From c91ba8cf2fe1a4ee779c5a8266191a2d906c50b3 Mon Sep 17 00:00:00 2001
From: blam <ben@blam.sh>
Date: Wed, 26 Jan 2022 09:42:29 +0100
Subject: [PATCH] feat: Added the ability for the scaffolder backend engine to
 template secrets into the input of actions

Signed-off-by: blam <ben@blam.sh>
---
 .../tasks/NunjucksWorkflowRunner.test.ts      | 54 +++++++++++++++++++
 .../tasks/NunjucksWorkflowRunner.ts           |  9 +++-
 2 files changed, 62 insertions(+), 1 deletion(-)

diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts
index 161d5b865b..2fc6b99406 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts
@@ -497,6 +497,60 @@ describe('DefaultWorkflowRunner', () => {
         expect.objectContaining({ secrets: { foo: 'bar' } }),
       );
     });
+
+    it('should be able to template secrets into the input of an action', async () => {
+      const task = createMockTaskWithSpec(
+        {
+          apiVersion: 'scaffolder.backstage.io/v1beta3',
+          steps: [
+            {
+              id: 'test',
+              name: 'name',
+              action: 'jest-mock-action',
+              input: {
+                b: '${{ secrets.foo }}',
+              },
+            },
+          ],
+          output: {},
+          parameters: {},
+        },
+        { foo: 'bar' },
+      );
+
+      await runner.execute(task);
+
+      expect(fakeActionHandler).toHaveBeenCalledWith(
+        expect.objectContaining({ input: { b: 'bar' } }),
+      );
+    });
+
+    it('does not allow templating of secrets as an output', async () => {
+      const task = createMockTaskWithSpec(
+        {
+          apiVersion: 'scaffolder.backstage.io/v1beta3',
+          steps: [
+            {
+              id: 'test',
+              name: 'name',
+              action: 'jest-mock-action',
+              input: {
+                b: '${{ secrets.foo }}',
+              },
+            },
+          ],
+          output: {
+            b: '${{ secrets.foo }}',
+          },
+          parameters: {},
+        },
+        { foo: 'bar' },
+      );
+
+      const executedTask = await runner.execute(task);
+
+      expect(executedTask.output.b).toBeUndefined();
+    });
   });
 
   describe('filters', () => {
diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts
index 5089998834..889e94d000 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts
@@ -53,6 +53,7 @@ type TemplateContext = {
   steps: {
     [stepName: string]: { output: { [outputName: string]: JsonValue } };
   };
+  secrets?: Record<string, string>;
 };
 
 const isValidTaskSpec = (taskSpec: TaskSpec): taskSpec is TaskSpecV1beta3 => {
@@ -231,8 +232,14 @@ export class NunjucksWorkflowRunner implements WorkflowRunner {
           const action = this.options.actionRegistry.get(step.action);
           const { taskLogger, streamLogger } = createStepLogger({ task, step });
 
+          // Secrets are only passed when templating the input to actions for security reasons
           const input =
-            (step.input && this.render(step.input, context, renderTemplate)) ??
+            (step.input &&
+              this.render(
+                step.input,
+                { ...context, secrets: task.secrets ?? {} },
+                renderTemplate,
+              )) ??
             {};
 
           if (action.schema?.input) {