GitHub Actions Environment SecretsをOpenSSL暗号化で安全継承する回避策

# 32文字のランダムな文字列を生成
openssl rand -base64 32

# 実行例（毎回異なる値が生成されます）
# 出力例: K9mX7vQ2pL8nR5wE3tY9oU6iA1sD4fG7hJ0kM2nB5vC8

name: ci-encryption

on:
  workflow_dispatch:
    inputs:
      deployment_target:
        description: "Deployment target"
        required: true
        default: "production"
        type: environment

jobs:
  get-secrets:
    runs-on: ubuntu-22.04
    environment: ${{ inputs.deployment_target }}
    outputs:
      api_key: ${{ steps.get-secret.outputs.api_key }}
    steps:
      - name: Get environment secret
        id: get-secret
        run: |
          # Environment SecretsをOpenSSLで暗号化してBase64エンコード
          ENCRYPTED_KEY=$(echo -n "${{ secrets.API_KEY }}" | openssl enc -aes-256-cbc -pbkdf2 -salt -k "${{ secrets.ENCRYPTION_PASSWORD }}" | base64 -w 0)
          echo "api_key=$ENCRYPTED_KEY" >> $GITHUB_OUTPUT

  call-deploy:
    needs: [get-secrets]
    uses: ./.github/workflows/cd-encryption.yml
    with:
      api_key: ${{ needs.get-secrets.outputs.api_key }}
    secrets:
      ENCRYPTION_PASSWORD: ${{ secrets.ENCRYPTION_PASSWORD }}

name: cd-encryption

on:
  workflow_call:
    inputs:
      api_key:
        required: true
        type: string
    secrets:
      ENCRYPTION_PASSWORD:
        required: true

jobs:
  deploy-job:
    runs-on: ubuntu-22.04
    name: Deploy with decrypted secrets
    steps:
      - name: Deploy with decrypted API key
        run: |
          echo "🔍 暗号化されたシークレットを復号化中..."

          if [ -z "${{ inputs.api_key }}" ]; then
            echo "::error title=Missing API Key::暗号化されたapi_keyが必要です"
            exit 1
          fi

          # Base64デコード → OpenSSL復号化
          DECRYPTED_KEY=$(echo "${{ inputs.api_key }}" | base64 -d | openssl enc -aes-256-cbc -pbkdf2 -d -salt -k "${{ secrets.ENCRYPTION_PASSWORD }}")
          echo "::add-mask::$DECRYPTED_KEY"

          echo "✅ Environment Secretsの復号化に成功しました"
          # ここで実際のデプロイ処理を実行
          # curl -H "Authorization: Bearer $DECRYPTED_KEY" ...

# 暗号化時のコマンド詳細
echo -n "$SECRET_VALUE" | openssl enc -aes-256-cbc -pbkdf2 -salt -k "$ENCRYPTION_PASSWORD" | base64 -w 0

# 復号化時のコマンド詳細
echo "$ENCRYPTED_VALUE" | base64 -d | openssl enc -aes-256-cbc -pbkdf2 -d -salt -k "$ENCRYPTION_PASSWORD"