step-security/Get Secret Manager secrets
Get secrets from Google Secret Manager and make their results available as output variables.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| secrets | List of secrets to access and inject into the environment. These are comma-separated or newline-separated `OUTPUTNAME:SECRET`. Output names or secret names that contain separators must be escaped with a backslash (e.g. `\,` or `\\n`) unless quoted. Any leading or trailing whitespace is trimmed unless values are quoted. ```yaml secrets: |- output1:my-project/my-secret1 output2:my-project/my-secret2 ``` Secrets can be referenced using the following formats: ```text # Long form projects/<project-id>/secrets/<secret-id>/versions/<version-id> # Long form - "latest" version projects/<project-id>/secrets/<secret-id> # Short form <project-id>/<secret-id>/<version-id> # Short form - "latest" version <project-id>/<secret-id> ``` | yes | — |
| min_mask_length | Minimum line length for a secret to be masked. Extremely short secrets (e.g. `{` or `a`) can make GitHub Actions log output unreadable. This is especially important for multi-line secrets, since each line of the secret is masked independently. | no | 4 |
| export_to_environment | Make the fetched secrets additionally available as environment variables. | no | false |
| encoding | Encoding in which secrets will be exported into outputs (and environment variables if `export_to_environment` is true). For secrets that cannot be represented in text, such as encryption key bytes, choose an encoding that has a safe character such as `base64` or `hex`. For more information about available encoding types, please see the [Node.js Buffer and character encodings](https://nodejs.org/docs/latest/api/buffer.html#buffers-and-character-encodings). | no | utf8 |
| universe | The Google Cloud universe to use for constructing API endpoints. The default universe is "googleapis.com", which corresponds to https://cloud.google.com. Trusted Partner Cloud and Google Distributed Hosted Cloud should set this to their universe address. | no | googleapis.com |
Outputs
| name | description |
|---|---|
| secrets | Each secret is prefixed with an output name. The secret's resolved access value will be available at that output in future build steps. For example: ```yaml jobs: job_id: steps: - id: 'secrets' uses: 'step-security/google-github-auth@v3' with: secrets: |- token:my-project/docker-registry-token ``` will be available in future steps as the output: ```text steps.secrets.outputs.token ``` |