chore: bump version [skip ci]

VERSION

@@ -1 +1 @@
-1.5.0
+1.10.0

docker/README.md

@@ -20,6 +20,7 @@ Build a Docker image and push it to the Gitea container registry
 | `ARTIFACT_NAME` | <p>Name of the build artifact to download</p> | `false` | `dist` |
 | `ARTIFACT_PATH` | <p>Destination path for the downloaded artifact</p> | `false` | `dist` |
 | `TAG_LATEST` | <p>Also tag and push the image as latest</p> | `false` | `false` |
+| `TAG_PREFIX` | <p>Optional prefix to prepend to IMAGE_TAG (e.g. 'dev' produces 'dev-&lt;tag&gt;'). Does not affect the latest tag.</p> | `false` | `""` |
 | `WORKING_DIRECTORY` | <p>Working directory for the Docker build</p> | `false` | `.` |
 <!-- action-docs-inputs source="action.yml" -->
 

docker/action.yml

@@ -28,6 +28,9 @@ inputs:
   TAG_LATEST:
     description: "Also tag and push the image as latest"
     default: "false"
+  TAG_PREFIX:
+    description: "Optional prefix to prepend to IMAGE_TAG (e.g. 'dev' produces 'dev-<tag>'). Does not affect the latest tag."
+    default: ""
   WORKING_DIRECTORY:
     description: "Working directory for the Docker build"
     default: "."
@@ -51,7 +54,11 @@ runs:
     - name: Docker Build and Push
       shell: sh
       run: |
-        TAGS="-t ${{ inputs.IMAGE_PATH }}:${{ inputs.IMAGE_TAG }}"
+        TAG="${{ inputs.IMAGE_TAG }}"
+        if [ -n "${{ inputs.TAG_PREFIX }}" ]; then
+          TAG="${{ inputs.TAG_PREFIX }}-${TAG}"
+        fi
+        TAGS="-t ${{ inputs.IMAGE_PATH }}:${TAG}"
         if [ "${{ inputs.TAG_LATEST }}" = "true" ]; then
           TAGS="$TAGS -t ${{ inputs.IMAGE_PATH }}:latest"
         fi

helm/upgrade/action.yml

@@ -37,26 +37,38 @@ runs:
   steps:
     - name: Helm OCI Login
       shell: sh
+      env:
+        REGISTRY: ${{ inputs.REGISTRY }}
+        REGISTRY_USERNAME: ${{ inputs.REGISTRY_USERNAME }}
+        REGISTRY_TOKEN: ${{ inputs.REGISTRY_TOKEN }}
       run: |
-        echo "${{ inputs.REGISTRY_TOKEN }}" | helm registry login ${{ inputs.REGISTRY }} \
+        echo "$REGISTRY_TOKEN" | helm registry login "$REGISTRY" \
-          --username ${{ inputs.REGISTRY_USERNAME }} \
+          --username "$REGISTRY_USERNAME" \
           --password-stdin
 
     - name: Helm Upgrade
       shell: sh
+      env:
+        DEPLOYMENT_NAME: ${{ inputs.DEPLOYMENT_NAME }}
+        DEPLOYMENT_NAMESPACE: ${{ inputs.DEPLOYMENT_NAMESPACE }}
+        CHART_PATH: ${{ inputs.CHART_PATH }}
+        VALUES_FILE: ${{ inputs.VALUES_FILE }}
+        IMAGE_PATH: ${{ inputs.IMAGE_PATH }}
+        IMAGE_TAG: ${{ inputs.IMAGE_TAG }}
+        TAG_KEY: ${{ inputs.TAG_KEY }}
       run: |
-        NAMESPACE="${{ inputs.DEPLOYMENT_NAMESPACE }}"
+        NAMESPACE="$DEPLOYMENT_NAMESPACE"
-        if [ -z "$NAMESPACE" ]; then NAMESPACE="${{ inputs.DEPLOYMENT_NAME }}"; fi
+        if [ -z "$NAMESPACE" ]; then NAMESPACE="$DEPLOYMENT_NAME"; fi
         SET_FLAGS=""
-        if [ -n "${{ inputs.TAG_KEY }}" ] && [ -n "${{ inputs.IMAGE_TAG }}" ]; then
+        if [ -n "$TAG_KEY" ] && [ -n "$IMAGE_TAG" ]; then
-          SET_FLAGS="$SET_FLAGS --set ${{ inputs.TAG_KEY }}=${{ inputs.IMAGE_TAG }}"
+          SET_FLAGS="$SET_FLAGS --set $TAG_KEY=$IMAGE_TAG"
         fi
-        if [ -n "${{ inputs.IMAGE_PATH }}" ]; then
+        if [ -n "$IMAGE_PATH" ]; then
-          SET_FLAGS="$SET_FLAGS --set image.repository=${{ inputs.IMAGE_PATH }}"
+          SET_FLAGS="$SET_FLAGS --set image.repository=$IMAGE_PATH"
         fi
-        helm dependency update ${{ inputs.CHART_PATH }}
+        helm dependency update "$CHART_PATH"
-        echo "Running: helm upgrade ${{ inputs.DEPLOYMENT_NAME }} ${{ inputs.CHART_PATH }} -n ${NAMESPACE} --values ${{ inputs.VALUES_FILE }}${SET_FLAGS}"
+        echo "Running: helm upgrade $DEPLOYMENT_NAME $CHART_PATH -n $NAMESPACE --values $VALUES_FILE$SET_FLAGS"
-        helm upgrade ${{ inputs.DEPLOYMENT_NAME }} ${{ inputs.CHART_PATH }} -n ${NAMESPACE} --values ${{ inputs.VALUES_FILE }} $SET_FLAGS
+        helm upgrade "$DEPLOYMENT_NAME" "$CHART_PATH" -n "$NAMESPACE" --values "$VALUES_FILE" $SET_FLAGS
 
     - name: Remove kubeconfig
       if: always()

infisical/fetch-secret/action.yml

@@ -24,7 +24,7 @@ inputs:
     default: "/"
 outputs:
   value:
-    description: "The fetched secret value"
+    description: "The fetched secret value (base64-encoded)"
     value: ${{ steps.fetch.outputs.value }}
 
 runs:
@@ -61,10 +61,11 @@ runs:
           exit 1
         fi
 
-        echo "::add-mask::$VALUE"
+        B64=$(printf '%s' "$VALUE" | base64 | tr -d '\n')
+        echo "::add-mask::$B64"
 
         DELIMITER="INFISICAL_EOF_$$"
         echo "value<<${DELIMITER}" >> "$GITHUB_OUTPUT"
-        echo "$VALUE" >> "$GITHUB_OUTPUT"
+        printf '%s\n' "$B64" >> "$GITHUB_OUTPUT"
         echo "${DELIMITER}" >> "$GITHUB_OUTPUT"
         echo "Successfully fetched secret '${{ inputs.SECRET_NAME }}'"

kubectl/configure/action.yml

@@ -2,7 +2,7 @@ name: Configure Kubectl
 description: Configure kubectl for use with Kubernetes
 inputs:
   K8S_CONFIG:
-    description: "The RAW Kubernetes config"
+    description: "The base64-encoded Kubernetes config"
     required: true
   K8S_NAMESPACE:
     description: "The K8S namespace"
@@ -16,7 +16,9 @@ runs:
   steps:
     - name: Mask kubeconfig
       shell: sh
-      run: echo "::add-mask::${{ inputs.K8S_CONFIG }}"
+      env:
+        K8S_CONFIG: ${{ inputs.K8S_CONFIG }}
+      run: echo "::add-mask::$K8S_CONFIG"
 
     - name: Configure kubectl
       shell: sh
@@ -26,7 +28,7 @@ runs:
         echo "Configuring kubectl for context=${{ inputs.K8S_CONTEXT }} namespace=${{ inputs.K8S_NAMESPACE }}"
         rm -f ~/.kube/config
         mkdir -p ~/.kube
-        printf '%s' "$K8S_CONFIG" > ~/.kube/config
+        printf '%s' "$K8S_CONFIG" | base64 -d > ~/.kube/config
         kubectl config set-context ${{ inputs.K8S_CONTEXT }} --cluster=${{ inputs.K8S_CONTEXT }} --namespace=${{ inputs.K8S_NAMESPACE }}
         kubectl config use-context ${{ inputs.K8S_CONTEXT }}
         echo "kubectl configured successfully"