From 7af7fe1f36e0030280dbe15a66a1a7befbf3a1c5 Mon Sep 17 00:00:00 2001
From: InAnYan <ruslanpopov1512@gmail.com>
Date: Wed, 5 Aug 2026 22:27:11 +0200
Subject: [PATCH] refactor(tofu): export all secrets to env

---
 .gitea/workflows/deploy-infrastructure.yml | 27 +++++++++++++---------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/.gitea/workflows/deploy-infrastructure.yml b/.gitea/workflows/deploy-infrastructure.yml
index ab38832..9c5f951 100644
--- a/.gitea/workflows/deploy-infrastructure.yml
+++ b/.gitea/workflows/deploy-infrastructure.yml
@@ -58,19 +58,24 @@ jobs:
             INFISICAL_ENV="${{ gitea.ref_name }}"
           fi
 
-          # Fetch secrets (assuming CLI is pre-installed)
-          echo "Fetching secrets from Infisical..."
-          PROXMOX_VE_API_TOKEN=$(infisical secrets get PROXMOX_VE_API_TOKEN --env="$INFISICAL_ENV" --plain)
-          INFRASTRUCTURE_TOKEN=$(infisical secrets get INFRASTRUCTURE_TOKEN --env="$INFISICAL_ENV" --plain)
+          # Fetch all secrets in JSON format
+          echo "Exporting all secrets from Infisical..."
+          infisical export --env="$INFISICAL_ENV" --format=json > secrets.json
+          if [ $? -ne 0 ]; then
+            echo "Error: Failed to fetch secrets from Infisical." >&2
+            exit 1
+          fi
 
-          # Mask values in logs immediately
-          echo "::add-mask::$PROXMOX_VE_API_TOKEN"
-          echo "::add-mask::$INFRASTRUCTURE_TOKEN"
+          # Mask and write all secrets to GITHUB_ENV
+          while IFS= read -r key && IFS= read -r value; do
+            echo "::add-mask::$value"
+            echo "$key=$value" >> $GITHUB_ENV
+            if [ "$key" = "INFRASTRUCTURE_TOKEN" ]; then
+              echo "TF_HTTP_PASSWORD=$value" >> $GITHUB_ENV
+            fi
+          done < <(jq -r 'to_entries[] | (.key, .value)' secrets.json)
 
-          # Export to GITHUB_ENV for subsequent steps/env context
-          echo "PROXMOX_VE_API_TOKEN=$PROXMOX_VE_API_TOKEN" >> $GITHUB_ENV
-          echo "INFRASTRUCTURE_TOKEN=$INFRASTRUCTURE_TOKEN" >> $GITHUB_ENV
-          echo "TF_HTTP_PASSWORD=$INFRASTRUCTURE_TOKEN" >> $GITHUB_ENV
+          rm -f secrets.json
 
       - name: Verify Secrets
         run: |