STACKIT Secrets Manager Action

The action connects to a STACKIT Secrets Manager instance and returns all key-value pairs from the specified path as a single JSON string in the secrets output.

Inputs

Input	Description	Default
vault_addr	Secrets Manager Base URL	https://prod.sm.eu01.stackit.cloud
vault_id	Your Secrets Manager ID, looks something like this: 6d9060fd-59b4-4dda-9106-b2dbe88acf65	-
vault_username	Your Secrets Manager Username, looks something like this: sms96o170771ttt6	-
vault_password	Your Secrets Manager Password, a random generated password provided by the STACKIT Portal	-
vault_path	The Path to your Secret can be something like this: test or folder/test	-
secrets_file_path	Optional path to file with JSON object of secret names and values	-
secrets	Optional JSON object string containing key-value pairs	-

Outputs

Output	Description
secrets	A JSON object string containing all the fetched secrets under the specified path.

Note: All secret values contained within the JSON object are automatically masked (***) as soon as they are fetched. This prevents accidental exposure in the workflow logs.

Usage

Extracting values with jq in a step

In this example, the entire JSON string is loaded into an environment variable and then parsed using jq to extract a specific key.

name: Secrets Manager via jq Example

on:
  push:

jobs:
  fetch-and-parse:
    runs-on: stackit-docker
    steps:
      - name: Fetch secrets from STACKIT Secrets Manager
        id: secrets
        uses: https://stackit-solutions.git.onstackit.cloud/actions/secretsmanager@v0.4.2
        with:
          vault_id: ${{ secrets.STACKIT_VAULT_ID }}
          vault_username: ${{ secrets.STACKIT_VAULT_USERNAME }}
          vault_password: ${{ secrets.STACKIT_VAULT_PASSWORD }}
          vault_path: "production/database"

      - name: Extract DB credentials via jq
        env:
          JSON_DATA: ${{ steps.secrets.outputs.secrets }}
        run: |
          # Safe extraction using jq into a local script variable
          DB_USER=$(printf "%s" "$JSON_DATA" | jq -r '.username')

          echo "Connecting to database as user: $DB_USER"
          # DB_USER and corresponding passwords are fully masked in logs

Extracting values with jq in a step from a file

Similar to the previous example, but this time the secrets are written to a file which can then be parsed with jq.

name: Secrets Manager via jq Example

on:
  push:

jobs:
  fetch-and-parse:
    runs-on: stackit-docker
    steps:
      - name: Fetch secrets from STACKIT Secrets Manager
        id: secrets
        uses: https://stackit-solutions.git.onstackit.cloud/actions/secretsmanager@v0.4.2
        with:
          vault_id: ${{ secrets.STACKIT_VAULT_ID }}
          vault_username: ${{ secrets.STACKIT_VAULT_USERNAME }}
          vault_password: ${{ secrets.STACKIT_VAULT_PASSWORD }}
          vault_path: "production/database"
          secrets_file_path: ${{ github.workspace }}/my-secrets.json

      - name: Extract DB credentials via jq
        run: |
          # Safe extraction using jq into a local script variable
          DB_USER=$(jq -r '.username' my-secrets.json)

          echo "Connecting to database as user: $DB_USER"
          # DB_USER and corresponding passwords are fully masked in logs

Using fromJSON expression for single key mapping

This example showcases how to use GitHub Actions' native expression context fromJSON to securely extract a single key and assign it directly to an environment variable for a step.

name: Secrets Manager via fromJSON Example

on:
  push:

jobs:
  fetch-and-map:
    runs-on: stackit-docker
    steps:
      - name: Fetch secrets from STACKIT Secrets Manager
        id: secrets
        uses: https://stackit-solutions.git.onstackit.cloud/actions/secretsmanager@v0.4.2
        with:
          vault_id: ${{ secrets.STACKIT_VAULT_ID }}
          vault_username: ${{ secrets.STACKIT_VAULT_USERNAME }}
          vault_password: ${{ secrets.STACKIT_VAULT_PASSWORD }}
          vault_path: "production/api"

      - name: Consume API Key
        env:
          # Directly map the specific key 'api_token' from the JSON object
          API_TOKEN: ${{ fromJSON(steps.secrets.outputs.secrets).api_token }}
        run: |
          # Use the environment variable securely inside your deployment script or application
          curl -H "Authorization: Bearer $API_TOKEN" https://api.example.test/deploy

Writing secrets to a path

To safely write pipeline secrets, you should wrap your context variables in a toJSON function call. This will automatically quote your secret value and escape special characters.

name: Secrets Manager write Example

on:
  push:

jobs:
  write:
    runs-on: stackit-docker
    steps:
      - name: Write secrets to STACKIT Secrets Manager
        uses: https://stackit-solutions.git.onstackit.cloud/actions/secretsmanager@v0.4.2
        with:
          vault_id: ${{ secrets.STACKIT_VAULT_ID }}
          vault_username: ${{ secrets.STACKIT_VAULT_USERNAME }}
          vault_password: ${{ secrets.STACKIT_VAULT_PASSWORD }}
          vault_path: "production/passwords"
          secrets: |
            {
              "db_password": ${{ toJSON(secrets.DB_PASSWORD) }},
              "api_token": ${{ toJSON(secrets.API_TOKEN) }},
              "my_multiline_secret": "foo\nbar\nbaz"
            }