git-secrets decryption in GitHub actions

776 Views Asked by At

Hello Github actions community :)

I have a workflow in github actions that I don't quite understand why it is not working.

I am currently using git-secrets to encrypt my credentials using git-secrets and I am trying to decrypt them in the github actions workflow.

This is the code block that I execute when I want to decrypt the files:

- name: Reveal data
        run: |
          echo
          echo 'Before decrypt'
          ls -ls
          git secret reveal -p ${{ secrets.PASSPHRASE }} -f
          echo 'After decrypt'
          ls -ls
          git secret whoknows
Before decrypt
total 4
4 -rw-r--r-- 1 runner docker 630 Jul 18 09:39 secrets.md.secret
done. all 1 files are revealed.
After decrypt
total 4
4 -rw-r--r-- 1 runner docker 630 Jul 18 09:39 secrets.md.secret
[email protected]

According to github actions this works because as you can see the github actions returns 'done. all 1 files are revealed.'. However, as you can see below, no new file is being generated.

Locally it works and I get the decrypted file by running the same command.

How to reproduce it locally:

  1. Install git-secrets
  2. Create a GPG key (gpg --full-generate-key)
  3. Run 'git secret tell email-used-in-the-gpg
  4. Run 'git secret add filename
  5. Run 'git secret hide' to encrypt the file
  6. Run 'rm filename'
  7. Run 'git secret reveal' and pass the password. This will create the decrypted file

How to reproduce it in github actions:

  1. Create a new workflow
  2. Paste this step:
- name: Reveal
        run: |
          git secret reveal -p ${{ secrets.PASSPHRASE }}

Does anyone have any idea what this is about? Github Workflows does not allow file creation maybe?

Thank you very much in advance and best regards!

0

There are 0 best solutions below