从戈朗脚本中检索带有空格的 Github 机密

Question

我想通过戈朗从脚本中检索一个Github秘密内容，该内容是从Github操作执行的。在这种特殊情况下，存储在 Github 机密中的机密值具有空间。我的意思是秘密值是：.JWT <token-string>

从任何语言的任何脚本中检索 Github 机密（只要它们在 Github 操作运行器中执行）的方法是将它们作为环境变量读取。所以我正在做的是以这种方式阅读它：（请参阅下面字符串切片中的元素）Authorization:

func MyTestFunction(t *testing.T, serverURL string) {

    type AppLogin struct {

        token string

    }

    method := "GET"

    

    headers := map[string][]string{

        "Content-Type": []string{"application/json, text/plain, */*"},

        "Authorization": []string{os.Getenv("USER_JWT")},

    }

问题是，在运行 Github 操作运行器时，我没有从 Github 机密中获取值。我知道自从我试图以这种方式打印它以来，这种情况正在发生，但没有任何结果：

fmt.Println("My JWT", os.Getenv("USER_JWT"))

我担心它正在发生，因为令牌和令牌之间的空间，我的意思是。"JWT "JWT <token-string>

这里说：

机密名称只能包含字母数字字符（[a-z]、[A-Z]、[0-9]）或下划线 （_）。不允许使用空格。

作为一个重要的事实，我的令牌秘密值在其值中也包含字符。该值如下所示：.

JWT xxxxxxx8888xxxxdsdsfsfsf9.eyJxxxxxxx8888xxxxdsdsfsfsf9.Tfgxadsdsfsfsasasad_s7sdsdsfgsgcs

所以我相信，这就是我无法获得秘密价值的原因。

我不确定如何从我的Golang脚本中获取它，我甚至试图修改Github秘密值，只是为了避免值中的空格，我以这种方式从go调用它：<token-string>

"Authorization": []string{"JWT ", os.Getenv("SPECKLE_USER_JWT")}

但它没有奏效。我在这里读到，当从github操作中调用具有特殊字符的机密时，我们必须用单引号转义它们，但此过程来自文件github操作。' '.yaml

我正在尝试以前的解决方案替代方案，它们适用于我的本地计算机，因为我的bash cli能够获取值中带有空格的环境变量。我不确定我 - 让我们说“逃脱” - 一个在字符串中留有空间的秘密，就像我从golang那里得到的那样。

Answer 1

我设法从执行戈兰泰拉泰坦代码的GitHub操作中读取了存储在GitHub秘密中的JWT秘密。如前所述，由于Github机密不允许空格和点字符，并且令牌有一些点加一个空格，因此我首先做的是对其进行编码" ".echo -n '<token-value>' | base64这将生成一个没有空格的整个字符串，然后我将此值存储在Github机密上。我从戈朗这样读：.func main() {&nbsp; &nbsp;var t *testing.T&nbsp; &nbsp;serverURL := os.Getenv("SERVER_URL")&nbsp; &nbsp;MyTestFunction(t, serverURL)}func MyTestFunction(t *testing.T, serverURL string) {&nbsp; &nbsp; type SpeckleLogin struct {&nbsp; &nbsp; &nbsp; &nbsp; token string&nbsp; &nbsp; }&nbsp; &nbsp; method := "GET"&nbsp; &nbsp; // The encoded token is read from github secrets&nbsp; &nbsp; b64EncodeJwt := os.Getenv("USER_JWT_ENCODE")&nbsp; &nbsp; // fmt.Println("The encode JWT is:", b64EncodeJwt)&nbsp; &nbsp; // The encoded read token is decoded&nbsp; &nbsp; b64DecodeJwt, _ := b64.StdEncoding.DecodeString(b64EncodeJwt)&nbsp; &nbsp; // fmt.Println("JWT Decoded", string(b64DecodeJwt))&nbsp; &nbsp; // fmt.Println()&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; headers := map[string][]string{&nbsp; &nbsp; &nbsp; &nbsp; "Content-Type": []string{"application/json, text/plain, */*"},&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; // The content of the token already decoded is included in the headers slice of strings.&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; "Authorization": []string{(string(b64DecodeJwt))},&nbsp; &nbsp; }&nbsp; &nbsp; jsonLogin := []byte(fmt.Sprintf(`{&nbsp; &nbsp; &nbsp; &nbsp; "email":"%s",&nbsp; &nbsp; &nbsp; &nbsp; "password": "%s"&nbsp; &nbsp; }`, os.Getenv("USER_EMAIL"), os.Getenv("USER_PASSWORD")))&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; // The HTTP request is created&nbsp; &nbsp; reqLogin, errReq := http.NewRequest(method, serverURL+"/api/accounts", bytes.NewBuffer(jsonLogin))&nbsp; &nbsp; // The headers are added to the HTTP request&nbsp; &nbsp; reqLogin.Header = headers&nbsp; &nbsp; if errReq != nil {&nbsp; &nbsp; &nbsp; &nbsp; messageReq := fmt.Sprintf("Error GET login request: %s", errReq.Error())&nbsp; &nbsp; &nbsp; &nbsp; t.Fatal(messageReq)&nbsp; &nbsp; }&nbsp; &nbsp; clientLogin := &http.Client{&nbsp; &nbsp; &nbsp; &nbsp; Transport: &http.Transport{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TLSClientConfig: &tls.Config{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; InsecureSkipVerify: true,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; }&nbsp; &nbsp; // Sending the request&nbsp; &nbsp; respLogin, errResp := clientLogin.Do(reqLogin)&nbsp; &nbsp; if errResp != nil {&nbsp; &nbsp; &nbsp; &nbsp; messageResp := fmt.Sprintf("Error GET login response: %s", errResp.Error())&nbsp; &nbsp; &nbsp; &nbsp; t.Fatal(messageResp)&nbsp; &nbsp; }&nbsp; &nbsp; defer respLogin.Body.Close()&nbsp; &nbsp; body, _ := ioutil.ReadAll(respLogin.Body)&nbsp; &nbsp; // fmt.Println("BODY IS:")&nbsp; &nbsp; // fmt.Println(string(body))&nbsp; &nbsp; var speckleLogin map[string]interface{}&nbsp; &nbsp; if err := json.Unmarshal([]byte(body), &speckleLogin); err != nil {&nbsp; &nbsp; &nbsp; &nbsp; t.Fatal("Could not unmarshal json")&nbsp; &nbsp; }&nbsp; &nbsp; // We take the API token from the response&nbsp; &nbsp; data := speckleLogin["resource"].(map[string]interface{})["apitoken"]&nbsp; &nbsp;&nbsp; &nbsp; if speckleToken, ok := data.(string); ok {&nbsp; &nbsp; &nbsp; &nbsp; // Here we assert the token is not empty&nbsp; &nbsp; &nbsp; &nbsp; assert.NotEmpty(t, speckleToken)}但除此之外，正如@WishwaPerera试图告诉我的那样，我从上面调用的gorang中使用的新环境变量必须包含在我的github操作中，以便从命令运行这些测试。所以我的github操作文件最终是这样：SPECKLE_USER_JWT_ENCODEgo test.yamlname: Preview_Workflowon:&nbsp; pull_request:&nbsp; &nbsp; branches:&nbsp; &nbsp; - masterjobs:&nbsp; build-and-deploy:&nbsp; &nbsp; runs-on: ubuntu-latest&nbsp; &nbsp; steps:&nbsp; &nbsp; - name: 'Checkout GitHub Action'&nbsp; &nbsp; &nbsp; uses: actions/checkout@master&nbsp; &nbsp; - name: Install terraform&nbsp;&nbsp; &nbsp; &nbsp; uses: hashicorp/setup-terraform@v1&nbsp; &nbsp; &nbsp; with:&nbsp; &nbsp; &nbsp; &nbsp; terraform_version: 0.13.5&nbsp; &nbsp; &nbsp; &nbsp; terraform_wrapper: false&nbsp; &nbsp; - name: 'Terraform Version'&nbsp; &nbsp; &nbsp; shell: bash&nbsp; &nbsp; &nbsp; run: |&nbsp; &nbsp; &nbsp; &nbsp; terraform version&nbsp; &nbsp; - name: 'Login via Azure CLI'&nbsp; &nbsp; &nbsp; uses: azure/login@v1&nbsp; &nbsp; &nbsp; with:&nbsp; &nbsp; &nbsp; &nbsp; creds: ${{ secrets.AZURE_CREDENTIALS }}&nbsp; &nbsp; - name: 'Setup Go'&nbsp; &nbsp; &nbsp; id: go&nbsp; &nbsp; &nbsp; uses: actions/setup-go@v2&nbsp; &nbsp; &nbsp; with:&nbsp; &nbsp; &nbsp; &nbsp; go-version: '^1.16.5'&nbsp; &nbsp; - name: 'Run Terratest'&nbsp; &nbsp; &nbsp; id: terratest&nbsp; &nbsp; &nbsp; run: |&nbsp; &nbsp; &nbsp; &nbsp; cd tests&nbsp; &nbsp; &nbsp; &nbsp; go get -u github.com/Azure/azure-storage-blob-go/azblob&nbsp; &nbsp; &nbsp; &nbsp; go get -u github.com/gruntwork-io/terratest/modules/terraform&nbsp; &nbsp; &nbsp; &nbsp; go get -u github.com/stretchr/testify/assert&nbsp; &nbsp; &nbsp; &nbsp; // executing the test&nbsp; &nbsp; &nbsp; &nbsp; go test&nbsp; &nbsp; &nbsp; env:&nbsp; &nbsp; &nbsp; &nbsp; SERVER_URL: "https://my-service-application-url"&nbsp; &nbsp; &nbsp; &nbsp; USER_EMAIL: ${{ secrets.USER_EMAIL }}&nbsp; &nbsp; &nbsp; &nbsp; USER_PASSWORD: ${{ secrets.USER_PASSWORD }}&nbsp; &nbsp; &nbsp; &nbsp; USER_JWT_ENCODE: ${{ secrets.USER_JWT_ENCODE }}&nbsp; &nbsp; &nbsp; &nbsp; # I am using these other ones to connect to azure.&nbsp; &nbsp; &nbsp; &nbsp; ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}&nbsp; &nbsp; &nbsp; &nbsp; ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}&nbsp; &nbsp; &nbsp; &nbsp; ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}&nbsp; &nbsp; &nbsp; &nbsp; ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}&nbsp; &nbsp; - name: Azure logout&nbsp; &nbsp; &nbsp; run: |&nbsp; &nbsp; &nbsp; &nbsp; az logout一个很好的参考，以了解一些如何处理HTTP包