitions.push(current);
|
||||
}
|
||||
return definitions;
|
||||
}
|
||||
}
|
||||
exports.SecretSourceService = SecretSourceService;
|
||||
SecretSourceService.premadeSources = {
|
||||
'aws-secrets-manager': {
|
||||
name: 'aws-secrets-manager',
|
||||
command: 'aws secretsmanager get-secret-value --secret-id {0} --query SecretString --output text',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
'aws-secret-manager': {
|
||||
// Alias for backward compatibility (original name in inputPullCommand)
|
||||
name: 'aws-secret-manager',
|
||||
command: 'aws secretsmanager get-secret-value --secret-id {0} --query SecretString --output text',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
'aws-parameter-store': {
|
||||
name: 'aws-parameter-store',
|
||||
command: 'aws ssm get-parameter --name {0} --with-decryption --query Parameter.Value --output text',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
'gcp-secret-manager': {
|
||||
name: 'gcp-secret-manager',
|
||||
command: 'gcloud secrets versions access latest --secret="{0}"',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
'azure-key-vault': {
|
||||
name: 'azure-key-vault',
|
||||
command: 'az keyvault secret show --vault-name "$AZURE_VAULT_NAME" --name {0} --query value --output tsv',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
'hashicorp-vault': {
|
||||
// HashiCorp Vault KV v2 (default). Requires VAULT_ADDR env var.
|
||||
// Optionally set VAULT_MOUNT to override the mount path (default: 'secret').
|
||||
// Authentication is handled by VAULT_TOKEN or other Vault auth env vars.
|
||||
name: 'hashicorp-vault',
|
||||
command: 'vault kv get -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
'hashicorp-vault-kv1': {
|
||||
// HashiCorp Vault KV v1. Requires VAULT_ADDR env var.
|
||||
// Optionally set VAULT_MOUNT to override the mount path (default: 'secret').
|
||||
name: 'hashicorp-vault-kv1',
|
||||
command: 'vault read -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
vault: {
|
||||
// Short alias for hashicorp-vault (KV v2)
|
||||
name: 'vault',
|
||||
command: 'vault kv get -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
};
|
||||
|
||||
|
||||
/***/ }),
|
||||
|
||||
/***/ 23451:
|
||||
@@ -10124,7 +9731,8 @@ if [ -n "$(git ls-remote --heads "$REPO" "$BRANCH" 2>/dev/null)" ]; then
|
||||
git clone -q -b "$BRANCH" "$REPO" /builder
|
||||
else
|
||||
echo "Remote branch $BRANCH not found in $REPO; falling back to a known branch"
|
||||
git clone -q -b main "$REPO" /builder \
|
||||
git clone -q -b orchestrator-develop "$REPO" /builder \
|
||||
|| git clone -q -b main "$REPO" /builder \
|
||||
|| git clone -q "$REPO" /builder
|
||||
fi
|
||||
git clone -q -b ${orchestrator_1.default.buildParameters.branch} ${orchestrator_folders_1.OrchestratorFolders.targetBuildRepoUrl} /repo
|
||||
@@ -10241,7 +9849,8 @@ if [ -n "$(git ls-remote --heads "$REPO" "$BRANCH" 2>/dev/null)" ]; then
|
||||
git clone -q -b "$BRANCH" "$REPO" "$DEST"
|
||||
else
|
||||
echo "Remote branch $BRANCH not found in $REPO; falling back to a known branch"
|
||||
git clone -q -b main "$REPO" "$DEST" \
|
||||
git clone -q -b orchestrator-develop "$REPO" "$DEST" \
|
||||
|| git clone -q -b main "$REPO" "$DEST" \
|
||||
|| git clone -q "$REPO" "$DEST"
|
||||
fi
|
||||
chmod +x ${builderPath}`;
|
||||
|
||||
2
dist/index.js.map
generated
vendored
2
dist/index.js.map
generated
vendored
File diff suppressed because one or more lines are too long
@@ -190,10 +190,6 @@ class OrchestratorOptions {
|
||||
return OrchestratorOptions.getInput('pullInputList')?.split(`,`) || [];
|
||||
}
|
||||
|
||||
static get secretSource(): string {
|
||||
return OrchestratorOptions.getInput('secretSource') || '';
|
||||
}
|
||||
|
||||
static get inputPullCommand(): string {
|
||||
const value = OrchestratorOptions.getInput('inputPullCommand');
|
||||
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
import * as core from '@actions/core';
|
||||
import Input from '../../input';
|
||||
import { GenericInputReader } from '../../input-readers/generic-input-reader';
|
||||
import OrchestratorOptions from './orchestrator-options';
|
||||
import { SecretSourceService, validateSecretKey } from '../services/secrets/secret-source-service';
|
||||
import OrchestratorLogger from '../services/core/orchestrator-logger';
|
||||
|
||||
const formatFunction = (value: string, arguments_: any[]) => {
|
||||
for (const element of arguments_) {
|
||||
@@ -16,6 +13,8 @@ const formatFunction = (value: string, arguments_: any[]) => {
|
||||
class OrchestratorQueryOverride {
|
||||
static queryOverrides: { [key: string]: string } | undefined;
|
||||
|
||||
// TODO accept premade secret sources or custom secret source definition yamls
|
||||
|
||||
public static query(key: string, alternativeKey: string) {
|
||||
if (OrchestratorQueryOverride.queryOverrides && OrchestratorQueryOverride.queryOverrides[key] !== undefined) {
|
||||
return OrchestratorQueryOverride.queryOverrides[key];
|
||||
@@ -50,62 +49,14 @@ class OrchestratorQueryOverride {
|
||||
throw new Error(`Should not be trying to run override query on ${query}`);
|
||||
}
|
||||
|
||||
// Validate the query key before interpolating it into a shell command
|
||||
validateSecretKey(query);
|
||||
|
||||
const result = await GenericInputReader.Run(
|
||||
return await GenericInputReader.Run(
|
||||
formatFunction(OrchestratorOptions.inputPullCommand, [{ key: 0, value: query }]),
|
||||
);
|
||||
|
||||
// Mask the fetched secret value so it does not appear in GitHub Actions logs
|
||||
if (result && result.trim().length > 0) {
|
||||
core.setSecret(result);
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
/**
|
||||
* Populate query overrides using either:
|
||||
* 1. Premade/custom secret sources (via secretSource input), or
|
||||
* 2. Shell command (via inputPullCommand, legacy approach)
|
||||
*
|
||||
* The secretSource input takes precedence if set. It supports:
|
||||
* - Premade names: 'aws-secrets-manager', 'aws-parameter-store', 'gcp-secret-manager', 'azure-key-vault', 'env'
|
||||
* - Custom commands: any string containing {0} placeholder
|
||||
* - YAML file path: a path ending in .yml or .yaml containing custom source definitions
|
||||
*/
|
||||
public static async PopulateQueryOverrideInput() {
|
||||
const queries = OrchestratorOptions.pullInputList;
|
||||
OrchestratorQueryOverride.queryOverrides = {};
|
||||
|
||||
const secretSource = OrchestratorOptions.secretSource;
|
||||
|
||||
// Use SecretSourceService if secretSource is configured
|
||||
if (secretSource) {
|
||||
OrchestratorLogger.log(`Using secret source: ${secretSource}`);
|
||||
|
||||
// YAML file: load definitions and use the first source
|
||||
if (secretSource.endsWith('.yml') || secretSource.endsWith('.yaml')) {
|
||||
const definitions = SecretSourceService.loadFromYaml(secretSource);
|
||||
if (definitions.length > 0) {
|
||||
OrchestratorLogger.log(`Loaded ${definitions.length} secret source(s) from ${secretSource}`);
|
||||
for (const key of queries) {
|
||||
OrchestratorQueryOverride.queryOverrides[key] = await SecretSourceService.fetchSecret(definitions[0], key);
|
||||
}
|
||||
}
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
// Premade or custom command source
|
||||
const results = await SecretSourceService.fetchAll(secretSource, queries);
|
||||
Object.assign(OrchestratorQueryOverride.queryOverrides, results);
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
// Legacy: use inputPullCommand if set
|
||||
for (const element of queries) {
|
||||
if (OrchestratorQueryOverride.shouldUseOverride(element)) {
|
||||
OrchestratorQueryOverride.queryOverrides[element] = await OrchestratorQueryOverride.queryOverride(element);
|
||||
|
||||
@@ -1,446 +0,0 @@
|
||||
import fs from 'node:fs';
|
||||
import * as core from '@actions/core';
|
||||
import { SecretSourceService, validateSecretKey } from './secret-source-service';
|
||||
|
||||
jest.mock('node:fs');
|
||||
jest.mock('@actions/core', () => ({
|
||||
setSecret: jest.fn(),
|
||||
info: jest.fn(),
|
||||
warning: jest.fn(),
|
||||
error: jest.fn(),
|
||||
}));
|
||||
jest.mock('../core/orchestrator-system', () => ({
|
||||
OrchestratorSystem: {
|
||||
Run: jest.fn().mockResolvedValue(''),
|
||||
},
|
||||
}));
|
||||
jest.mock('../core/orchestrator-logger', () => ({
|
||||
__esModule: true,
|
||||
default: {
|
||||
log: jest.fn(),
|
||||
logWarning: jest.fn(),
|
||||
error: jest.fn(),
|
||||
},
|
||||
}));
|
||||
|
||||
const mockFs = fs as jest.Mocked<typeof fs>;
|
||||
|
||||
describe('SecretSourceService', () => {
|
||||
beforeEach(() => {
|
||||
jest.clearAllMocks();
|
||||
});
|
||||
|
||||
describe('validateSecretKey', () => {
|
||||
it('should accept alphanumeric keys', () => {
|
||||
expect(validateSecretKey('MY_SECRET_KEY')).toBe('MY_SECRET_KEY');
|
||||
});
|
||||
|
||||
it('should accept keys with hyphens', () => {
|
||||
expect(validateSecretKey('my-secret-key')).toBe('my-secret-key');
|
||||
});
|
||||
|
||||
it('should accept keys with dots', () => {
|
||||
expect(validateSecretKey('my.secret.key')).toBe('my.secret.key');
|
||||
});
|
||||
|
||||
it('should accept keys with forward slashes', () => {
|
||||
expect(validateSecretKey('path/to/secret')).toBe('path/to/secret');
|
||||
});
|
||||
|
||||
it('should accept keys with mixed valid characters', () => {
|
||||
expect(validateSecretKey('my-app/prod_db.password')).toBe('my-app/prod_db.password');
|
||||
});
|
||||
|
||||
it('should reject keys with semicolons (shell injection)', () => {
|
||||
expect(() => validateSecretKey('; rm -rf /')).toThrow('Invalid secret key name');
|
||||
});
|
||||
|
||||
it('should reject keys with backticks (command substitution)', () => {
|
||||
expect(() => validateSecretKey('`whoami`')).toThrow('Invalid secret key name');
|
||||
});
|
||||
|
||||
it('should reject keys with dollar signs (variable expansion)', () => {
|
||||
expect(() => validateSecretKey('$HOME')).toThrow('Invalid secret key name');
|
||||
});
|
||||
|
||||
it('should reject keys with pipe characters', () => {
|
||||
expect(() => validateSecretKey('key | cat /etc/passwd')).toThrow('Invalid secret key name');
|
||||
});
|
||||
|
||||
it('should reject keys with ampersands', () => {
|
||||
expect(() => validateSecretKey('key && echo pwned')).toThrow('Invalid secret key name');
|
||||
});
|
||||
|
||||
it('should reject keys with newlines', () => {
|
||||
expect(() => validateSecretKey('key\nmalicious')).toThrow('Invalid secret key name');
|
||||
});
|
||||
|
||||
it('should reject keys with quotes', () => {
|
||||
expect(() => validateSecretKey('"key"')).toThrow('Invalid secret key name');
|
||||
expect(() => validateSecretKey("'key'")).toThrow('Invalid secret key name');
|
||||
});
|
||||
|
||||
it('should reject keys with parentheses (subshell)', () => {
|
||||
expect(() => validateSecretKey('$(whoami)')).toThrow('Invalid secret key name');
|
||||
});
|
||||
|
||||
it('should reject empty keys', () => {
|
||||
expect(() => validateSecretKey('')).toThrow('Invalid secret key name');
|
||||
});
|
||||
|
||||
it('should reject keys with spaces', () => {
|
||||
expect(() => validateSecretKey('key with spaces')).toThrow('Invalid secret key name');
|
||||
});
|
||||
});
|
||||
|
||||
describe('isPremadeSource', () => {
|
||||
it('should return true for aws-secrets-manager', () => {
|
||||
expect(SecretSourceService.isPremadeSource('aws-secrets-manager')).toBe(true);
|
||||
});
|
||||
|
||||
it('should return true for aws-secret-manager (legacy alias)', () => {
|
||||
expect(SecretSourceService.isPremadeSource('aws-secret-manager')).toBe(true);
|
||||
});
|
||||
|
||||
it('should return true for aws-parameter-store', () => {
|
||||
expect(SecretSourceService.isPremadeSource('aws-parameter-store')).toBe(true);
|
||||
});
|
||||
|
||||
it('should return true for gcp-secret-manager', () => {
|
||||
expect(SecretSourceService.isPremadeSource('gcp-secret-manager')).toBe(true);
|
||||
});
|
||||
|
||||
it('should return true for azure-key-vault', () => {
|
||||
expect(SecretSourceService.isPremadeSource('azure-key-vault')).toBe(true);
|
||||
});
|
||||
|
||||
it('should return true for hashicorp-vault', () => {
|
||||
expect(SecretSourceService.isPremadeSource('hashicorp-vault')).toBe(true);
|
||||
});
|
||||
|
||||
it('should return true for hashicorp-vault-kv1', () => {
|
||||
expect(SecretSourceService.isPremadeSource('hashicorp-vault-kv1')).toBe(true);
|
||||
});
|
||||
|
||||
it('should return true for vault (short alias)', () => {
|
||||
expect(SecretSourceService.isPremadeSource('vault')).toBe(true);
|
||||
});
|
||||
|
||||
it('should return false for unknown source', () => {
|
||||
expect(SecretSourceService.isPremadeSource('unknown-source')).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe('getAvailableSources', () => {
|
||||
it('should return all premade source names', () => {
|
||||
const sources = SecretSourceService.getAvailableSources();
|
||||
expect(sources).toContain('aws-secrets-manager');
|
||||
expect(sources).toContain('aws-parameter-store');
|
||||
expect(sources).toContain('gcp-secret-manager');
|
||||
expect(sources).toContain('azure-key-vault');
|
||||
expect(sources).toContain('hashicorp-vault');
|
||||
expect(sources).toContain('hashicorp-vault-kv1');
|
||||
expect(sources).toContain('vault');
|
||||
expect(sources.length).toBeGreaterThanOrEqual(8);
|
||||
});
|
||||
});
|
||||
|
||||
describe('resolveSource', () => {
|
||||
it('should resolve premade source by name', () => {
|
||||
const source = SecretSourceService.resolveSource('aws-secrets-manager');
|
||||
expect(source).toBeDefined();
|
||||
expect(source!.name).toBe('aws-secrets-manager');
|
||||
expect(source!.command).toContain('secretsmanager');
|
||||
});
|
||||
|
||||
it('should resolve custom command with {0} placeholder', () => {
|
||||
const source = SecretSourceService.resolveSource('vault kv get -field=value secret/{0}');
|
||||
expect(source).toBeDefined();
|
||||
expect(source!.name).toBe('custom-command');
|
||||
expect(source!.command).toContain('{0}');
|
||||
});
|
||||
|
||||
it('should resolve command with spaces as custom command', () => {
|
||||
const source = SecretSourceService.resolveSource('my-tool get-secret');
|
||||
expect(source).toBeDefined();
|
||||
expect(source!.name).toBe('custom-command');
|
||||
});
|
||||
|
||||
it('should return undefined for unknown single-word source', () => {
|
||||
const source = SecretSourceService.resolveSource('unknown');
|
||||
expect(source).toBeUndefined();
|
||||
});
|
||||
});
|
||||
|
||||
describe('fetchSecret', () => {
|
||||
it('should run the command with {0} replaced by key', async () => {
|
||||
const { OrchestratorSystem } = require('../core/orchestrator-system');
|
||||
OrchestratorSystem.Run.mockResolvedValue('my-secret-value');
|
||||
|
||||
const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
|
||||
const result = await SecretSourceService.fetchSecret(source, 'MY_SECRET');
|
||||
|
||||
expect(result).toBe('my-secret-value');
|
||||
expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('MY_SECRET'), false, true);
|
||||
});
|
||||
|
||||
it('should parse JSON output when parseOutput is json-field', async () => {
|
||||
const { OrchestratorSystem } = require('../core/orchestrator-system');
|
||||
OrchestratorSystem.Run.mockResolvedValue(JSON.stringify({ value: 'extracted-secret' }));
|
||||
|
||||
const source = {
|
||||
name: 'test-source',
|
||||
command: 'fetch {0}',
|
||||
parseOutput: 'json-field' as const,
|
||||
jsonField: 'value',
|
||||
};
|
||||
const result = await SecretSourceService.fetchSecret(source, 'KEY');
|
||||
|
||||
expect(result).toBe('extracted-secret');
|
||||
});
|
||||
|
||||
it('should fall back to raw output on invalid JSON with json-field mode', async () => {
|
||||
const { OrchestratorSystem } = require('../core/orchestrator-system');
|
||||
OrchestratorSystem.Run.mockResolvedValue('not-json');
|
||||
|
||||
const source = {
|
||||
name: 'test-source',
|
||||
command: 'fetch {0}',
|
||||
parseOutput: 'json-field' as const,
|
||||
jsonField: 'value',
|
||||
};
|
||||
const result = await SecretSourceService.fetchSecret(source, 'KEY');
|
||||
|
||||
expect(result).toBe('not-json');
|
||||
});
|
||||
|
||||
it('should return empty string on command failure', async () => {
|
||||
const { OrchestratorSystem } = require('../core/orchestrator-system');
|
||||
OrchestratorSystem.Run.mockRejectedValue(new Error('command not found'));
|
||||
|
||||
const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
|
||||
const result = await SecretSourceService.fetchSecret(source, 'KEY');
|
||||
|
||||
expect(result).toBe('');
|
||||
});
|
||||
|
||||
it('should reject keys with shell injection characters', async () => {
|
||||
const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
|
||||
|
||||
await expect(SecretSourceService.fetchSecret(source, '; rm -rf /')).rejects.toThrow('Invalid secret key name');
|
||||
});
|
||||
|
||||
it('should reject keys with command substitution', async () => {
|
||||
const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
|
||||
|
||||
await expect(SecretSourceService.fetchSecret(source, '$(whoami)')).rejects.toThrow('Invalid secret key name');
|
||||
});
|
||||
|
||||
it('should reject keys with backtick command substitution', async () => {
|
||||
const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
|
||||
|
||||
await expect(SecretSourceService.fetchSecret(source, '`cat /etc/passwd`')).rejects.toThrow(
|
||||
'Invalid secret key name',
|
||||
);
|
||||
});
|
||||
|
||||
it('should accept keys with valid path-like patterns', async () => {
|
||||
const { OrchestratorSystem } = require('../core/orchestrator-system');
|
||||
OrchestratorSystem.Run.mockResolvedValue('secret-value');
|
||||
|
||||
const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
|
||||
const result = await SecretSourceService.fetchSecret(source, 'prod/database/password');
|
||||
|
||||
expect(result).toBe('secret-value');
|
||||
});
|
||||
|
||||
it('should mask fetched secret values with core.setSecret', async () => {
|
||||
const { OrchestratorSystem } = require('../core/orchestrator-system');
|
||||
OrchestratorSystem.Run.mockResolvedValue('super-secret-value');
|
||||
|
||||
const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
|
||||
await SecretSourceService.fetchSecret(source, 'MY_SECRET');
|
||||
|
||||
expect(core.setSecret).toHaveBeenCalledWith('super-secret-value');
|
||||
});
|
||||
|
||||
it('should not mask empty secret values', async () => {
|
||||
const { OrchestratorSystem } = require('../core/orchestrator-system');
|
||||
OrchestratorSystem.Run.mockResolvedValue('');
|
||||
|
||||
const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
|
||||
await SecretSourceService.fetchSecret(source, 'MY_SECRET');
|
||||
|
||||
expect(core.setSecret).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('should mask JSON-extracted secret values', async () => {
|
||||
const { OrchestratorSystem } = require('../core/orchestrator-system');
|
||||
OrchestratorSystem.Run.mockResolvedValue(JSON.stringify({ value: 'json-secret' }));
|
||||
|
||||
const source = {
|
||||
name: 'test-source',
|
||||
command: 'fetch {0}',
|
||||
parseOutput: 'json-field' as const,
|
||||
jsonField: 'value',
|
||||
};
|
||||
await SecretSourceService.fetchSecret(source, 'KEY');
|
||||
|
||||
expect(core.setSecret).toHaveBeenCalledWith('json-secret');
|
||||
});
|
||||
});
|
||||
|
||||
describe('fetchFromEnv', () => {
|
||||
it('should return env var value when set', () => {
|
||||
process.env.TEST_SECRET_KEY = 'env-value';
|
||||
const result = SecretSourceService.fetchFromEnv('TEST_SECRET_KEY');
|
||||
expect(result).toBe('env-value');
|
||||
delete process.env.TEST_SECRET_KEY;
|
||||
});
|
||||
|
||||
it('should return empty string when env var is not set', () => {
|
||||
const result = SecretSourceService.fetchFromEnv('NONEXISTENT_KEY_12345');
|
||||
expect(result).toBe('');
|
||||
});
|
||||
|
||||
it('should mask env var values with core.setSecret', () => {
|
||||
process.env.TEST_MASK_KEY = 'masked-env-value';
|
||||
SecretSourceService.fetchFromEnv('TEST_MASK_KEY');
|
||||
expect(core.setSecret).toHaveBeenCalledWith('masked-env-value');
|
||||
delete process.env.TEST_MASK_KEY;
|
||||
});
|
||||
|
||||
it('should not mask empty env var values', () => {
|
||||
const result = SecretSourceService.fetchFromEnv('NONEXISTENT_KEY_99999');
|
||||
expect(result).toBe('');
|
||||
expect(core.setSecret).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
|
||||
describe('fetchAll', () => {
|
||||
it('should fetch all keys from env source', async () => {
|
||||
process.env.KEY_A = 'val-a';
|
||||
process.env.KEY_B = 'val-b';
|
||||
|
||||
const results = await SecretSourceService.fetchAll('env', ['KEY_A', 'KEY_B']);
|
||||
|
||||
expect(results.KEY_A).toBe('val-a');
|
||||
expect(results.KEY_B).toBe('val-b');
|
||||
|
||||
delete process.env.KEY_A;
|
||||
delete process.env.KEY_B;
|
||||
});
|
||||
|
||||
it('should fetch all keys from premade source', async () => {
|
||||
const { OrchestratorSystem } = require('../core/orchestrator-system');
|
||||
OrchestratorSystem.Run.mockResolvedValueOnce('secret-1').mockResolvedValueOnce('secret-2');
|
||||
|
||||
const results = await SecretSourceService.fetchAll('aws-parameter-store', ['param1', 'param2']);
|
||||
|
||||
expect(results.param1).toBe('secret-1');
|
||||
expect(results.param2).toBe('secret-2');
|
||||
expect(OrchestratorSystem.Run).toHaveBeenCalledTimes(2);
|
||||
});
|
||||
|
||||
it('should return empty results for unknown source', async () => {
|
||||
const results = await SecretSourceService.fetchAll('unknown', ['key1']);
|
||||
expect(results).toEqual({});
|
||||
});
|
||||
});
|
||||
|
||||
describe('loadFromYaml', () => {
|
||||
it('should return empty array when file does not exist', () => {
|
||||
(mockFs.existsSync as jest.Mock).mockReturnValue(false);
|
||||
const result = SecretSourceService.loadFromYaml('/nonexistent.yml');
|
||||
expect(result).toEqual([]);
|
||||
});
|
||||
|
||||
it('should parse valid YAML source definitions', () => {
|
||||
(mockFs.existsSync as jest.Mock).mockReturnValue(true);
|
||||
(mockFs.readFileSync as jest.Mock).mockReturnValue(`
|
||||
sources:
|
||||
- name: my-vault
|
||||
command: 'vault kv get -field=value secret/{0}'
|
||||
- name: my-api
|
||||
command: 'curl -s https://api.example.com/{0}'
|
||||
parseOutput: json-field
|
||||
jsonField: secret_value
|
||||
`);
|
||||
|
||||
const result = SecretSourceService.loadFromYaml('/sources.yml');
|
||||
|
||||
expect(result).toHaveLength(2);
|
||||
expect(result[0].name).toBe('my-vault');
|
||||
expect(result[0].command).toBe('vault kv get -field=value secret/{0}');
|
||||
expect(result[1].name).toBe('my-api');
|
||||
expect(result[1].parseOutput).toBe('json-field');
|
||||
expect(result[1].jsonField).toBe('secret_value');
|
||||
});
|
||||
|
||||
it('should handle YAML with single source', () => {
|
||||
(mockFs.existsSync as jest.Mock).mockReturnValue(true);
|
||||
(mockFs.readFileSync as jest.Mock).mockReturnValue(`
|
||||
sources:
|
||||
- name: simple
|
||||
command: echo {0}
|
||||
`);
|
||||
|
||||
const result = SecretSourceService.loadFromYaml('/simple.yml');
|
||||
expect(result).toHaveLength(1);
|
||||
expect(result[0].name).toBe('simple');
|
||||
});
|
||||
|
||||
it('should return empty array on parse error', () => {
|
||||
(mockFs.existsSync as jest.Mock).mockReturnValue(true);
|
||||
(mockFs.readFileSync as jest.Mock).mockImplementation(() => {
|
||||
throw new Error('Permission denied');
|
||||
});
|
||||
|
||||
const result = SecretSourceService.loadFromYaml('/error.yml');
|
||||
expect(result).toEqual([]);
|
||||
});
|
||||
});
|
||||
|
||||
describe('premade source commands', () => {
|
||||
it('aws-secrets-manager uses --query SecretString', () => {
|
||||
const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
|
||||
expect(source.command).toContain('--query SecretString');
|
||||
expect(source.command).toContain('--output text');
|
||||
});
|
||||
|
||||
it('aws-parameter-store uses --with-decryption', () => {
|
||||
const source = SecretSourceService.resolveSource('aws-parameter-store')!;
|
||||
expect(source.command).toContain('--with-decryption');
|
||||
expect(source.command).toContain('--query Parameter.Value');
|
||||
});
|
||||
|
||||
it('gcp-secret-manager uses latest version', () => {
|
||||
const source = SecretSourceService.resolveSource('gcp-secret-manager')!;
|
||||
expect(source.command).toContain('latest');
|
||||
});
|
||||
|
||||
it('azure-key-vault uses AZURE_VAULT_NAME env var', () => {
|
||||
const source = SecretSourceService.resolveSource('azure-key-vault')!;
|
||||
expect(source.command).toContain('$AZURE_VAULT_NAME');
|
||||
});
|
||||
|
||||
it('hashicorp-vault uses vault kv get with VAULT_MOUNT', () => {
|
||||
const source = SecretSourceService.resolveSource('hashicorp-vault')!;
|
||||
expect(source.command).toContain('vault kv get');
|
||||
expect(source.command).toContain('VAULT_MOUNT');
|
||||
expect(source.command).toContain('-field=value');
|
||||
});
|
||||
|
||||
it('hashicorp-vault-kv1 uses vault read for KV v1', () => {
|
||||
const source = SecretSourceService.resolveSource('hashicorp-vault-kv1')!;
|
||||
expect(source.command).toContain('vault read');
|
||||
expect(source.command).toContain('-field=value');
|
||||
});
|
||||
|
||||
it('vault alias resolves to same command as hashicorp-vault', () => {
|
||||
const vault = SecretSourceService.resolveSource('vault')!;
|
||||
const hashicorpVault = SecretSourceService.resolveSource('hashicorp-vault')!;
|
||||
expect(vault.command).toBe(hashicorpVault.command);
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -1,337 +0,0 @@
|
||||
import fs from 'node:fs';
|
||||
import * as core from '@actions/core';
|
||||
import OrchestratorLogger from '../core/orchestrator-logger';
|
||||
import { OrchestratorSystem } from '../core/orchestrator-system';
|
||||
|
||||
/**
|
||||
* A secret source definition: how to fetch a secret value by key.
|
||||
*/
|
||||
export interface SecretSourceDefinition {
|
||||
name: string;
|
||||
command: string;
|
||||
parseOutput?: 'raw' | 'json-field';
|
||||
jsonField?: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate that a secret key name contains only safe characters.
|
||||
* Prevents shell injection when keys are interpolated into commands.
|
||||
*
|
||||
* Allowed characters: alphanumeric, hyphens, underscores, dots, forward slashes.
|
||||
*
|
||||
* @param key - The secret key name to validate
|
||||
* @returns The validated key (unchanged)
|
||||
* @throws Error if the key contains disallowed characters
|
||||
*/
|
||||
export function validateSecretKey(key: string): string {
|
||||
if (!/^[a-zA-Z0-9\-_./]+$/.test(key)) {
|
||||
throw new Error(
|
||||
`Invalid secret key name: "${key}". Keys may only contain alphanumeric characters, hyphens, underscores, dots, and forward slashes.`,
|
||||
);
|
||||
}
|
||||
|
||||
return key;
|
||||
}
|
||||
|
||||
/**
|
||||
* Mask a secret value so it does not appear in GitHub Actions logs.
|
||||
* Empty or whitespace-only values are skipped (core.setSecret would be a no-op).
|
||||
*/
|
||||
function maskSecretValue(value: string): void {
|
||||
if (value.trim().length > 0) {
|
||||
core.setSecret(value);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Premade secret sources and custom YAML-based secret source definitions.
|
||||
*
|
||||
* Premade sources are string shortcuts that expand to shell commands:
|
||||
* - `aws-secrets-manager` -- AWS Secrets Manager
|
||||
* - `aws-parameter-store` -- AWS Systems Manager Parameter Store
|
||||
* - `gcp-secret-manager` -- Google Cloud Secret Manager
|
||||
* - `azure-key-vault` -- Azure Key Vault (requires AZURE_VAULT_NAME env var)
|
||||
* - `hashicorp-vault` -- HashiCorp Vault KV v2 (requires VAULT_ADDR, optionally VAULT_MOUNT)
|
||||
* - `hashicorp-vault-kv1` -- HashiCorp Vault KV v1 (requires VAULT_ADDR, optionally VAULT_MOUNT)
|
||||
* - `env` -- Read from environment variables (no shell command needed)
|
||||
*
|
||||
* Custom YAML format:
|
||||
* sources:
|
||||
* - name: my-vault
|
||||
* command: 'vault kv get -field=value secret/{0}'
|
||||
* - name: my-api
|
||||
* command: 'curl -s https://secrets.example.com/api/{0}'
|
||||
* parseOutput: json-field
|
||||
* jsonField: value
|
||||
*/
|
||||
export class SecretSourceService {
|
||||
private static readonly premadeSources: Record<string, SecretSourceDefinition> = {
|
||||
'aws-secrets-manager': {
|
||||
name: 'aws-secrets-manager',
|
||||
command: 'aws secretsmanager get-secret-value --secret-id {0} --query SecretString --output text',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
'aws-secret-manager': {
|
||||
// Alias for backward compatibility (original name in inputPullCommand)
|
||||
name: 'aws-secret-manager',
|
||||
command: 'aws secretsmanager get-secret-value --secret-id {0} --query SecretString --output text',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
'aws-parameter-store': {
|
||||
name: 'aws-parameter-store',
|
||||
command: 'aws ssm get-parameter --name {0} --with-decryption --query Parameter.Value --output text',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
'gcp-secret-manager': {
|
||||
name: 'gcp-secret-manager',
|
||||
command: 'gcloud secrets versions access latest --secret="{0}"',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
'azure-key-vault': {
|
||||
name: 'azure-key-vault',
|
||||
command: 'az keyvault secret show --vault-name "$AZURE_VAULT_NAME" --name {0} --query value --output tsv',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
'hashicorp-vault': {
|
||||
// HashiCorp Vault KV v2 (default). Requires VAULT_ADDR env var.
|
||||
// Optionally set VAULT_MOUNT to override the mount path (default: 'secret').
|
||||
// Authentication is handled by VAULT_TOKEN or other Vault auth env vars.
|
||||
name: 'hashicorp-vault',
|
||||
command: 'vault kv get -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
'hashicorp-vault-kv1': {
|
||||
// HashiCorp Vault KV v1. Requires VAULT_ADDR env var.
|
||||
// Optionally set VAULT_MOUNT to override the mount path (default: 'secret').
|
||||
name: 'hashicorp-vault-kv1',
|
||||
command: 'vault read -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
vault: {
|
||||
// Short alias for hashicorp-vault (KV v2)
|
||||
name: 'vault',
|
||||
command: 'vault kv get -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
|
||||
parseOutput: 'raw',
|
||||
},
|
||||
};
|
||||
|
||||
/**
|
||||
* Check if a source name is a known premade source.
|
||||
*/
|
||||
static isPremadeSource(sourceName: string): boolean {
|
||||
return sourceName in SecretSourceService.premadeSources;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the list of available premade source names.
|
||||
*/
|
||||
static getAvailableSources(): string[] {
|
||||
return Object.keys(SecretSourceService.premadeSources);
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve a source name to a SecretSourceDefinition.
|
||||
*
|
||||
* - If the name matches a premade source, returns that definition.
|
||||
* - If it looks like a shell command (contains spaces or {0}), wraps it as a custom command.
|
||||
* - Otherwise, returns undefined.
|
||||
*/
|
||||
static resolveSource(sourceName: string): SecretSourceDefinition | undefined {
|
||||
// Check premade sources
|
||||
if (SecretSourceService.isPremadeSource(sourceName)) {
|
||||
return SecretSourceService.premadeSources[sourceName];
|
||||
}
|
||||
|
||||
// If it contains a placeholder or spaces, treat it as a raw command
|
||||
if (sourceName.includes('{0}') || sourceName.includes(' ')) {
|
||||
return {
|
||||
name: 'custom-command',
|
||||
command: sourceName,
|
||||
parseOutput: 'raw',
|
||||
};
|
||||
}
|
||||
|
||||
return undefined;
|
||||
}
|
||||
|
||||
/**
|
||||
* Load custom secret source definitions from a YAML file.
|
||||
*
|
||||
* Expected format:
|
||||
* sources:
|
||||
* - name: my-source
|
||||
* command: 'my-tool get-secret {0}'
|
||||
* - name: my-api
|
||||
* command: 'curl -s https://api.example.com/secrets/{0}'
|
||||
* parseOutput: json-field
|
||||
* jsonField: value
|
||||
*/
|
||||
static loadFromYaml(filePath: string): SecretSourceDefinition[] {
|
||||
if (!fs.existsSync(filePath)) {
|
||||
OrchestratorLogger.logWarning(`Secret source YAML not found: ${filePath}`);
|
||||
|
||||
return [];
|
||||
}
|
||||
|
||||
try {
|
||||
const content = fs.readFileSync(filePath, 'utf8');
|
||||
const parsed = SecretSourceService.parseSimpleYaml(content);
|
||||
|
||||
return parsed;
|
||||
} catch (error: any) {
|
||||
OrchestratorLogger.logWarning(`Failed to parse secret source YAML: ${error.message}`);
|
||||
|
||||
return [];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Fetch a secret value using the given source definition.
|
||||
*
|
||||
* Validates the key against an allowlist pattern before interpolating it
|
||||
* into the command string to prevent shell injection. The fetched secret
|
||||
* value is masked via core.setSecret() so it does not leak in logs.
|
||||
*
|
||||
* @param source - The secret source definition to use
|
||||
* @param key - The secret key to fetch
|
||||
* @returns The secret value, or empty string on failure
|
||||
*/
|
||||
static async fetchSecret(source: SecretSourceDefinition, key: string): Promise<string> {
|
||||
// Validate the key to prevent shell injection
|
||||
validateSecretKey(key);
|
||||
|
||||
const command = source.command.replace(/\{0\}/g, key);
|
||||
|
||||
try {
|
||||
const output = await OrchestratorSystem.Run(command, false, true);
|
||||
|
||||
let value: string;
|
||||
|
||||
if (source.parseOutput === 'json-field' && source.jsonField) {
|
||||
try {
|
||||
const parsed = JSON.parse(output);
|
||||
value = parsed[source.jsonField] || '';
|
||||
} catch {
|
||||
OrchestratorLogger.logWarning(`Failed to parse JSON output from ${source.name} for key ${key}`);
|
||||
value = output.trim();
|
||||
}
|
||||
} else {
|
||||
value = output.trim();
|
||||
}
|
||||
|
||||
// Mask the secret value so it does not appear in GitHub Actions logs
|
||||
maskSecretValue(value);
|
||||
|
||||
return value;
|
||||
} catch (error: any) {
|
||||
OrchestratorLogger.logWarning(`Failed to fetch secret '${key}' from ${source.name}: ${error.message}`);
|
||||
|
||||
return '';
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Fetch a secret from an environment variable. No shell command needed.
|
||||
* The value is masked via core.setSecret() so it does not leak in logs.
|
||||
*/
|
||||
static fetchFromEnv(key: string): string {
|
||||
const value = process.env[key] || '';
|
||||
maskSecretValue(value);
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve a source name and fetch all secrets from it.
|
||||
*
|
||||
* @param sourceName - Premade source name, shell command, or 'env'
|
||||
* @param keys - List of secret keys to fetch
|
||||
* @returns Map of key -> value
|
||||
*/
|
||||
static async fetchAll(sourceName: string, keys: string[]): Promise<Record<string, string>> {
|
||||
const results: Record<string, string> = {};
|
||||
|
||||
if (sourceName === 'env') {
|
||||
for (const key of keys) {
|
||||
results[key] = SecretSourceService.fetchFromEnv(key);
|
||||
}
|
||||
|
||||
return results;
|
||||
}
|
||||
|
||||
const source = SecretSourceService.resolveSource(sourceName);
|
||||
if (!source) {
|
||||
OrchestratorLogger.logWarning(
|
||||
`Unknown secret source '${sourceName}'. Available sources: ${SecretSourceService.getAvailableSources().join(
|
||||
', ',
|
||||
)}`,
|
||||
);
|
||||
|
||||
return results;
|
||||
}
|
||||
|
||||
OrchestratorLogger.log(`Fetching ${keys.length} secret(s) from ${source.name}`);
|
||||
|
||||
for (const key of keys) {
|
||||
results[key] = await SecretSourceService.fetchSecret(source, key);
|
||||
}
|
||||
|
||||
return results;
|
||||
}
|
||||
|
||||
/**
|
||||
* Simple YAML parser for secret source definitions.
|
||||
* Handles the specific structure we expect without requiring a YAML library.
|
||||
*/
|
||||
private static parseSimpleYaml(content: string): SecretSourceDefinition[] {
|
||||
const definitions: SecretSourceDefinition[] = [];
|
||||
const lines = content.split('\n');
|
||||
let current: Partial<SecretSourceDefinition> | null = null;
|
||||
|
||||
for (const rawLine of lines) {
|
||||
const line = rawLine.replace(/\r$/, '');
|
||||
const trimmed = line.trim();
|
||||
|
||||
if (trimmed === '' || trimmed.startsWith('#')) continue;
|
||||
|
||||
if (trimmed === '- name:' || trimmed.startsWith('- name:')) {
|
||||
if (current?.name && current?.command) {
|
||||
definitions.push(current as SecretSourceDefinition);
|
||||
}
|
||||
|
||||
current = {
|
||||
name: trimmed
|
||||
.replace('- name:', '')
|
||||
.trim()
|
||||
.replace(/^['"]|['"]$/g, ''),
|
||||
parseOutput: 'raw',
|
||||
};
|
||||
continue;
|
||||
}
|
||||
|
||||
if (current && trimmed.startsWith('command:')) {
|
||||
current.command = trimmed
|
||||
.replace('command:', '')
|
||||
.trim()
|
||||
.replace(/^['"]|['"]$/g, '');
|
||||
} else if (current && trimmed.startsWith('parseOutput:')) {
|
||||
const value = trimmed
|
||||
.replace('parseOutput:', '')
|
||||
.trim()
|
||||
.replace(/^['"]|['"]$/g, '');
|
||||
current.parseOutput = value as 'raw' | 'json-field';
|
||||
} else if (current && trimmed.startsWith('jsonField:')) {
|
||||
current.jsonField = trimmed
|
||||
.replace('jsonField:', '')
|
||||
.trim()
|
||||
.replace(/^['"]|['"]$/g, '');
|
||||
}
|
||||
}
|
||||
|
||||
if (current?.name && current?.command) {
|
||||
definitions.push(current as SecretSourceDefinition);
|
||||
}
|
||||
|
||||
return definitions;
|
||||
}
|
||||
}
|
||||
@@ -30,7 +30,7 @@ describe('Orchestrator Caching', () => {
|
||||
targetPlatform: 'StandaloneLinux64',
|
||||
cacheKey: `test-case-${uuidv4()}`,
|
||||
containerHookFiles: `debug-cache`,
|
||||
orchestratorBranch: `main`,
|
||||
orchestratorBranch: `orchestrator-develop`,
|
||||
orchestratorDebug: true,
|
||||
};
|
||||
|
||||
|
||||
@@ -33,7 +33,8 @@ if [ -n "$(git ls-remote --heads "$REPO" "$BRANCH" 2>/dev/null)" ]; then
|
||||
git clone -q -b "$BRANCH" "$REPO" /builder
|
||||
else
|
||||
echo "Remote branch $BRANCH not found in $REPO; falling back to a known branch"
|
||||
git clone -q -b main "$REPO" /builder \
|
||||
git clone -q -b orchestrator-develop "$REPO" /builder \
|
||||
|| git clone -q -b main "$REPO" /builder \
|
||||
|| git clone -q "$REPO" /builder
|
||||
fi
|
||||
git clone -q -b ${Orchestrator.buildParameters.branch} ${OrchestratorFolders.targetBuildRepoUrl} /repo
|
||||
|
||||
@@ -99,7 +99,8 @@ if [ -n "$(git ls-remote --heads "$REPO" "$BRANCH" 2>/dev/null)" ]; then
|
||||
git clone -q -b "$BRANCH" "$REPO" "$DEST"
|
||||
else
|
||||
echo "Remote branch $BRANCH not found in $REPO; falling back to a known branch"
|
||||
git clone -q -b main "$REPO" "$DEST" \
|
||||
git clone -q -b orchestrator-develop "$REPO" "$DEST" \
|
||||
|| git clone -q -b main "$REPO" "$DEST" \
|
||||
|| git clone -q "$REPO" "$DEST"
|
||||
fi
|
||||
chmod +x ${builderPath}`;
|
||||
|
||||
Reference in New Issue
Block a user