feat: Added the ability for the scaffolder backend engine to template secrets into the input of actions

Signed-off-by: blam <ben@blam.sh>

plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts

@@ -497,6 +497,60 @@ describe('DefaultWorkflowRunner', () => {
         expect.objectContaining({ secrets: { foo: 'bar' } }),
       );
     });
+
+    it('should be able to template secrets into the input of an action', async () => {
+      const task = createMockTaskWithSpec(
+        {
+          apiVersion: 'scaffolder.backstage.io/v1beta3',
+          steps: [
+            {
+              id: 'test',
+              name: 'name',
+              action: 'jest-mock-action',
+              input: {
+                b: '${{ secrets.foo }}',
+              },
+            },
+          ],
+          output: {},
+          parameters: {},
+        },
+        { foo: 'bar' },
+      );
+
+      await runner.execute(task);
+
+      expect(fakeActionHandler).toHaveBeenCalledWith(
+        expect.objectContaining({ input: { b: 'bar' } }),
+      );
+    });
+
+    it('does not allow templating of secrets as an output', async () => {
+      const task = createMockTaskWithSpec(
+        {
+          apiVersion: 'scaffolder.backstage.io/v1beta3',
+          steps: [
+            {
+              id: 'test',
+              name: 'name',
+              action: 'jest-mock-action',
+              input: {
+                b: '${{ secrets.foo }}',
+              },
+            },
+          ],
+          output: {
+            b: '${{ secrets.foo }}',
+          },
+          parameters: {},
+        },
+        { foo: 'bar' },
+      );
+
+      const executedTask = await runner.execute(task);
+
+      expect(executedTask.output.b).toBeUndefined();
+    });
   });
 
   describe('filters', () => {

plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts

@@ -53,6 +53,7 @@ type TemplateContext = {
   steps: {
     [stepName: string]: { output: { [outputName: string]: JsonValue } };
   };
+  secrets?: Record<string, string>;
 };
 
 const isValidTaskSpec = (taskSpec: TaskSpec): taskSpec is TaskSpecV1beta3 => {
@@ -231,8 +232,14 @@ export class NunjucksWorkflowRunner implements WorkflowRunner {
           const action = this.options.actionRegistry.get(step.action);
           const { taskLogger, streamLogger } = createStepLogger({ task, step });
 
+          // Secrets are only passed when templating the input to actions for security reasons
           const input =
-            (step.input && this.render(step.input, context, renderTemplate)) ??
+            (step.input &&
+              this.render(
+                step.input,
+                { ...context, secrets: task.secrets ?? {} },
+                renderTemplate,
+              )) ??
             {};
 
           if (action.schema?.input) {