如何将 Github 机密作为 json 文件中的值传递？

Question

我正在使用Cypress.io进行自动化测试并使用Github Actions在 CI/D 中触发它。 配置cypress.json文件具有嵌套的env值，如下所示：

{
  "baseUrl": "<url-to-login>",
  "env": {
    "roles": {
      "admin": {
        "PASSWORD": "<password>",
        "USERNAME": "<username>"
      },
      "employee": {
        "PASSWORD": "<password>",
        "USERNAME": "<username>"
      },
      "client": {
        "PASSWORD": "<password>",
        "USERNAME": "<username>"
      }
    }
  }
}

不幸的是，赛普拉斯无法访问深度环境变量，所以我正在创建配置cypress.json ，如下所示：

name: Cypress Tests

on: [push]

jobs:
  cypress-run:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        # creates cypress.json file to run Cypress
      - name: Create Cypress config files
        run: |
          echo '{ "baseUrl": "${{ secrets.BASE_URL }}", "env": { "roles": { "admin": { "PASSWORD": "${{ secrets.PASSWORD }}", "USERNAME": "${{ secrets.USERNAME }}" } } } }' > cypress.json
      - name: Cypress run
        uses: cypress-io/github-action@v2
        with:
          build: yarn run
          start: yarn cypress:run
          wait-on-timeout: 120
          browser: chrome

它不起作用，但我硬编码了它确实起作用的值：

run: |
          echo '{ "baseUrl": "<hardcoded-redacted-value>", "env": { "roles": { "admin": { "PASSWORD": "<hardcoded-redacted-value>", "USERNAME": "<hardcoded-redacted-value>" } } } }' > cypress.json

所以我的问题是，如何在json文件中传递秘密？

Answer 1

我想你会发现它是对 setPluginResolvedOn 函数 #7960 上未定义值的固定检查

const roles = Cypress.env('roles') 
expect(roles.client.PASSWORD).to.eq('<password>')   // ✅ passes

Answer 2

我通过将整个cypress.json配置文件的内容存储为GitHub 的存储库加密密钥来解决了这个问题。 然后，我使用create-json GitHub Action生成在 CI/CD 上运行Cypress所需的cypress.json 。 这是最终的.github/workflows/main.yml文件：

name: Cypress Tests

on: [push]

jobs:
  cypress-run:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: create-json
        id: create-json
        uses: jsdaniell/create-json@1.1.2
        with:
          name: "cypress.json"
          json: ${{ secrets.CYPRESS_CONFIG_JSON }}
      - name: Cypress run
        uses: cypress-io/github-action@v2
        with:
          build: yarn run
          start: yarn cypress:run
          wait-on-timeout: 120
          browser: chrome