name: "enprot"
description: >-
Encrypt or decrypt WORD segments in files, using the enprot release
binary — for CI pipelines that publish mixed-confidentiality
documents (e.g. Metanorma sources with encrypted annexes).
inputs:
mode:
description: "decrypt or encrypt"
required: true
files:
description: "File(s) to process, space-separated"
required: true
word:
description: "WORD segment name"
required: true
password:
description: "WORD password (prefer a secret)"
required: false
cipher:
description: "Cipher for encrypt mode (default aes-256-gcm-det)"
required: false
default: "aes-256-gcm-det"
version:
description: "enprot release tag to download (default latest)"
required: false
default: ""
runs:
using: "composite"
steps:
- id: download
shell: bash
run: |
set -euxo pipefail
tag="${{ inputs.version }}"
if [ -z "$tag" ]; then
tag="$(curl -fsSL https://api.github.com/repos/engyon/enprot/releases/latest | jq -r .tag_name | sed 's/^enprot-//')"
fi
case "$(uname -m)-$(uname -s)" in
x86_64-Linux) asset="enprot-${tag#v}-x86_64-unknown-linux-musl.tar.gz" ;;
aarch64-Linux) asset="enprot-${tag#v}-aarch64-unknown-linux-musl.tar.gz" ;;
arm64-Darwin) asset="enprot-${tag#v}-aarch64-apple-darwin.tar.gz" ;;
x86_64-Darwin) asset="enprot-${tag#v}-x86_64-apple-darwin.tar.gz" ;;
*) echo "unsupported runner" >&2; exit 1 ;;
esac
curl -fsSL --retry 3 -o /tmp/enprot.tgz \
"https://github.com/engyon/enprot/releases/download/enprot-v${tag#v}/${asset}"
sudo tar -xzf /tmp/enprot.tgz -C /tmp
sudo find /tmp -maxdepth 2 -type f -name enprot -exec install -m755 {} /usr/local/bin/enprot \;
- shell: bash
run: |
set -euxo pipefail
pw_args=()
if [ -n "${{ inputs.password }}" ]; then
pw_args=(-k "${{ inputs.word }}=${{ inputs.password }}")
fi
case "${{ inputs.mode }}" in
decrypt) enprot decrypt -w "${{ inputs.word }}" "${pw_args[@]}" ${{ inputs.files }} ;;
encrypt) enprot encrypt -w "${{ inputs.word }}" "${pw_args[@]}" --cipher "${{ inputs.cipher }}" ${{ inputs.files }} ;;
*) echo "mode must be decrypt or encrypt" >&2; exit 1 ;;
esac