Skip to content

fix(ci): harden Infisical secret sync #331

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
KooshaPari wants to merge 3 commits into
base: codex/byteport-cargo-semver-tauri-deps
Choose a base branch
from
+16 −13
Draft

fix(ci): harden Infisical secret sync #331

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ff44961
fix(ci): harden Infisical secret sync workflow
KooshaPari Aug 3, 2026
6ea5cda
fix(ci): normalize Infisical workflow guard
KooshaPari Aug 3, 2026
3b37aee
style(ci): apply Prettier to Infisical workflow
KooshaPari Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 16 additions & 13 deletions .github/workflows/infisical.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,22 @@ on:
push:
branches: [main, master]
paths:
- '.github/workflows/infisical.yml'
pull_request:
- ".github/workflows/infisical.yml"

# Secret-backed jobs must never run from untrusted pull-request code.
permissions:
contents: read

jobs:
sync-secrets:
name: Pull secrets from Infisical
# A reusable caller must also be trusted; never pull credentials for a
# pull_request context, even if another workflow invokes this one.
if: >-
github.event_name != 'pull_request' &&
github.event_name != 'pull_request_target'
permissions:
contents: read
runs-on: blacksmith-2vcpu-ubuntu-2204
timeout-minutes: 5
steps:
Expand All @@ -27,7 +37,7 @@ jobs:
curl -1sLf "https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh" | sudo -E bash
sudo apt-get install -y infisical

- name: Pull secrets to .env
- name: Validate Infisical access without exposing values
env:
INFISICAL_TOKEN: ${{ secrets.INFISICAL_TOKEN }}
INFISICAL_PROJECT_ID: ${{ vars.INFISICAL_PROJECT_ID || secrets.INFISICAL_PROJECT_ID || '8efe392e-56a6-4c3c-89f9-8141183dd7e8' }}
Expand All @@ -43,17 +53,10 @@ jobs:
exit 1
fi

# Pull all secrets from the configured env into .env
# Inject secrets only into this short-lived child process. Do not
# write a local secrets file or print the resulting environment.
infisical run \
--projectId "$INFISICAL_PROJECT_ID" \
--env "$INFISICAL_ENV" \
--token "$INFISICAL_TOKEN" \
-- bash -c 'echo "Secrets loaded into env successfully" && env | grep -E "^[A-Z_]+=" | grep -v -E "^(PATH|HOME|PWD|SHELL|HOSTNAME|TERM|GITHUB_|RUNNER_|CARGO_|DEPLOY_|INPUT_|IMAGE_|ACTIONS_|STEP_|BOOT_|GRUB_|LS_COLORS|INVOCATION_ID|JOURNAL_)" | head -20'

- name: Upload secrets as artifact (debug only, never published)
if: failure()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: infisical-debug
path: .env
retention-days: 1
-- bash -c 'printf "%s\\n" "Infisical secrets loaded successfully"'
Loading