This GitHub Action implement workaround for the problem
Combining job outputs with masking leads to empty output.
The problem was described in
GitHub Action documentation
Outputs containing secrets are redacted on the runner and not sent to GitHub Actions.
Note
This project is part of Cloud Posse's comprehensive "SweetOps" approach towards DevOps.
Learn More
It's 100% Open Source and licensed under the APACHE2.
name: Pull Request
on:
pull_request:
branches: [ 'main' ]
types: [opened, synchronize, reopened, closed, labeled, unlabeled]
jobs:
context:
runs-on: ubuntu-latest
steps:
- name: Step with the secret output
id: iam
run: |
echo "role=arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/admin" >> $GITHUB_OUTPUT
- uses: cloudposse/github-action-secret-outputs@main
id: role
with:
## PASSWORD is a gpg passphrase stored in Github Secrets.
secret: ${{ secrets.PASSWORD }}
op: encode
in: ${{ steps.iam.outputs.role }}
outputs:
role: ${{ steps.role.outputs.out }}
usage:
runs-on: ubuntu-latest
needs: [context]
steps:
- uses: cloudposse/github-action-secret-outputs@main
id: role
with:
## PASSWORD is a gpg passphrase stored in Github Secrets.
secret: ${{ secrets.PASSWORD }}
op: decode
in: ${{ needs.context.outputs.role }}
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v1
with:
role-to-assume: ${{ steps.role.outputs.out }}
aws-region: us-east-2| Name | Description | Default | Required |
|---|---|---|---|
| in | Input data | N/A | true |
| op | Operation to perform (encode or decode) | encode | true |
| secret | Secret to encrypt/decrypt data | N/A | true |
| Name | Description |
|---|---|
| out | Result of encryption/decryption |
Check out these related projects.
- github-actions-workflows - Reusable workflows for different types of projects
For additional context, refer to some of these links.
- How to Pass Secrets Between Runners in GitHub Actions - When trying to pass a secret or masked variable between jobs in GitHub Actions using outputs, it will say 'Warning: Skip output since it may contain secrets'. This tutorial aims to provide a reasonable solution for this.
- Combining job outputs with masking leads to empty output - When combining job outputs with masking the output is empty when used in another job.
- Skip output 'AWS_ACCOUNT_ID' since it may contain secret - aws-actions/configure-aws-credentials@v1 will addMask for our aws accountid
- Workflow syntax for GitHub Actions - Outputs containing secrets are redacted on the runner and not sent to GitHub Actions
This project is under active development, and we encourage contributions from our community. Many thanks to our outstanding contributors:
Please use the issue tracker to report any bugs or file feature requests.
If you are interested in being a contributor and want to get involved in developing this project or help out with Cloud Posse's other projects, we would love to hear from you!
Hit us up in Slack, in the #cloudposse channel.
In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.
- Review our Code of Conduct and Contributor Guidelines.
- Fork the repo on GitHub
- Clone the project to your own machine
- Commit changes to your own branch
- Push your work back up to your fork
- Submit a Pull Request so that we can review your changes
NOTE: Be sure to merge the latest changes from "upstream" before making a pull request!
Join our Open Source Community on Slack. It's FREE for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totally sweet infrastructure.
Sign up for our newsletter and join 3,000+ DevOps engineers, CTOs, and founders who get insider access to the latest DevOps trends, so you can always stay in the know. Dropped straight into your Inbox every week — and usually a 5-minute read.
Join us every Wednesday via Zoom for your weekly dose of insider DevOps trends, AWS news and Terraform insights, all sourced from our SweetOps community, plus a live Q&A that you can’t find anywhere else. It's FREE for everyone!
This project is maintained by Cloud Posse, LLC.
We are a DevOps Accelerator for funded startups and enterprises. Use our ready-to-go terraform architecture blueprints for AWS to get up and running quickly. We build it with you. You own everything. Your team wins. Plus, we stick around until you succeed.
Your team can operate like a pro today.
Ensure that your team succeeds by using our proven process and turnkey blueprints. Plus, we stick around until you succeed.
📚 See What's Included
- Reference Architecture. You'll get everything you need from the ground up built using 100% infrastructure as code.
- Deployment Strategy. You'll have a battle-tested deployment strategy using GitHub Actions that's automated and repeatable.
- Site Reliability Engineering. You'll have total visibility into your apps and microservices.
- Security Baseline. You'll have built-in governance with accountability and audit logs for all changes.
- GitOps. You'll be able to operate your infrastructure via Pull Requests.
- Training. You'll receive hands-on training so your team can operate what we build.
- Questions. You'll have a direct line of communication between our teams via a Shared Slack channel.
- Troubleshooting. You'll get help to triage when things aren't working.
- Code Reviews. You'll receive constructive feedback on Pull Requests.
- Bug Fixes. We'll rapidly work with you to fix any bugs in our projects.
Preamble to the Apache License, Version 2.0
Complete license is available in the LICENSE file.
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
Copyright © 2017-2024 Cloud Posse, LLC