From 4462f5706634dc5de53e189548d1609c1a2e2384 Mon Sep 17 00:00:00 2001 From: InAnYan Date: Wed, 5 Aug 2026 22:30:47 +0200 Subject: [PATCH] fix(tofu): fix secrets export parser for array JSON format and support multiline values --- .gitea/workflows/deploy-infrastructure.yml | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/deploy-infrastructure.yml b/.gitea/workflows/deploy-infrastructure.yml index 9c5f951..63d1e89 100644 --- a/.gitea/workflows/deploy-infrastructure.yml +++ b/.gitea/workflows/deploy-infrastructure.yml @@ -67,13 +67,21 @@ jobs: fi # Mask and write all secrets to GITHUB_ENV - while IFS= read -r key && IFS= read -r value; do + while IFS= read -r -d '' key && IFS= read -r -d '' value; do echo "::add-mask::$value" - echo "$key=$value" >> $GITHUB_ENV + + # Use multi-line syntax to support keys like SSH keys which have newlines + EOF_DELIMITER="EOF_${key}_${RANDOM}" + echo "$key<<$EOF_DELIMITER" >> $GITHUB_ENV + echo "$value" >> $GITHUB_ENV + echo "$EOF_DELIMITER" >> $GITHUB_ENV + if [ "$key" = "INFRASTRUCTURE_TOKEN" ]; then - echo "TF_HTTP_PASSWORD=$value" >> $GITHUB_ENV + echo "TF_HTTP_PASSWORD<<$EOF_DELIMITER" >> $GITHUB_ENV + echo "$value" >> $GITHUB_ENV + echo "$EOF_DELIMITER" >> $GITHUB_ENV fi - done < <(jq -r 'to_entries[] | (.key, .value)' secrets.json) + done < <(jq -j 'if type == "array" then .[] | (.key, "\u0000", .value, "\u0000") else to_entries[] | (.key, "\u0000", .value, "\u0000") end' secrets.json) rm -f secrets.json