Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement support for masked outputs #53

Merged
merged 1 commit into from
Oct 21, 2024
Merged

Implement support for masked outputs #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,7 @@ For end-to-end workflow examples, please see [Deployment](./examples/DEPLOYMENT.
| `bypass-stack-out-of-sync-error` | Specifies whether to bypass the stack out of sync error. | `true`, `false` |
| `description` | Specifies the description of the deploymentStack. | Free-text |
| `tags` | Specifies the tags for the deploymentStack. | Free-text |
| `masked-outputs` | Specifies output names to mask values for. | Free-text |

## Contributing

Expand Down
4 changes: 4 additions & 0 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,10 @@ inputs:
description: "Specifies the tags for the deploymentStack."
required: false

masked-outputs:
description: "Specifies output names to mask values for."
required: false

runs:
using: node20
main: dist/index.js
13 changes: 10 additions & 3 deletions dist/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59331,6 +59331,7 @@ function parseConfig() {
const parameters = (0, input_1.getOptionalDictionaryInput)("parameters");
const description = (0, input_1.getOptionalStringInput)("description");
const tags = (0, input_1.getOptionalStringDictionaryInput)("tags");
const maskedOutputs = (0, input_1.getOptionalStringArrayInput)("masked-outputs");
switch (type) {
case "deployment": {
return {
Expand All @@ -59341,6 +59342,7 @@ function parseConfig() {
parametersFile,
parameters,
tags,
maskedOutputs,
operation: (0, input_1.getRequiredEnumInput)("operation", [
"create",
"validate",
Expand Down Expand Up @@ -59370,6 +59372,7 @@ function parseConfig() {
parameters,
description,
tags,
maskedOutputs,
operation: (0, input_1.getRequiredEnumInput)("operation", [
"create",
"validate",
Expand Down Expand Up @@ -59518,7 +59521,7 @@ async function execute(config, files) {
case "create": {
await tryWithErrorHandling(async () => {
const result = await deploymentCreate(config, files);
setCreateOutputs(result?.properties?.outputs);
setCreateOutputs(config, result?.properties?.outputs);
}, error => {
(0, logging_1.logError)(JSON.stringify(error, null, 2));
(0, core_1.setFailed)("Create failed");
Expand Down Expand Up @@ -59546,7 +59549,7 @@ async function execute(config, files) {
case "create": {
await tryWithErrorHandling(async () => {
const result = await stackCreate(config, files);
setCreateOutputs(result?.properties?.outputs);
setCreateOutputs(config, result?.properties?.outputs);
}, error => {
(0, logging_1.logError)(JSON.stringify(error, null, 2));
(0, core_1.setFailed)("Create failed");
Expand Down Expand Up @@ -59580,13 +59583,17 @@ async function execute(config, files) {
throw error;
}
}
function setCreateOutputs(outputs) {
function setCreateOutputs(config, outputs) {
if (!outputs) {
return;
}
for (const key of Object.keys(outputs)) {
const output = outputs[key];
(0, core_1.setOutput)(key, output.value);
if (config.maskedOutputs &&
config.maskedOutputs.some(x => x.toLowerCase() === key.toLowerCase())) {
(0, core_1.setSecret)(output.value);
}
}
}
async function deploymentCreate(config, files) {
Expand Down
2 changes: 1 addition & 1 deletion dist/index.js.map
View file
Open in desktop

Large diffs are not rendered by default.

4 changes: 4 additions & 0 deletions src/config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ type CommonConfig = {
name?: string;
location?: string;
tags?: Record<string, string>;
maskedOutputs?: string[];
} & FileConfig;

type WhatIfChangeType =
Expand Down Expand Up @@ -102,6 +103,7 @@ export function parseConfig(): DeploymentsConfig | DeploymentStackConfig {
const parameters = getOptionalDictionaryInput("parameters");
const description = getOptionalStringInput("description");
const tags = getOptionalStringDictionaryInput("tags");
const maskedOutputs = getOptionalStringArrayInput("masked-outputs");

switch (type) {
case "deployment": {
Expand All @@ -113,6 +115,7 @@ export function parseConfig(): DeploymentsConfig | DeploymentStackConfig {
parametersFile,
parameters,
tags,
maskedOutputs,
operation: getRequiredEnumInput("operation", [
"create",
"validate",
Expand Down Expand Up @@ -145,6 +148,7 @@ export function parseConfig(): DeploymentsConfig | DeploymentStackConfig {
parameters,
description,
tags,
maskedOutputs,
operation: getRequiredEnumInput("operation", [
"create",
"validate",
Expand Down
17 changes: 13 additions & 4 deletions src/handler.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.
import { setOutput, setFailed } from "@actions/core";
import { setOutput, setFailed, setSecret } from "@actions/core";
import { CloudError, Deployment, ErrorResponse } from "@azure/arm-resources";
import { DeploymentStack } from "@azure/arm-resourcesdeploymentstacks";
import { RestError } from "@azure/core-rest-pipeline";
Expand Down Expand Up @@ -60,7 +60,7 @@ export async function execute(config: ActionConfig, files: ParsedFiles) {
await tryWithErrorHandling(
async () => {
const result = await deploymentCreate(config, files);
setCreateOutputs(result?.properties?.outputs);
setCreateOutputs(config, result?.properties?.outputs);
},
error => {
logError(JSON.stringify(error, null, 2));
Expand Down Expand Up @@ -94,7 +94,7 @@ export async function execute(config: ActionConfig, files: ParsedFiles) {
await tryWithErrorHandling(
async () => {
const result = await stackCreate(config, files);
setCreateOutputs(result?.properties?.outputs);
setCreateOutputs(config, result?.properties?.outputs);
},
error => {
logError(JSON.stringify(error, null, 2));
Expand Down Expand Up @@ -137,14 +137,23 @@ export async function execute(config: ActionConfig, files: ParsedFiles) {
}
}

function setCreateOutputs(outputs?: Record<string, unknown>) {
function setCreateOutputs(
config: ActionConfig,
outputs?: Record<string, unknown>,
) {
if (!outputs) {
return;
}

for (const key of Object.keys(outputs)) {
const output = outputs[key] as { value: string };
setOutput(key, output.value);
if (
config.maskedOutputs &&
config.maskedOutputs.some(x => x.toLowerCase() === key.toLowerCase())
) {
setSecret(output.value);
}
}
}

Expand Down
4 changes: 4 additions & 0 deletions test/config.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,6 +264,7 @@ describe("input parsing", () => {
parameters: '{"foo": "bar2"}',
description: "mockDescription",
tags: '{"foo": "bar"}',
"masked-outputs": "abc,def",
"what-if-exclude-change-types": "noChange",
});

Expand All @@ -288,6 +289,7 @@ describe("input parsing", () => {
tags: {
foo: "bar",
},
maskedOutputs: ["abc", "def"],
whatIf: {
excludeChangeTypes: ["noChange"],
},
Expand All @@ -307,6 +309,7 @@ describe("input parsing", () => {
parameters: '{"foo": "bar2"}',
description: "mockDescription",
tags: '{"foo": "bar"}',
"masked-outputs": "abc,def",
"action-on-unmanage-resources": "delete",
"action-on-unmanage-resourcegroups": "delete",
"action-on-unmanage-managementgroups": "delete",
Expand Down Expand Up @@ -337,6 +340,7 @@ describe("input parsing", () => {
tags: {
foo: "bar",
},
maskedOutputs: ["abc", "def"],
actionOnUnManage: {
resources: "delete",
resourceGroups: "delete",
Expand Down
48 changes: 48 additions & 0 deletions test/handler.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@ import {
import { Color, colorize } from "../src/helpers/logging";

describe("deployment execution", () => {
afterEach(() => jest.clearAllMocks());

describe("subscription scope", () => {
const scope: SubscriptionScope = {
type: "subscription",
Expand Down Expand Up @@ -95,6 +97,17 @@ describe("deployment execution", () => {
"mockOutput",
"foo",
);
expect(mockActionsCore.setSecret).not.toHaveBeenCalled();
});

it("masks secure values", async () => {
mockDeploymentsOps.beginCreateOrUpdateAtSubscriptionScopeAndWait!.mockResolvedValue(
mockReturnPayload,
);

await execute({ ...config, maskedOutputs: ["mockOutput"] }, files);

expect(mockActionsCore.setSecret).toHaveBeenCalledWith("foo");
});

it("validates", async () => {
Expand Down Expand Up @@ -210,6 +223,17 @@ describe("deployment execution", () => {
"mockOutput",
"foo",
);
expect(mockActionsCore.setSecret).not.toHaveBeenCalled();
});

it("masks secure values", async () => {
mockDeploymentsOps.beginCreateOrUpdateAtSubscriptionScopeAndWait!.mockResolvedValue(
mockReturnPayload,
);

await execute({ ...config, maskedOutputs: ["mockOutput"] }, files);

expect(mockActionsCore.setSecret).toHaveBeenCalledWith("foo");
});

it("handles deploy errors", async () => {
Expand Down Expand Up @@ -287,6 +311,8 @@ describe("deployment execution", () => {
});

describe("stack execution", () => {
afterEach(() => jest.clearAllMocks());

describe("subscription scope", () => {
const scope: SubscriptionScope = {
type: "subscription",
Expand Down Expand Up @@ -360,6 +386,17 @@ describe("stack execution", () => {
"mockOutput",
"foo",
);
expect(mockActionsCore.setSecret).not.toHaveBeenCalled();
});

it("masks secure values", async () => {
mockStacksOps.beginCreateOrUpdateAtSubscriptionAndWait!.mockResolvedValue(
mockReturnPayload,
);

await execute({ ...config, maskedOutputs: ["mockOutput"] }, files);

expect(mockActionsCore.setSecret).toHaveBeenCalledWith("foo");
});

it("validates", async () => {
Expand Down Expand Up @@ -459,6 +496,17 @@ describe("stack execution", () => {
"mockOutput",
"foo",
);
expect(mockActionsCore.setSecret).not.toHaveBeenCalled();
});

it("masks secure values", async () => {
mockStacksOps.beginCreateOrUpdateAtSubscriptionAndWait!.mockResolvedValue(
mockReturnPayload,
);

await execute({ ...config, maskedOutputs: ["mockOutput"] }, files);

expect(mockActionsCore.setSecret).toHaveBeenCalledWith("foo");
});

it("validates", async () => {
Expand Down
1 change: 1 addition & 0 deletions test/mocks/actionCoreMocks.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ export const mockActionsCore = {
getInput: jest.fn(),
setFailed: jest.fn(),
setOutput: jest.fn(),
setSecret: jest.fn(),
};

// eslint-disable-next-line jest/no-untyped-mock-factory
Expand Down