From 839a452087f766802f5e5a3829df57b57c757e4f Mon Sep 17 00:00:00 2001 From: InAnYan Date: Wed, 5 Aug 2026 22:33:34 +0200 Subject: [PATCH] fix(cli): update infisical installation script and mask secrets line-by-line in logs --- .gitea/actions/configure-homelab-ssh/action.yml | 2 +- .gitea/workflows/deploy-infrastructure.yml | 9 +++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitea/actions/configure-homelab-ssh/action.yml b/.gitea/actions/configure-homelab-ssh/action.yml index b66cf6a..6de7ded 100644 --- a/.gitea/actions/configure-homelab-ssh/action.yml +++ b/.gitea/actions/configure-homelab-ssh/action.yml @@ -47,7 +47,7 @@ runs: shell: bash run: | if ! command -v infisical &> /dev/null; then - curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash + curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | sudo -E bash sudo apt-get update && sudo apt-get install -y infisical else echo "Infisical CLI already installed" diff --git a/.gitea/workflows/deploy-infrastructure.yml b/.gitea/workflows/deploy-infrastructure.yml index 63d1e89..06665f4 100644 --- a/.gitea/workflows/deploy-infrastructure.yml +++ b/.gitea/workflows/deploy-infrastructure.yml @@ -43,7 +43,7 @@ jobs: - name: Install Infisical CLI run: | - curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash + curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | sudo -E bash sudo apt-get update && sudo apt-get install -y infisical - name: Fetch secrets from Infisical @@ -68,7 +68,12 @@ jobs: # Mask and write all secrets to GITHUB_ENV while IFS= read -r -d '' key && IFS= read -r -d '' value; do - echo "::add-mask::$value" + # Mask each line of the value individually to ensure multiline values are fully masked in the logs + while IFS= read -r line; do + if [ -n "$line" ]; then + echo "::add-mask::$line" + fi + done <<< "$value" # Use multi-line syntax to support keys like SSH keys which have newlines EOF_DELIMITER="EOF_${key}_${RANDOM}"