refactor(tofu): export all secrets to env

.gitea/workflows/deploy-infrastructure.yml

@@ -58,19 +58,24 @@ jobs:
             INFISICAL_ENV="${{ gitea.ref_name }}"
           fi
 
-          # Fetch secrets (assuming CLI is pre-installed)
+          # Fetch all secrets in JSON format
-          echo "Fetching secrets from Infisical..."
+          echo "Exporting all secrets from Infisical..."
-          PROXMOX_VE_API_TOKEN=$(infisical secrets get PROXMOX_VE_API_TOKEN --env="$INFISICAL_ENV" --plain)
+          infisical export --env="$INFISICAL_ENV" --format=json > secrets.json
-          INFRASTRUCTURE_TOKEN=$(infisical secrets get INFRASTRUCTURE_TOKEN --env="$INFISICAL_ENV" --plain)
+          if [ $? -ne 0 ]; then
+            echo "Error: Failed to fetch secrets from Infisical." >&2
+            exit 1
+          fi
 
-          # Mask values in logs immediately
+          # Mask and write all secrets to GITHUB_ENV
-          echo "::add-mask::$PROXMOX_VE_API_TOKEN"
+          while IFS= read -r key && IFS= read -r value; do
-          echo "::add-mask::$INFRASTRUCTURE_TOKEN"
+            echo "::add-mask::$value"
+            echo "$key=$value" >> $GITHUB_ENV
+            if [ "$key" = "INFRASTRUCTURE_TOKEN" ]; then
+              echo "TF_HTTP_PASSWORD=$value" >> $GITHUB_ENV
+            fi
+          done < <(jq -r 'to_entries[] | (.key, .value)' secrets.json)
 
-          # Export to GITHUB_ENV for subsequent steps/env context
+          rm -f secrets.json
-          echo "PROXMOX_VE_API_TOKEN=$PROXMOX_VE_API_TOKEN" >> $GITHUB_ENV
-          echo "INFRASTRUCTURE_TOKEN=$INFRASTRUCTURE_TOKEN" >> $GITHUB_ENV
-          echo "TF_HTTP_PASSWORD=$INFRASTRUCTURE_TOKEN" >> $GITHUB_ENV
 
       - name: Verify Secrets
         run: |