nrkno/setenv
Set enviroment variables from Vault app_role_applications autodoc: permissions: id-token: write
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 28, 2026
- License
- GPL 3.0
Pinned Snippet
uses: nrkno/github-action-setenv@06991eb888f9773dd0b64b7ef12d85d5c367ea78 # v3.1.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| name | Vault app_role_applications name | yes | — |
| env | Vault environment eg: prod | yes | — |
| token | Vault token, defaults to /vault/secrets/token | no | — |
| cluster | Can be used multiple times, exported in KUBE_CONFIG_PATH: ~/.kube/atlantis/config | no | — |
| azure | Get Azure credentials, exported as ARM_CLIENT_ID and ARM_CLIENT_SECRET | no | — |
| azure_tenant_id | Azure tenant ID. Required if --azure is set | no | "" |
| azure_subscription_id | Azure subscription ID. Subscription ID for which your state is stored. Required if --azure is set | no | "" |
| azure_resource_group | Azure resource group name. Resource group for which your state is stored. Required if --azure is set | no | "" |
| azure_no_arm | Do not export ARM_CLIENT_ID and ARM_CLIENT_SECRET, only TF_VAR_azure_client_id and TF_VAR_azure_client_secret | no | — |
| gcp | GCP project names, creates TF_VAR_gcp_project_name for use in "credentials" in google provider | no | — |
| terraform_registry | Get Terraform registry token, expects to be found in vault under "token" in secret/applications/{name}/{env}/terraform-registry | no | — |
| wait_time | Do not wait for credentials to propagate | no | — |
| eval | Output as export statements, for use with eval $() | no | — |
| new_line | Output as text separated by newline | no | — |
| debug | Print progress messages | no | — |
| vault_role_id_name | Name of the environment variable for Vault role ID, defaults to "TF_VAR_vault_role_id" | no | — |
| vault_secret_id_name | Name of the environment variable for Vault secret ID, defaults to "TF_VAR_vault_secret_id" | no | — |
| vault_secret_id_cidr | CIDR to use for Vault secret ID, defaults to the IP address from --myip-url with /32 suffix | no | — |
| cache | Cache/ use cached credentials | no | — |
| cache_file | Path and name to cache file, defaults to /tmp/{repo_name}_{workflow_name}.cache.json when running in atlantis, or /tmp/{current_workdir}.cache.json when running from shell | yes | — |
| secret | Every key/value pair in vault applications "setenv" secret is added to env vars on hardcoded path secret/applications/{name}/{env}/setenv | no | — |
| vault_secret | Get secret from vault, spec path to secret, key in secret and name of environment variable to export. Can be used multiple times, e.g. --vault-secret secret/applications/myapp/prod:mykey:MY_VAR_NAME. using * as key, all keys in secret will be exported with the speced var_name as prefix, e.g.: --vault-secret secret/applications/myapp/prod:*:MY_PREFIX_ will export MY_PREFIX_key1, MY_PREFIX_key2 etc. | no | — |
| myip_url | URL to get current IP address, default is http://icanhazip.com | no | — |
Outputs
no outputs