hashicorp / vault-action

A GitHub Action that simplifies using HashiCorp Vault™ secrets as build variables.
MIT License
434 stars 138 forks source link

[FEAT] Automatically revoke token after completion of action #427

Open backjo opened 1 year ago

backjo commented 1 year ago

Is your feature request related to a problem? Please describe. As a user, I'd like to have my vault credentials automatically revoked after completion of my action.

Describe the solution you'd like I'd like the vault action to automatically revoke tokens after the action is complete, unless I tell it not to. Ideally, this could be accomplished via runs.post https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs

Describe alternatives you've considered We currently do this ourselves on every action, but less boilerplate would be nice.

-      name: Revoke tokens
        if: always()
        run: |
          curl -XPOST -sv -H "X-Vault-Token: ${{ env.VAULT_TOKEN }}" https://vault.company.com/v1/auth/token/revoke-self 
rmb938 commented 1 month ago

I would also like this functionality. It's easy to forget to add the curl step to revoke the token.