hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions

Prefer age for release secret decrypt
Some checks failed
Cache: Publish Nix / Publish Nix Cache (push) Has been cancelled
Details
Build Rust / Cargo Test (push) Successful in 4m0s
Details
Build Site / Next.js Build (push) Failing after 4s
Details
Lint Governance / BEP Metadata (push) Successful in 1s
Details

Browse source
This commit is contained in:
Conrad Kramer 2026-06-07 11:56:04 -07:00
parent 83da429854
commit ef7023f9be
3 changed files with 16 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
.forgejo/actions/decrypt-release-secrets/action.yml
View file

@ -71,6 +71,11 @@ runs:
nix_bin="$(resolve_nix_bin || true)"
if [[ -n "$nix_bin" ]]; then
local built
built="$("$nix_bin" --extra-experimental-features 'nix-command flakes' build --no-link "$ROOT#age" --print-out-paths 2>/dev/null | tail -n 1 || true)"
if [[ -n "$built" && -x "$built/bin/age" ]]; then
printf 'age:%s\n' "$built/bin/age"
return 0
fi
built="$("$nix_bin" --extra-experimental-features 'nix-command flakes' build --no-link "$ROOT#agenix" --print-out-paths 2>/dev/null | tail -n 1 || true)"
if [[ -n "$built" && -x "$built/bin/agenix" ]]; then
printf 'agenix:%s\n' "$built/bin/agenix"
@ -93,7 +98,11 @@ runs:
decrypt_age_file() {
local file_path="$1"
if [[ "$decrypt_kind" == "agenix" ]]; then
"$decrypt_bin" --identity "$KEY" --decrypt "$file_path"
local agenix_path="$file_path"
if [[ "$file_path" == "$ROOT/"* ]]; then
agenix_path="${file_path#"$ROOT"/}"
fi
(cd "$ROOT" && "$decrypt_bin" --identity "$KEY" --decrypt "$agenix_path")
else
"$decrypt_bin" --decrypt -i "$KEY" "$file_path"
fi