GitHub Action多作业间共享Vault密钥方案咨询

问题分析 #

你之前尝试用作业输出传递密钥失败，主要原因大概率是：

• Vault Action未将密钥注入到你引用的env.ARTIFACTORY_USERNAME环境变量中，多数Vault Action会把密钥输出到steps.<id>.outputs而非系统环境变量
• 即使配置正确，作业输出传递敏感密钥存在泄露风险（GitHub会屏蔽但仍有日志暴露可能）

可行方案 #

方案一：修正作业输出传递（适合非极端敏感场景） #

先确认你的Vault Action支持将密钥输出到steps对象，调整vault作业如下：

vault:
  name: Retrieve Vault Secrets
  runs-on: ubuntu-latest
  outputs:
    ARTIFACTORY_USERNAME: ${{ steps.vault.outputs.ARTIFACTORY_USERNAME }}
    ARTIFACTORY_PASSWORD: ${{ steps.vault.outputs.ARTIFACTORY_PASSWORD }}
  steps:
    - name: Retrieve Vault Secrets
      uses: /workflows/actions/vault@v1
      id: vault
      with:
        # 补充Vault配置，明确映射密钥到outputs
        secrets: |
          secret/data/artifactory username | ARTIFACTORY_USERNAME;
          secret/data/artifactory password | ARTIFACTORY_PASSWORD;
        # 其他必要配置（如Vault地址、身份凭证等）

在依赖作业中引用输出并注入环境变量：

build:
  name: Build
  runs-on: ${{ inputs.runner_environment }}
  needs: vault
  steps:
    - name: Inject Vault secrets to environment
      run: |
        echo "ARTIFACTORY_USERNAME=${{ needs.vault.outputs.ARTIFACTORY_USERNAME }}" >> $GITHUB_ENV
        echo "ARTIFACTORY_PASSWORD=${{ needs.vault.outputs.ARTIFACTORY_PASSWORD }}" >> $GITHUB_ENV
    # 后续步骤可直接使用$ARTIFACTORY_USERNAME等环境变量

方案二：加密Artifact传递密钥（安全优先场景） #

通过加密文件上传为Artifact，避免明文传递风险：

1. 配置vault作业生成加密密钥文件并上传：

vault:
  name: Retrieve Vault Secrets
  runs-on: ubuntu-latest
  steps:
    - name: Retrieve Vault Secrets
      uses: /workflows/actions/vault@v1
      id: vault
      with:
        secrets: |
          secret/data/artifactory username | ARTIFACTORY_USERNAME;
          secret/data/artifactory password | ARTIFACTORY_PASSWORD;
    - name: Write & encrypt secrets
      run: |
        # 将密钥写入临时文件
        echo "ARTIFACTORY_USERNAME=${ARTIFACTORY_USERNAME}" > .env.secrets
        echo "ARTIFACTORY_PASSWORD=${ARTIFACTORY_PASSWORD}" >> .env.secrets
        # 用GPG加密（需提前在仓库机密中存储GPG_PASSPHRASE）
        gpg --batch --yes --passphrase "${{ secrets.GPG_PASSPHRASE }}" -c .env.secrets
    - name: Upload encrypted artifact
      uses: actions/upload-artifact@v4
      with:
        name: encrypted-secrets
        path: .env.secrets.gpg
        retention-days: 1 # 限制保留时间降低风险

2. 在依赖作业中下载并解密：

build:
  name: Build
  runs-on: ${{ inputs.runner_environment }}
  needs: vault
  steps:
    - name: Download encrypted secrets
      uses: actions/download-artifact@v4
      with:
        name: encrypted-secrets
    - name: Decrypt & inject secrets
      run: |
        gpg --batch --yes --passphrase "${{ secrets.GPG_PASSPHRASE }}" -d .env.secrets.gpg > .env.secrets
        # 注入到环境变量
        source .env.secrets
        echo "ARTIFACTORY_USERNAME=${ARTIFACTORY_USERNAME}" >> $GITHUB_ENV
        echo "ARTIFACTORY_PASSWORD=${ARTIFACTORY_PASSWORD}" >> $GITHUB_ENV

方案三：复用Workflow片段（减少重复代码） #

把Vault密钥获取逻辑抽成可复用的Workflow，避免每个作业重复配置：

1. 创建.github/workflows/vault-secrets.yml：

name: Vault Secrets
on:
  workflow_call:
    outputs:
      ARTIFACTORY_USERNAME:
        value: ${{ jobs.get-secrets.outputs.ARTIFACTORY_USERNAME }}
      ARTIFACTORY_PASSWORD:
        value: ${{ jobs.get-secrets.outputs.ARTIFACTORY_PASSWORD }}
jobs:
  get-secrets:
    runs-on: ubuntu-latest
    outputs:
      ARTIFACTORY_USERNAME: ${{ steps.vault.outputs.ARTIFACTORY_USERNAME }}
      ARTIFACTORY_PASSWORD: ${{ steps.vault.outputs.ARTIFACTORY_PASSWORD }}
    steps:
      - name: Retrieve Vault Secrets
        uses: /workflows/actions/vault@v1
        id: vault
        with:
          # 统一配置Vault地址、身份凭证、密钥映射
          vault-url: ${{ secrets.VAULT_URL }}
          role-id: ${{ secrets.VAULT_ROLE_ID }}
          secret-id: ${{ secrets.VAULT_SECRET_ID }}
          secrets: |
            secret/data/artifactory username | ARTIFACTORY_USERNAME;
            secret/data/artifactory password | ARTIFACTORY_PASSWORD;

2. 在主Workflow中调用：

build:
  name: Build
  runs-on: ${{ inputs.runner_environment }}
  needs: get-vault-secrets
  steps:
    - name: Inject secrets to environment
      run: |
        echo "ARTIFACTORY_USERNAME=${{ needs.get-vault-secrets.outputs.ARTIFACTORY_USERNAME }}" >> $GITHUB_ENV
        echo "ARTIFACTORY_PASSWORD=${{ needs.get-vault-secrets.outputs.ARTIFACTORY_PASSWORD }}" >> $GITHUB_ENV

docker_image:
  name: Build & Push Docker image
  runs-on: ${{ inputs.runner_environment }}
  needs: [build, get-vault-secrets]
  steps:
    - name: Inject secrets to environment
      run: |
        echo "ARTIFACTORY_USERNAME=${{ needs.get-vault-secrets.outputs.ARTIFACTORY_USERNAME }}" >> $GITHUB_ENV
        echo "ARTIFACTORY_PASSWORD=${{ needs.get-vault-secrets.outputs.ARTIFACTORY_PASSWORD }}" >> $GITHUB_ENV

# 调用复用的Workflow
get-vault-secrets:
  uses: ./.github/workflows/vault-secrets.yml

内容的提问来源于stack exchange，提问作者osumatu