get-secret-from-environment.yml

name: Reusable Fetch Secret Workflow

on:
  workflow_call:
    inputs:
      secret_name:
        required: true
        type: string
      env_name:
        required: true
        type: string
    outputs:
      secret_value:
        description: 'Secret value, encrypted with the encryption key'
        value: ${{ jobs.fetch-credentials.outputs.secret_value }}
      environment_exists:
        description: 'Whether the environment exists or not'
        value: ${{ jobs.check-environment.outputs.environment_exists }}
    secrets:
      gh_token:
        required: true
      encryption_key:
        required: true
      # All secrets that are we want to allow access to need
      # to be defined in this list
      BACKUP_ENCRYPTION_PASSPHRASE:
        required: false
      SSH_KEY:
        required: false

jobs:
  check-environment:
    name: Check if Environment Exists
    runs-on: ubuntu-22.04
    outputs:
      environment_exists: ${{ steps.check-env.outputs.exists }}
    steps:
      - name: Check if GITHUB_TOKEN is set
        id: check-token
        run: |
          if [ -z "${{ secrets.gh_token }}" ]; then
            echo "Environment secret GITHUB_TOKEN is not set. Make sure you add a correct Github API token before running this pipeline."
            exit 1
          fi

      - name: Check if environment exists
        id: check-env
        run: |
          ENV_NAME="${{ inputs.env_name }}"
          RESPONSE=$(curl -s -H "Authorization: Bearer ${{ secrets.gh_token }}" \
                            "https://api.github.com/repos/${{ github.repository }}/environments/$ENV_NAME")
          if echo "$RESPONSE" | grep -q '"name": "'$ENV_NAME'"'; then
            echo "Environment $ENV_NAME exists."
            echo "::set-output name=exists::true"
          else
            echo "Environment $ENV_NAME does not exist."
            echo "::set-output name=exists::false"
          fi

  fetch-credentials:
    name: Fetch Secret
    runs-on: ubuntu-22.04
    environment: ${{ inputs.env_name }}
    needs: check-environment
    # Without this Github actions will create the environment when it doesnt exist
    if: needs.check-environment.outputs.environment_exists == 'true'
    outputs:
      secret_value: ${{ steps.fetch-credentials.outputs.secret_value }}
    steps:
      - name: Fetch the secret
        id: fetch-credentials
        env:
          SECRET_NAME: ${{ inputs.secret_name }}
        run: |
          SECRET_VALUE="${{ secrets[env.SECRET_NAME] }}"
          if [ -z "$SECRET_VALUE" ]; then
            echo "Secret ${{ inputs.secret_name }} is empty. Usually this means you have not explicitly stated the secrets"
            echo "in both the workflow file get-secrets-from-environment and in the file you are using the reusable workflow from."
            echo "Please make sure you have added the secret to the workflow files and retry."
            exit 1
          fi
          echo -n "$SECRET_VALUE" | openssl enc -aes-256-cbc -pbkdf2 -salt -k "${{ secrets.encryption_key }}" -out encrypted_key.bin
          ENCODED_ENCRYPTED_SECRET=$(base64 < encrypted_key.bin)
          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
          echo "secret_value<<$EOF" >> $GITHUB_OUTPUT
          echo "$ENCODED_ENCRYPTED_SECRET" >> $GITHUB_OUTPUT
          echo "$EOF" >> $GITHUB_OUTPUT