action.yml

name: 'GitHub Secrets Exporter'
description: 'Securely export repository secrets encrypted with age'
branding:
  icon: 'lock'
  color: 'blue'

inputs:
  public_encryption_key:
    description: 'Your public encryption key (age or SSH format)'
    required: true
  secrets_json:
    description: 'JSON of repository secrets (e.g. toJSON(secrets))'
    required: true

runs:
  using: 'composite'
  steps:
    - name: Install age
      shell: bash
      run: sudo apt-get update && sudo apt-get install -y age

    - name: Export and encrypt all secrets
      shell: bash
      run: |
        set -euo pipefail

        recipient='${{ inputs.public_encryption_key }}'
        secrets_json='${{ inputs.secrets_json }}'

        # Validate recipient format to avoid shell interpretation
        [[ "$recipient" =~ ^[A-Za-z0-9._:+/=-]+$ ]] || {
          echo "public_encryption_key contains unsafe characters" >&2
          exit 1
        }

        # Validate secrets_json is not empty
        [ -n "$secrets_json" ] || {
          echo "Error: secrets_json input is empty" >&2
          exit 1
        }

        # Stream secrets to age without echoing (secrets only exist in memory)
        printf '%s' "$secrets_json" | \
          age -r "$recipient" \
          -o /tmp/encrypted-secrets.age

    - name: Upload encrypted secrets
      uses: actions/upload-artifact@v4
      with:
        name: encrypted-secrets
        path: /tmp/encrypted-secrets.age
        retention-days: 1

    - name: Cleanup and show instructions
      shell: bash
      run: |
        echo "✓ Secrets encrypted and uploaded as artifact"
        echo ""
        echo "Download with:"
        echo "  gh run download ${{ github.run_id }} -n encrypted-secrets"
        echo ""
        echo "Then decrypt:"
        echo "  age --decrypt --identity private.key < encrypted-secrets.age"
        echo ""
        echo "Artifact will auto-delete in 1 day"