Warning

Alpha. This action and its API may change without notice. Contact Blacksmith support to enable it for your organization.

A GitHub Action that sets Blacksmith secrets from a CI job. Hand Blacksmith short-lived credentials your CI already mints, such as an AWS CodeArtifact token from an OIDC role, instead of storing a long-lived key in Blacksmith settings. [code]smith and Proof sessions get these secrets as env vars.

How it works

The action runs on a Blacksmith runner and authenticates with the token Blacksmith gives every job, so your workflow needs no secrets or extra permissions. Each value becomes a Team secret that is:

• Org-wide. [code]smith and Proof sessions in every repository see it. Give a value meant for one repository its own name, such as API_CODEARTIFACT_TOKEN.
• Sensitive. It is write-only: nobody can read it back in the dashboard or API.
• Created or replaced on each run, with no expiry. Refresh it more often than the credential expires.
• Managed by CI. Blacksmith settings link it to the workflow that set it and block edits, since the next run would overwrite them. You can still delete it. [code]smith sessions see the workflow too, so they can rerun it when a value expires.

Each call is all-or-nothing: if any secret is refused, none changes. New [code]smith turns and Proof runs pick up the latest values when they start.

Usage

- id: mint
  run: |
    token=$(mint-my-token)
    echo "::add-mask::${token//%/%25}"
    echo "token=$token" >> "$GITHUB_OUTPUT"
- uses: useblacksmith/set-secrets@v0.1
  with:
    secrets: |
      MY_TOKEN=${{ steps.mint.outputs.token }}
      MY_API_KEY=${{ secrets.MY_API_KEY }}

Each line is NAME=value, split at the first =, with whitespace trimmed and blank lines ignored. Values must be single-line.

Mask a value in the step that produces it, as above: GitHub logs action inputs before the action runs, so its own masking is too late. secrets.* values are already masked.

Name	Description
secrets (input, required)	1 to 10 NAME=value lines. Names use letters, digits and underscores. Values up to 8KB each.
created (output)	JSON array of the secret names this run created
updated (output)	JSON array of the secret names whose value this run replaced

Read outputs with fromJSON, e.g. contains(fromJSON(steps.set.outputs.created), 'MY_TOKEN').

Example: AWS CodeArtifact

CodeArtifact tokens last up to 12 hours. This workflow mints one every 6 hours with your CI's OIDC role and hands it to Blacksmith.

# .github/workflows/refresh-codeartifact-token.yml
name: Refresh CodeArtifact token

on:
  schedule:
    - cron: "0 */6 * * *"
  workflow_dispatch:
  pull_request:
    paths:
      - .github/workflows/refresh-codeartifact-token.yml

permissions:
  id-token: write

jobs:
  refresh:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::<account-id>:role/<ci-role>
          aws-region: <region>
      - id: mint
        run: |
          token=$(aws codeartifact get-authorization-token --domain <domain> \
            --domain-owner <account-id> --query authorizationToken --output text)
          echo "::add-mask::$token"
          echo "token=$token" >> "$GITHUB_OUTPUT"
      - uses: useblacksmith/set-secrets@v0.1
        if: github.event_name != 'pull_request'
        with:
          secrets: CODEARTIFACT_AUTH_TOKEN=${{ steps.mint.outputs.token }}

Pull requests that edit the workflow run it to check that minting works, then skip setting the secret, since the action refuses pull request events. After merging, run it once with Run workflow so the token exists before the first scheduled run. Your role's trust policy must allow the default branch, which scheduled runs use. Pull request runs also need it to allow repo:<owner>/<repo>:pull_request, but that lets any same-repository pull request run its own code with the role and obtain a CodeArtifact token before review. Only add it if everyone who can open such pull requests may hold that token, or point pull requests at a separate role with read-only access. Otherwise, drop the pull_request trigger.

Security

• Only jobs triggered by your repository's own code, such as push, schedule and workflow_dispatch, can set secrets.
• Jobs triggered by a pull request, its reviews or review comments can't, even when the branch is in the same repository, since that code may come from a fork or be unreviewed. The step fails, so a workflow that also runs on pull requests should skip it with if: ${{ !startsWith(github.event_name, 'pull_request') }}.
• Dependabot jobs can't either. GitHub withholds secrets from them.
• Any allowed job in any of your organization's repositories can replace these secrets. Review who can push to default branches and run workflows.
• The action can't touch personal secrets or repository-scoped Team secrets.
• Values are encrypted at rest and masked in the job log. Errors name the line number, never the line.

License

MIT. See LICENSE.