refactor: rewrite with plain commands #2

maximilian.jugl · 2026-07-01T06:38:06Z

maximilian.jugl commented

2026-07-01 06:38:06 +00:00

Contains some fixes and improvements:

no need to build and download release binary (and no additional version identifier in inputs)
masks secret values automatically
writes delimited outputs
reuses one token across multiple uses of this action and reauthenticates as necessary
only requires curl and jq, both of which are pre-installed on the default stackit-docker runner
tested on stackit-docker, stackit-alpine and stackit-alpine-bash runners

Why not just use the vault CLI?

$ ll vault_2.0.3_linux_amd64.zip 
-rw-r--r--@ 1 jugl  staff   168M Jun 18 08:28 vault_2.0.3_linux_amd64.zip
$ unzip -l vault_2.0.3_linux_amd64.zip 
Archive:  vault_2.0.3_linux_amd64.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
     4919  06-17-2026 18:45   LICENSE.txt
536903029  06-17-2026 18:45   vault
---------                     -------
536907948                     2 files

512M unzipped :D

Contains some fixes and improvements: - no need to build and download release binary (and no additional version identifier in inputs) - masks secret values automatically - writes delimited outputs - reuses one token across multiple uses of this action and reauthenticates as necessary - only requires curl and jq, both of which are pre-installed on the default stackit-docker runner - tested on stackit-docker, stackit-alpine and stackit-alpine-bash runners Why not just use the vault CLI? ``` $ ll vault_2.0.3_linux_amd64.zip -rw-r--r--@ 1 jugl staff 168M Jun 18 08:28 vault_2.0.3_linux_amd64.zip $ unzip -l vault_2.0.3_linux_amd64.zip Archive: vault_2.0.3_linux_amd64.zip Length Date Time Name --------- ---------- ----- ---- 4919 06-17-2026 18:45 LICENSE.txt 536903029 06-17-2026 18:45 vault --------- ------- 536907948 2 files ``` 512M unzipped :D

maximilian.jugl added 9 commits

2026-07-01 06:38:06 +00:00

feat: add plain sh implementation of secretsmanager ffab9d2565

feat: add test workflow

Run tests / Run tests on stackit-alpine (push) Failing after 4s

Details

Run tests / Run tests on stackit-alpine-bash (push) Failing after 5s

Details

Run tests / Run tests on stackit-docker (push) Successful in 46s

Details

a1284eb903

fix: add nodejs dep

Run tests / Run tests on stackit-alpine (push) Failing after 12s

Details

Run tests / Run tests on stackit-alpine-bash (push) Failing after 8s

Details

Run tests / Run tests on stackit-docker (push) Successful in 57s

Details

9dd5779ea3

fix: remove openssl dep check

Run tests / Run tests on stackit-alpine (push) Successful in 6s

Details

Run tests / Run tests on stackit-alpine-bash (push) Successful in 8s

Details

Run tests / Run tests on stackit-docker (push) Successful in 58s

Details

beffde6bc1

feat: add formatter

Run tests / Run tests on stackit-alpine-bash (push) Successful in 7s

Details

Run tests / Run tests on stackit-alpine (push) Successful in 10s

Details

Run tests / Run tests on stackit-docker (push) Successful in 42s

Details

6aae52e3c8

feat: add check for empty secret

Run tests / Run tests on stackit-alpine (push) Successful in 10s

Details

Run tests / Run tests on stackit-alpine-bash (push) Successful in 9s

Details

Run tests / Run tests on stackit-docker (push) Successful in 47s

Details

784fc60e78

feat: update metadata 15622c3402

feat: change test trigger 15a599d2d0

docs: typo

Run tests / Run tests on stackit-alpine-bash (pull_request) Successful in 7s

Details

Run tests / Run tests on stackit-alpine (pull_request) Successful in 10s

Details

Run tests / Run tests on stackit-docker (pull_request) Successful in 38s

Details

7142cc13a9

maximilian.jugl added 1 commit

2026-07-06 07:48:58 +00:00

refactor: leading newline

Run tests / Run tests on stackit-alpine (pull_request) Successful in 7s

Details

Run tests / Run tests on stackit-alpine-bash (pull_request) Successful in 12s

Details

Run tests / Run tests on stackit-docker (pull_request) Successful in 40s

Details

ced59fed2e

marcel.henselin approved these changes

2026-07-17 08:46:49 +00:00

Dismissed

.vscode/settings.json

					
				@ -0,0 +1,5 @@

				{

why do we check in ide files?

Using prettier to auto-format and enforce consistent formatting for workflow files and the README. Others who use this repo would automatically be prompted to get the corresponding extension. This is also why npm is part of this repo. Contains prettier as a dev dependency, nothing more. It's just there for DX :)

Using [prettier](https://prettier.io/) to auto-format and enforce consistent formatting for workflow files and the README. Others who use this repo would automatically be prompted to get the corresponding extension. This is also why npm is part of this repo. Contains prettier as a dev dependency, nothing more. It's just there for DX :)

action.yml Outdated

					
				@ -50,1 +43,4 @@

				        VAULT_PASSWORD: ${{ inputs.vault_password }}

				      shell: sh

				      run: |

				        if [ -z "${VAULT_TOKEN_FILE}" ]; then

i think we should use "set -e" and probably also "set -o pipefail" here

Agree

pipefail is not supported in runner environments but -e is present now

maximilian.jugl marked this conversation as resolved

action.yml

					
				@ -51,0 +57,4 @@

				          CURRENT_TOKEN="$(cat "${VAULT_TOKEN_FILE}")"

				          if [ -n "${CURRENT_TOKEN}" ]; then

				            HTTP_CODE="$(curl -s -o /dev/null -w "%{http_code}" \

should we use the --fail option as well?

Yes

Checked it again and no, we can't have --fail here. This endpoint can return a 403 if the Vault token expired, in which case the workflow will re-issue a new token. Docs are not clear which status codes can be returned. But I'm already checking for a 200 in the source code. Added a check for 4xx and 5xx status codes and causing the workflow to exit if the status code is not 403.

maximilian.jugl marked this conversation as resolved

package.json

					
				@ -0,0 +1,5 @@

				{

do we really need npm here?

See comment on IDE files

timo.bergen approved these changes

2026-07-17 08:54:41 +00:00

maximilian.jugl added 1 commit

2026-07-17 09:21:18 +00:00

feat: add secrets_file_path input

Run tests / Run tests on stackit-alpine (pull_request) Successful in 6s

Details

Run tests / Run tests on stackit-alpine-bash (pull_request) Successful in 9s

Details

Run tests / Run tests on stackit-docker (pull_request) Successful in 43s

Details

fd32752170

maximilian.jugl added 1 commit

2026-07-17 10:08:46 +00:00

feat: add missing fail flag, -eo pipefail in shell

Run tests / Run tests on stackit-alpine-bash (pull_request) Failing after 7s

Details

Run tests / Run tests on stackit-alpine (pull_request) Failing after 7s

Details

Run tests / Run tests on stackit-docker (pull_request) Failing after 40s

Details

5e4926449b

maximilian.jugl added 1 commit

2026-07-17 10:14:24 +00:00

fix: remove pipefail option

Run tests / Run tests on stackit-alpine-bash (pull_request) Successful in 12s

Details

Run tests / Run tests on stackit-alpine (pull_request) Successful in 12s

Details

Run tests / Run tests on stackit-docker (pull_request) Successful in 1m25s

Details

ec8fe9e921

maximilian.jugl added 1 commit

2026-07-17 11:15:34 +00:00

feat: add status code check

Run tests / Run tests on stackit-alpine (pull_request) Has been cancelled

Details

Run tests / Run tests on stackit-alpine-bash (pull_request) Has been cancelled

Details

Run tests / Run tests on stackit-docker (pull_request) Has been cancelled

Details

7f78809ab0

maximilian.jugl added 1 commit

2026-07-17 11:15:48 +00:00

fix: remove -x flag

Run tests / Run tests on stackit-alpine-bash (pull_request) Successful in 7s

Details

Run tests / Run tests on stackit-alpine (pull_request) Successful in 7s

Details

Run tests / Run tests on stackit-docker (pull_request) Successful in 46s

Details

867ad00506

maximilian.jugl added 1 commit

2026-07-17 11:27:33 +00:00

feat: write response body to temporary file

Run tests / Run tests on stackit-alpine (pull_request) Successful in 8s

Details

Run tests / Run tests on stackit-alpine-bash (pull_request) Successful in 10s

Details

Run tests / Run tests on stackit-docker (pull_request) Successful in 38s

Details

f7ba0e6440

marcel.henselin approved these changes

2026-07-17 11:46:09 +00:00

maximilian.jugl merged commit c9854891f5 into main

2026-07-17 11:57:42 +00:00

maximilian.jugl deleted branch refactor/bash

2026-07-17 11:57:42 +00:00

maximilian.jugl referenced this pull request from a commit

2026-07-17 11:57:43 +00:00

Merge pull request 'refactor: rewrite with plain commands' (#2) from refactor/bash into main

Sign in to join this conversation.

No reviewers

No labels

No milestone

No project

No assignees

3 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

actions/secretsmanager!2

				`@ -0,0 +1,5 @@`
				`{`

				`@ -0,0 +1,5 @@`
				`{`

Rows
Columns