fix(tofu): fix secrets export parser for array JSON format and support multiline values

2026-08-05 22:30:47 +02:00
parent 7af7fe1f36
commit 4462f57066
1 changed files with 12 additions and 4 deletions
@@ -67,13 +67,21 @@ jobs:
          fi

          # Mask and write all secrets to GITHUB_ENV
-          while IFS= read -r key && IFS= read -r value; do
+          while IFS= read -r -d '' key && IFS= read -r -d '' value; do
            echo "::add-mask::$value"
-            echo "$key=$value" >> $GITHUB_ENV
+            
+            # Use multi-line syntax to support keys like SSH keys which have newlines
+            EOF_DELIMITER="EOF_${key}_${RANDOM}"
+            echo "$key<<$EOF_DELIMITER" >> $GITHUB_ENV
+            echo "$value" >> $GITHUB_ENV
+            echo "$EOF_DELIMITER" >> $GITHUB_ENV
+
            if [ "$key" = "INFRASTRUCTURE_TOKEN" ]; then
-              echo "TF_HTTP_PASSWORD=$value" >> $GITHUB_ENV
+              echo "TF_HTTP_PASSWORD<<$EOF_DELIMITER" >> $GITHUB_ENV
+              echo "$value" >> $GITHUB_ENV
+              echo "$EOF_DELIMITER" >> $GITHUB_ENV
            fi
-          done < <(jq -r 'to_entries[] | (.key, .value)' secrets.json)
+          done < <(jq -j 'if type == "array" then .[] | (.key, "\u0000", .value, "\u0000") else to_entries[] | (.key, "\u0000", .value, "\u0000") end' secrets.json)

          rm -f secrets.json