Skip to content

Conversation

@c-w
Copy link

@c-w c-w commented Dec 12, 2023

This pull request adds a flag to ejson2env that enables exporting only a portion of the secrets as environment variables.

The partial export functionality is described in the ejson readme but I didn't find an obvious way to achieve it with the current state of the ejson2env CLI except for post-processing the CLI output which to me seems quite brittle.

If this change is merged, a consumer of ejson2env can request a subset of secrets to be exported as such:

ejson2env ./path/to/secrets.ejson \
  --include some_key \
  --include other_key

A concrete use-case which I have for the partial export functionality is that I have one shared secrets file which I use to inject values into Github Action workflows. However, some steps of the workflow require only access to some of the subsets of the secret values. Per the principle of least privilege, I want to only expose the secret values which each step requires, as opposed to exposing all the secret values to all the steps.

@c-w c-w requested a review from burke as a code owner December 12, 2023 11:19
@c-w
Copy link
Author

c-w commented Dec 12, 2023

I have signed the CLA! (Check fails anyways with an error that seems unrelated to the pull request: "Although you appear to have the correct authorization credentials, the Shopify organization has an IP allow list enabled, and your IP address is not permitted to access this resource.")

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant