feat(infra): import also project secrets

.gitea/workflows/deploy-infrastructure.yml

@@ -19,6 +19,9 @@ on:
       infisical_cicd_token:
         description: "Infisical Service Token for CI/CD secrets"
         required: true
+      infisical_project_token:
+        description: "Infisical Service Token for project-specific secrets"
+        required: false
 
 jobs:
   deploy-to-proxmox:
@@ -48,7 +51,6 @@ jobs:
 
       - name: Fetch secrets from Infisical
         run: |
-          export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
           export INFISICAL_API_URL="${{ inputs.infisical_api_url || 'https://app.infisical.com' }}"
           export INFISICAL_DOMAIN="$INFISICAL_API_URL"
           export INFISICAL_DISABLE_UPDATE_CHECK=true
@@ -58,37 +60,56 @@ jobs:
             INFISICAL_ENV="${{ gitea.ref_name }}"
           fi
 
-          # Fetch all secrets in JSON format
+          fetch_secrets() {
-          echo "Exporting all secrets from Infisical..."
+            local token="$1"
-          infisical export --env="$INFISICAL_ENV" --format=json > secrets.json
+            if [ -z "$token" ]; then
-          if [ $? -ne 0 ]; then
+              return 0
-            echo "Error: Failed to fetch secrets from Infisical." >&2
+            fi
-            exit 1
-          fi
 
-          # Mask and write all secrets to GITHUB_ENV
+            export INFISICAL_TOKEN="$token"
-          while IFS= read -r -d '' key && IFS= read -r -d '' value; do
+            echo "Exporting secrets from Infisical..."
-            # Mask each line of the value individually to ensure multiline values are fully masked in the logs
+            infisical export --env="$INFISICAL_ENV" --format=json > secrets.json
-            while IFS= read -r line; do
+            if [ $? -ne 0 ]; then
-              if [ -n "$line" ]; then
+              echo "Error: Failed to fetch secrets from Infisical." >&2
-                echo "::add-mask::$line"
+              exit 1
-              fi
+            fi
-            done <<< "$value"
-            
-            # Use multi-line syntax to support keys like SSH keys which have newlines
-            EOF_DELIMITER="EOF_${key}_${RANDOM}"
-            echo "$key<<$EOF_DELIMITER" >> $GITHUB_ENV
-            echo "$value" >> $GITHUB_ENV
-            echo "$EOF_DELIMITER" >> $GITHUB_ENV
 
-            if [ "$key" = "INFRASTRUCTURE_TOKEN" ]; then
+            # Mask and write all secrets to GITHUB_ENV
-              echo "TF_HTTP_PASSWORD<<$EOF_DELIMITER" >> $GITHUB_ENV
+            while IFS= read -r -d '' key && IFS= read -r -d '' value; do
+              # Mask each line of the value individually to ensure multiline values are fully masked in the logs
+              while IFS= read -r line; do
+                if [ -n "$line" ]; then
+                  echo "::add-mask::$line"
+                fi
+              done <<< "$value"
+              
+              # Use multi-line syntax to support keys like SSH keys which have newlines
+              EOF_DELIMITER="EOF_${key}_${RANDOM}"
+              echo "$key<<$EOF_DELIMITER" >> $GITHUB_ENV
               echo "$value" >> $GITHUB_ENV
               echo "$EOF_DELIMITER" >> $GITHUB_ENV
-            fi
-          done < <(jq -j 'if type == "array" then .[] | (.key, "\u0000", .value, "\u0000") else to_entries[] | (.key, "\u0000", .value, "\u0000") end' secrets.json)
 
-          rm -f secrets.json
+              if [ "$key" = "INFRASTRUCTURE_TOKEN" ]; then
+                echo "TF_HTTP_PASSWORD<<$EOF_DELIMITER" >> $GITHUB_ENV
+                echo "$value" >> $GITHUB_ENV
+                echo "$EOF_DELIMITER" >> $GITHUB_ENV
+              fi
+            done < <(jq -j 'if type == "array" then .[] | (.key, "\u0000", .value, "\u0000") else to_entries[] | (.key, "\u0000", .value, "\u0000") end' secrets.json)
+
+            rm -f secrets.json
+          }
+
+          # Fetch general CI/CD secrets first
+          fetch_secrets "${{ secrets.infisical_cicd_token }}"
+
+          # Optionally fetch project-specific secrets
+          PROJECT_TOKEN="${{ secrets.infisical_project_token }}"
+          if [ -n "$PROJECT_TOKEN" ]; then
+            echo "Fetching project-specific secrets from Infisical..."
+            fetch_secrets "$PROJECT_TOKEN"
+          else
+            echo "No project-specific secrets token provided. Skipping."
+          fi
 
       - name: Verify Secrets
         run: |