decode base64 Github Secrets

Question

I am setting up a pipeline to run Cypress automated tests using github actions/workflows on my code anytime there is a push to the repo. I came into a scenario where I want to generate dyanmic .env files depending on the branch , so instead of hard coding variables i created a base64 string and saved that as an secret and accessed that secret inside the code, however when i try to decode i run into issues, let me show you my code

ci.yml

name: Nuxt CI Pipeline
    on:
      push:
        branches: [ Cypress-reconfigure ]
      # pull_request:
      #   branches: [ master ]
jobs:
  build:
runs-on: ubuntu-latest

strategy:
  matrix:
    node-version: [ 14.x ]
    # See supported Node.js release schedule at https://nodejs.org/en/about/releases/

steps:
- uses: actions/checkout@v2
- name: Use Node.js ${{ matrix.node-version }}
  uses: actions/setup-node@v2
  with:
    node-version: ${{ matrix.node-version }}
    cache: 'npm'
- name: Generating .env files
  env:
    STAGING_ENV_FILE: ${{ secrets.STAGING_ENV_FILE }}
    PRODUCTION_ENV_FILE: ${{ secrets.PRODUCTION_ENV_FILE }}
  run: |
    [ &quot;$GITHUB_REF_NAME&quot; = Cypress-reconfigure ] &amp;&amp; echo $STAGING_ENV_FILE | base64 --decode &gt; .env
    [ &quot;$GITHUB_REF_NAME&quot; = staging ] &amp;&amp; echo $PRODUCTION_ENV_FILE | base64 --decode &gt; .env
- run: cat .env 
- run: npm ci
- run: npm run cy:ci

Screenshot

I followed this answer which was best suited for my scenario Stack Overflow post

As you can see, the error doesnt say anything it just exists! I have very limited knowledge of Devops can someone help me out with what I am doing wrong?

BMitch · Accepted Answer · 2022-01-25T16:00:13.707

This is guaranteed to always fail:

      run: |
        [ "$GITHUB_REF_NAME" = Cypress-reconfigure ] && echo $STAGING_ENV_FILE | base64 --decode > .env
        [ "$GITHUB_REF_NAME" = staging ] && echo $PRODUCTION_ENV_FILE | base64 --decode > .env

Why? Depending on the value of $GITHUB_REF_NAME only one of the lines will run. But the other line will return a non-zero return code:

$ [ "a" = "b" ] && true
$ echo $?
1

And GHA is configured to abort on the first command that doesn't return a zero exit code (that's the successful exit code).

To fix, you should use an if-then, rather than the shell one-liner:

      run: |
        if [ "$GITHUB_REF_NAME" = Cypress-reconfigure ]; then echo $STAGING_ENV_FILE | base64 --decode > .env; fi
        if [ "$GITHUB_REF_NAME" = staging ]; then echo $PRODUCTION_ENV_FILE | base64 --decode > .env; fi

Note that I didn't include a different workaround in the shell command of ignoring errors with a || true:

[ "$GITHUB_REF_NAME" = Cypress-reconfigure ] && echo $STAGING_ENV_FILE | base64 --decode > .env || true

because it results in false positives if the command (e.g. base64 --decode) fails.

decode base64 Github Secrets

1 Answers1