victorzkov/QuantumAPI Secrets

Fetch secrets from QuantumVault and expose them as masked environment variables.

Trust Signals

name	description	required	default
api-key	QuantumAPI API key (qapi_sk_…). Use a GitHub secret. Required.	yes	—
secret-paths	Newline-separated list of `ENV_VAR=secret-name` mappings. Lines starting with `#` are comments. Example: DB_PASSWORD=prod/db/password STRIPE_KEY=prod/stripe/api_key	yes	—
endpoint	QuantumAPI endpoint (defaults to https://api.quantumapi.eu).	no	https://api.quantumapi.eu
export-env	If true (default), values are written to $GITHUB_ENV. If false, values are only emitted as outputs.	no	true
secrets-file	Optional absolute path. When set, fetched secrets are also written to this file as `KEY=value` lines (one per line, mode 0600). It is the caller''s responsibility to clean up this file after use.	no	""
cache	When `true`, results are memoized for the lifetime of the job by writing a key to `$GITHUB_STATE`. A subsequent invocation in the same job that requests the same set of paths will short-circuit and reuse the previously fetched values from $GITHUB_ENV (cache is job-scoped, not pipeline-scoped).	no	false

name	description
injected-vars	Comma-separated list of environment variable names that were injected.
cache-hit	Set to `true` when a previous invocation in this job already fetched the same set of paths and the cache was reused.