GitHub Actions environment management

This repository holds reusable workflows and composite actions that are securely piped secrets and environent variables to dynamically configure actions.

Reusable workflows

Reusable workflows must be invocated with "secrets: inherit" and "env: ${{ secrets }}" must be configured for downstream actions utilised by the reusable workflow:

### Invoking workflow ###jobs:
ci:
name: invocationuses: ./.github/workflows/reusable-secret-env.yaml# 'secrets: inherit' along with the 'env: ${{ secrets }}' in downstream actions will make all secrets available as env variables in downstream actionssecrets: inheritwith:
env_vars: | ENV_VARIABLE_FOO=HELLO ENV_VARIABLE_BAR=WORLD---
### Reusable workflow ###name: secret-envon:
workflow_call:
inputs:
env_vars:
description: A literal block scalar of environment variables to set up, given in env=value format.required: falsetype: stringjobs:
build:
name: secret-env-variablesruns-on: ubuntu-lateststeps:
- name: Set environment variablesif: ${{ inputs.env_vars }}run: | for i in "${{ inputs.env_vars }}" do printf "%s\n" $i >> $GITHUB_ENV done - name: echo environment variablesenv: ${{ secrets }}run: | printenv

The output from the echo environment variables action is as follows:

printenv
shell: /usr/bin/bash -e {0}
env:
ENV_VARIABLE_FOO: HELLO
ENV_VARIABLE_BAR: WORLD
github_token: ***
RANDOM_TEST_SECRET: ***

Where RANDOM_TEST_SECRET is a secret that lives in the context of the repository

As we can see: no secrets are leaked.

Reusable workflows with composite actions

The behaviour is the same when utilizing reusable workflows calling composite actions.
You must only pipe "env: ${{ secrets }}" to the invocation of the composite action.
This entails that you do not have to setup env for the separate downstream actions orchastrated within the composite action:

### Reusable workflow ###name: reusable-secret-env-compositeon:
workflow_call:
inputs:
env_vars:
description: A literal block scalar of environment variables to set up, given in env=value format.required: falsetype: stringjobs:
build:
name: secret-env-variablesruns-on: ubuntu-lateststeps:
- name: echo env secretsuses: tsanton/github-action-environment-management/actions/echo-env-secrets@mainenv: ${{ secrets }}with:
env_vars: ${{ inputs.env_vars }}
---
### Composite action ###name: echo-env-secretdescription: Ensure that we're able to pass secrets as environment variables to steps in composite actions used by reusable workflowsinputs:
env_vars:
description: A literal block scalar of environment variables to set up, given in env=value format.required: falsetype: stringruns:
using: "composite"steps:
- name: Set environment variablesif: ${{ inputs.env_vars }}shell: bashrun: | for i in "${{ inputs.env_vars }}" do printf "%s\n" $i >> $GITHUB_ENV done - name: echo environment variablesshell: bashrun: | printenv

Again, the output from the echo environment variables action is as follows:

printenv
shell: /usr/bin/bash -e {0}
env:
ENV_VARIABLE_FOO: HELLO
ENV_VARIABLE_BAR: WORLD
github_token: ***
RANDOM_TEST_SECRET: ***

Where RANDOM_TEST_SECRET is a secret that lives in the context of the repository.

As before: we can see that no secrets are leaked.