enprot 0.5.12

Engyon Protected Text (EPT) — confidentiality processor and capability ledger
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118

name: "Engyon enprot"
description: "Run enprot (Engyon Protected Text) against files in your workflow. Encrypt, decrypt, store, fetch, or verify EPT segments."
author: "Engyon"
branding:
  icon: "lock"
  color: "blue"

inputs:
  version:
    description: "enprot release version to install (e.g. '0.5.11'). Defaults to 'latest'."
    required: false
    default: "latest"
  operation:
    description: "enprot subcommand: encrypt | decrypt | store | fetch | encrypt-store | passthrough | verify"
    required: true
  files:
    description: "Space- or newline-separated list of files to process."
    required: true
  words:
    description: "Comma-separated WORD=password pairs (e.g. 'SECRET=hunter2,API=xyz'). Use ${{ secrets.* }} for passwords."
    required: false
    default: ""
  cipher:
    description: "Cipher for encrypt/encrypt-store (aes-256-siv | aes-256-gcm | aes-256-gcm-siv | aes-256-gcm-det | aes-256-gcm-siv-det)."
    required: false
    default: ""
  casdir:
    description: "CAS directory for store/fetch/encrypt-store operations."
    required: false
    default: ".cas"
  policy:
    description: "Crypto policy: 'default' or 'nist' (--fips)."
    required: false
    default: ""
  extra-args:
    description: "Additional CLI arguments appended verbatim to the enprot invocation."
    required: false
    default: ""

runs:
  using: "composite"
  steps:
    - name: Detect platform
      id: platform
      shell: bash
      run: |
        set -euo pipefail
        case "${{ runner.os }}" in
          Linux)  suffix="x86_64-unknown-linux-musl.tar.gz"
                  [ "$(uname -m)" = "aarch64" ] && suffix="aarch64-unknown-linux-musl.tar.gz" ;;
          macOS)  suffix="x86_64-apple-darwin.tar.gz"
                  [ "$(uname -m)" = "arm64" ] && suffix="aarch64-apple-darwin.tar.gz" ;;
          Windows) suffix="x86_64-pc-windows-msvc.zip" ;;
          *) echo "unsupported runner.os: ${{ runner.os }}" >&2; exit 1 ;;
        esac
        echo "suffix=$suffix" >> "$GITHUB_OUTPUT"

    - name: Resolve version
      id: ver
      shell: bash
      run: |
        set -euo pipefail
        v="${{ inputs.version }}"
        if [ "$v" = "latest" ]; then
          v="$(curl -fsSL -H 'Accept: application/vnd.github+json' \
                -H "Authorization: Bearer ${{ github.token }}" \
                https://api.github.com/repos/${{ github.action_repository || 'engyon/enprot' }}/releases/latest \
                | python3 -c 'import sys, json; print(json.load(sys.stdin)["tag_name"].lstrip("v"))')"
        fi
        echo "version=${v#v}" >> "$GITHUB_OUTPUT"

    - name: Download enprot
      shell: bash
      run: |
        set -euo pipefail
        ver="${{ steps.ver.outputs.version }}"
        suffix="${{ steps.platform.outputs.suffix }}"
        repo="${{ github.action_repository || 'engyon/enprot' }}"
        url="https://github.com/${repo}/releases/download/v${ver}/enprot-v${ver}-${suffix}"
        echo "Fetching $url"
        if [[ "$suffix" == *.zip ]]; then
          curl -fsSL "$url" -o enprot.zip
          unzip -o enprot.zip -d "$HOME/.enprot-bin"
        else
          curl -fsSL "$url" -o enprot.tar.gz
          mkdir -p "$HOME/.enprot-bin"
          tar -xzf enprot.tar.gz -C "$HOME/.enprot-bin"
        fi
        echo "$HOME/.enprot-bin" >> "$GITHUB_PATH"

    - name: Run enprot
      shell: bash
      env:
        ENPROT_OPERATION: ${{ inputs.operation }}
        ENPROT_FILES: ${{ inputs.files }}
        ENPROT_WORDS: ${{ inputs.words }}
        ENPROT_CIPHER: ${{ inputs.cipher }}
        ENPROT_CASDIR: ${{ inputs.casdir }}
        ENPROT_POLICY: ${{ inputs.policy }}
        ENPROT_EXTRA: ${{ inputs.extra-args }}
      run: |
        set -euo pipefail
        args=("$ENPROT_OPERATION")
        [ -n "$ENPROT_POLICY" ] && args+=("--policy" "$ENPROT_POLICY")
        [ -n "$ENPROT_CASDIR" ] && args+=("-c" "$ENPROT_CASDIR")
        if [ -n "$ENPROT_WORDS" ]; then
          IFS=',' read -ra pairs <<< "$ENPROT_WORDS"
          for pair in "${pairs[@]}"; do
            args+=("-w" "$pair")
          done
        fi
        [ -n "$ENPROT_CIPHER" ] && args+=("--cipher" "$ENPROT_CIPHER")
        # shellcheck disable=SC2206
        files=($ENPROT_FILES)
        args+=("${files[@]}")
        [ -n "$ENPROT_EXTRA" ] && args+=($ENPROT_EXTRA)
        echo "+ enprot ${args[*]}"
        enprot "${args[@]}"