Importing Secrets

#!/bin/bash

# Check if jq is installed
if ! command -v jq &> /dev/null; then
    echo "jq could not be found, please install jq to process JSON data."
    exit 1
fi

# Check if aws is installed
if ! command -v aws &> /dev/null; then
    echo "aws could not be found, please install the aws CLI."
    exit 1
fi

# Check if doppler is installed
if ! command -v doppler &> /dev/null; then
    echo "doppler could not be found, please install the doppler CLI."
    exit 1
fi

# Configuration Variables
STRIP_SECRET_PATH="false" # strip path from secret name (e.g., changes 'some/path/secret-name' to 'secret-name')
DOPPLER_PROJECT_NAME="your-doppler-project-name"
DOPPLER_CONFIG_NAME="your-doppler-config-name"
AWS_SECRET_ARN="your-aws-secret-arn"

# Get the name of the secret from its metadata
secret_name=$(aws secretsmanager describe-secret --secret-id "$AWS_SECRET_ARN" --query 'Name' --output text)

# Strip the path from the secret name
if [ "$STRIP_SECRET_PATH" = "true" ]; then
    secret_name=$(echo "$secret_name" | awk -F/ '{print $NF}')
fi

# Convert secret name to uppercase and replace disallowed characters with underscores
NORMALIZED_SECRET_NAME=$(echo "$secret_name" | tr '[:lower:]' '[:upper:]' | sed 's/[^A-Z0-9]/_/g')

# Fetch the secret value from AWS Secrets Manager
secret_value=$(aws secretsmanager get-secret-value --secret-id "$AWS_SECRET_ARN" --query 'SecretString' --output text)

SECRETS_JSON=""
# Determine if the secret value is valid JSON
if echo "$secret_value" | jq -e . &> /dev/null; then
    # It's JSON, process all keys to uppercase and save
    SECRETS_JSON=$(echo "$secret_value" | jq 'with_entries(.key |= ascii_upcase)')
else
    # It's plaintext, use the formatted secret name
    SECRETS_JSON="{ \"$NORMALIZED_SECRET_NAME\": \"$secret_value\" }"
fi

# Check if the transformation was successful
if ! ( echo "$SECRETS_JSON" | jq -e . &> /dev/null ); then
    echo "Failed to process JSON data."
    exit 1
fi

# Upload the JSON file to Doppler
doppler secrets upload --project $DOPPLER_PROJECT_NAME --config $DOPPLER_CONFIG_NAME <(echo "$SECRETS_JSON")

name: Export Secrets to Doppler

on: workflow_dispatch

jobs:
  export-to-doppler:
    runs-on: ubuntu-latest
    name: export GitHub secrets to Doppler
    steps:
    - name: Install Doppler CLI
      uses: dopplerhq/cli-action@v3
    - name: Upload Secrets to Doppler
      run: doppler secrets upload --project "$DOPPLER_TARGET_PROJECT" --config "$DOPPLER_TARGET_CONFIG"  --silent <(echo "$GITHUB_SECRETS" | jq 'del(.github_token, .DOPPLER_TOKEN, .DOPPLER_TARGET_PROJECT, .DOPPLER_TARGET_CONFIG) | with_entries( .key |= ascii_upcase )')
      shell: bash
      env:
        DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }}
        DOPPLER_TARGET_PROJECT: ${{ secrets.DOPPLER_TARGET_PROJECT }}
        DOPPLER_TARGET_CONFIG: ${{ secrets.DOPPLER_TARGET_CONFIG }}
        GITHUB_SECRETS: ${{ toJson(secrets) }}

#!/usr/bin/env bash

# Check if jq is installed
if ! command -v jq &> /dev/null; then
    echo "jq could not be found, please install jq to process JSON data."
    exit 1
fi

# Check if vault is installed
if ! command -v vault &> /dev/null; then
    echo "vault could not be found, please install the Vault CLI."
    exit 1
fi

# Check if doppler is installed
if ! command -v doppler &> /dev/null; then
    echo "doppler could not be found, please install the Doppler CLI."
    exit 1
fi

# This is the path used to list all apps/services that are going to be imported.
# The names at this path are used to create Doppler projects. It's then
# expected that the next element name in the path will map to specific Doppler
# environments in the Doppler project and contain the secret KVs you want in that
# environment.
#
# For example, assume you set this to "kv/devops/" and when you list that you
# the next level of the path contains "backend", "frontend", and "worker" (so
# "kv/devops/backend/", "kv/devops/frontend/", and "kv/devops/worker/"). This
# script would ensure that a Doppler project exists called "backend", "frontend"
# and "worker". Now, the next path level would map to environments like "prd",
# "stg", "qa", and "dev" (so "kv/devops/backend/prd", "kv/devops/backend/stg", etc).
BASE_PATH="kv/devops/"

for service in $(vault kv list --format=json $BASE_PATH | jq -r '.[] | gsub("/$"; "")')
do
  echo "Importing secrets for $service"
  echo "==============================================="
  if ! doppler projects get "$service" > /dev/null 2>&1; then
    echo "Creating $service project..."
    doppler projects create --silent $service
  fi

  for environment in $(vault kv list --format=json "$BASE_PATH/$service" | jq -r '.[] | gsub("/$"; "")')
  do
    if ! doppler environments get --project "$service" "$environment" > /dev/null 2>&1; then
      echo "Creating ${service}.${environment} environment..."
      doppler environments create --project "$service" --silent "$environment" "$environment"
    fi
    echo "Uploading secrets for ${service}.${environment} environment..."
    # Note that secret keys that are imported (i.e., secret names) must be in
    # UPPER_SNAKE_CASE. The jq command below will convert secret names to that
    # format. So, if you had a KV entry where the key was "mysql-db-user", that
    # would be imported as "MYSQL_DB_USER". Secret names also cannot begin with
    # a number, so "9-test-secret" would be imported as "__TEST_SECRET".
    doppler secrets upload --silent --project "$service" --config "$environment" <(vault kv get -format=json "$BASE_PATH/$service/$environment" | jq '.data.data | to_entries | map( {key:.key|gsub("(^[0-9]{1}|[^0-9A-Za-z_])";"_")|ascii_upcase, value:.value} ) | from_entries')
  done

  echo
done