92 lines
2.5 KiB
YAML
92 lines
2.5 KiB
YAML
name: decrypt SOPS secrets
|
|
description: installs SOPS and decrypts all *.sops.* files using an age key
|
|
|
|
inputs:
|
|
sops-age-key:
|
|
description: age private key SOPS_AGE_KEY
|
|
required: true
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: resolve SOPS target
|
|
shell: bash
|
|
env:
|
|
## renovate: datasource=github-releases depName=getsops/sops
|
|
SOPS_VERSION: v3.13.3 ## latest
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
os=$(uname -s | tr '[:upper:]' '[:lower:]')
|
|
arch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
|
|
|
|
{
|
|
echo "SOPS_VERSION=$SOPS_VERSION"
|
|
echo "SOPS_OS=$os"
|
|
echo "SOPS_ARCH=$arch"
|
|
} >> "$GITHUB_ENV"
|
|
|
|
- name: restore cached SOPS
|
|
id: sops-cache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: ${{ runner.temp }}/sops
|
|
key: sops-${{ runner.os }}-${{ runner.arch }}-${{ env.SOPS_VERSION }}
|
|
|
|
- name: install SOPS
|
|
if: steps.sops-cache.outputs.cache-hit != 'true'
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
asset="sops-${SOPS_VERSION}.${SOPS_OS}.${SOPS_ARCH}"
|
|
url="https://github.com/getsops/sops/releases/download/${SOPS_VERSION}"
|
|
|
|
tmp=$(mktemp -d)
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
|
|
curl -fsSL -o "$tmp/$asset" "$url/$asset" \
|
|
-o "$tmp/checksums.txt" "$url/sops-${SOPS_VERSION}.checksums.txt"
|
|
(cd "$tmp" && grep " ${asset}$" checksums.txt | shasum -a 256 -c -)
|
|
|
|
mkdir -p "$RUNNER_TEMP/sops"
|
|
chmod +x "$tmp/$asset"
|
|
mv "$tmp/$asset" "$RUNNER_TEMP/sops/sops"
|
|
|
|
- name: add SOPS to PATH
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
chmod +x "$RUNNER_TEMP/sops/sops"
|
|
echo "$RUNNER_TEMP/sops" >> "$GITHUB_PATH"
|
|
|
|
- name: decrypt .sops files
|
|
shell: bash
|
|
env:
|
|
SOPS_AGE_KEY: ${{ inputs.sops-age-key }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
echo "searching for SOPS files to decrypt..."
|
|
|
|
while IFS= read -r -d '' file; do
|
|
dir=$(dirname "$file"); base=$(basename "$file")
|
|
output_file="$dir/${base/.sops/}"
|
|
|
|
echo "decrypting '$file' to '$output_file'"
|
|
|
|
tmp=$(mktemp "$dir/.sops-decrypt.XXXXXX")
|
|
|
|
if ! sops --decrypt "$file" > "$tmp" || [ ! -s "$tmp" ]; then
|
|
echo "decryption of '$file' failed or produced empty output" >&2
|
|
rm -f "$tmp"
|
|
exit 1
|
|
fi
|
|
|
|
chmod 600 "$tmp"
|
|
mv "$tmp" "$output_file"
|
|
done < <(find . -type f -name "*.sops.*" -not -name ".sops.yaml" -print0)
|
|
|
|
echo "SOPS decryption complete."
|