google-github-actions/Get Secret Manager secrets

Get secrets from Google Secret Manager and make their results available as output variables.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
secrets	List of secrets to access and inject into the environment. These are comma-separated or newline-separated `OUTPUTNAME:SECRET`. Output names or secret names that contain separators must be escaped with a backslash (e.g. `\,` or `\\n`) unless quoted. Any leading or trailing whitespace is trimmed unless values are quoted. ```yaml secrets: \|- output1:my-project/my-secret1 output2:my-project/my-secret2 ``` Secrets can be referenced using the following formats: ```text # Long form projects/<project-id>/secrets/<secret-id>/versions/<version-id> # Long form - "latest" version projects/<project-id>/secrets/<secret-id> # Short form <project-id>/<secret-id>/<version-id> # Short form - "latest" version <project-id>/<secret-id> ```	yes	—
min_mask_length	Minimum line length for a secret to be masked. Extremely short secrets (e.g. `{` or `a`) can make GitHub Actions log output unreadable. This is especially important for multi-line secrets, since each line of the secret is masked independently.	no	4
export_to_environment	Make the fetched secrets additionally available as environment variables.	no	false
encoding	Encoding in which secrets will be exported into outputs (and environment variables if `export_to_environment` is true). For secrets that cannot be represented in text, such as encryption key bytes, choose an encoding that has a safe character such as `base64` or `hex`. For more information about available encoding types, please see the [Node.js Buffer and character encodings](https://nodejs.org/docs/latest/api/buffer.html#buffers-and-character-encodings).	no	utf8
universe	The Google Cloud universe to use for constructing API endpoints. The default universe is "googleapis.com", which corresponds to https://cloud.google.com. Trusted Partner Cloud and Google Distributed Hosted Cloud should set this to their universe address.	no	googleapis.com

Outputs

name	description
secrets	Each secret is prefixed with an output name. The secret's resolved access value will be available at that output in future build steps. For example: ```yaml jobs: job_id: steps: - id: 'secrets' uses: 'google-github-actions/get-secretmanager-secrets@v3' with: secrets: \|- token:my-project/docker-registry-token ``` will be available in future steps as the output: ```text steps.secrets.outputs.token ```

name

description

secrets

Each secret is prefixed with an output name. The secret's resolved access value will be available at that output in future build steps. For example: ```yaml jobs: job_id: steps: - id: 'secrets' uses: 'google-github-actions/get-secretmanager-secrets@v3' with: secrets: |- token:my-project/docker-registry-token ``` will be available in future steps as the output: ```text steps.secrets.outputs.token ```