GitHub Action

Descarga secretos a archivos .env durante un flujo de GitHub Actions.

Configuración de GitHub Action

La GitHub Action precompilada de Envilder obtiene secretos de AWS SSM o Azure Key Vault en archivos .env durante tu workflow CI/CD. Usa la etiqueta publicada macalbert/envilder/github-action@v0; el proyecto consumidor no necesita ningún paso de compilación.

Prerrequisitos

AWS: Configura credenciales con aws-actions/configure-aws-credentials
Azure: Configura credenciales con azure/login
Un envilder.json en tu repositorio

La GitHub Action solo soporta el modo pull (sin push).

Ejemplo básico de workflow

.github/workflows/deploy.ymlyaml

name: Deploy Application

on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region: us-east-1

      - name: Pull Secrets from AWS SSM
        uses: macalbert/envilder/github-action@v0
        with:
          map-file: config/envilder.json
          env-file: .env

      - uses: actions/setup-node@v6
        with:
          node-version: "22.x"

      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - run: pnpm deploy

Workflow de Azure Key Vault

.github/workflows/deploy-azure.ymlyaml

name: Deploy with Azure Key Vault

on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5

      - name: Azure Login
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Pull Secrets from Azure Key Vault
        uses: macalbert/envilder/github-action@v0
        with:
          map-file: config/envilder.json
          env-file: .env
          provider: azure
          vault-url: https://my-vault.vault.azure.net

      - uses: actions/setup-node@v6
        with:
          node-version: "22.x"
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - run: pnpm deploy

Workflow multi-entorno

.github/workflows/deploy-env.ymlyaml

name: Deploy to Environment

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment'
        required: true
        type: choice
        options: [dev, staging, production]

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-24.04
    environment: ${{ inputs.environment }}
    steps:
      - uses: actions/checkout@v5

      - uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region: us-east-1

      - name: Pull ${{ inputs.environment }} secrets
        uses: macalbert/envilder/github-action@v0
        with:
          map-file: config/${{ inputs.environment }}/envilder.json
          env-file: .env

      - uses: actions/setup-node@v6
        with:
          node-version: "22.x"
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - run: pnpm deploy

Inputs y outputs de la Action

Inputs

Input	Requerido	Por defecto	Descripción
`map-file`	Sí	-	Ruta al archivo JSON de mapeo
`env-file`	Sí	-	Ruta al archivo .env a generar
`provider`	No	`aws`	aws o azure
`vault-url`	No	-	URL de Azure Key Vault

Outputs

Output	Descripción
`env-file-path`	Ruta al archivo .env generado