Merge pull request #1 from aragon/feat/credential-to-file

Feat/credential to file

Author: jjavieralv

steps/credential-retrieval/action.yml

@@ -1,18 +1,48 @@
-name: "credential retrieval"
-description: "Retrieve the credentials from password manager"
+name: "Credential Retrieval"
+description: "Retrieve credentials from a password manager"
 
 inputs:
-  load-all:
-    description: "Loads all the credentials in 1Password vault"
+  mode:
+    description: |
+      Mode to use the credential retrieval library:
+      - alltoenv: Loads all credentials in the 1Password vault and sets them as MASKED GitHub environment variables.
+      - alltofile: Loads all credentials in the 1Password vault and stores them in a specified file.
+        Options:
+          - secret-filepath
+          - file-format
     required: false
-    type: boolean
-    default: true
+    type: choice
+    default: "alltoenv"
+    options:
+      - alltoenv
+      - alltofile
+
+  secret-filepath:
+    description: |
+      Specifies the filepath where secrets will be downloaded.
+      Secrets will be appended to the end of the file.
+    required: false
+    type: string
+    default: ".env"
+
+  file-format:
+    description: |
+      Specifies the format of the configuration file.
+      - env: Uses the format VARNAME=VARVALUE
+    required: false
+    type: choice
+    default: "env"
+    options:
+      - env
+
+  # OP values
   op-token:
-    description: "1Password token of the service account"
+    description: "1Password token for the service account"
     required: true
     type: string
+
   op-vault:
-    description: "1Password vault to search all credentials"
+    description: "1Password vault to search for all credentials"
     required: true
     type: string
 
@@ -23,14 +53,23 @@ runs:
       uses: 1password/install-cli-action@v1
       with:
         version: latest-beta
-    - name: Download ALL vault secrets
-      if: ${{ inputs.load-all }}
+
+    - name: List All Items in the Vault
       env:
         OP_SERVICE_ACCOUNT_TOKEN: "${{ inputs.op-token }}"
       shell: bash
       run: |
-        echo "Get a list with all the credential names"
+        echo "Retrieving a list of all credential names in the vault ${{ inputs.op-vault }}"
         op item list --vault ${{ inputs.op-vault }} --categories 'API Credential' --format json > op_list.json
+
+    - name: "Download All Vault Secrets and Set Them as envvars"
+      if: ${{ inputs.mode == 'alltoenv' }}
+      env:
+        OP_SERVICE_ACCOUNT_TOKEN: "${{ inputs.op-token }}"
+      shell: bash
+      run: |
+        # Download ALL vault secrets and SET THEM AS VARS
+        # Extracts number of items
         if [[ -f op_list.json ]];then
           number_entries=$(jq length op_list.json)
         fi
@@ -39,7 +78,32 @@ runs:
           item_name=$(jq -r ".[$i].title" op_list.json)
           item_credential=$(op read "op://${{ inputs.op-vault }}/${item_name}/credential")
           echo "::add-mask::$item_credential"
-          echo ${item_name}=${item_credential} >> $GITHUB_ENV
+          echo "${item_name}=${item_credential}" >> $GITHUB_ENV
         done
+        rm op_list.json
 
+    - name: "Download All Vault Secrets and Store Them in File ${{ inputs.secret-filepath }}"
+      if: ${{ inputs.mode == 'alltofile' }}
+      env:
+        OP_SERVICE_ACCOUNT_TOKEN: "${{ inputs.op-token }}"
+      shell: bash
+      run: |
+        # Download ALL vault secrets and STORE THEM IN FILE ${{ inputs.secret-filepath }}
+        # Extracts number of items
+        if [[ -f op_list.json ]];then
+          number_entries=$(jq length op_list.json)
+        fi
+        for ((i=0; i<number_entries; i++)); do
+          item_name=$(jq -r ".[$i].title" op_list.json)
+          item_credential=$(op read "op://${{ inputs.op-vault }}/${item_name}/credential")
+          case "${{ inputs.file-format }}" in
+            "env")
+              echo "${item_name}=${item_credential}" >> "${{ inputs.secret-filepath }}"
+              ;;
+            *)
+              echo "Unsupported output format: ${{ inputs.file-format }}"
+              exit 1
+              ;;
+          esac
+        done
         rm op_list.json