Infisical Secrets Fetcher for Gitea Actions

This composite Gitea Action fetches secrets from a self-hosted Infisical instance and injects them into the Gitea Actions environment.

Features

• DNS Resolution Fix: Automatically resolves the Infisical domain using Cloudflare DNS (1.1.1.1) and updates /etc/hosts to prevent DNS timeouts on runners.
• Universal Auth: Supports Machine Identity authentication.
• Secure Injection: Injects secrets directly into $GITEA_ENV and masks values.

Usage

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Fetch Secrets
        uses: actions/infisical-secrets-fetcher@main
        with:
          client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
          client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
          project_id: ${{ secrets.INFISICAL_PROJECT_ID }}
          environment: 'prod'       # Optional, default: prod
          secret_path: '/MyHelper'  # Optional, default: /
          domain: 'https://infisical.lemarechal.eu' # Optional, default provided

Inputs

Input	Description	Required	Default
client_id	Machine Identity Client ID	Yes	-
client_secret	Machine Identity Client Secret	Yes	-
project_id	Infisical Project ID (Workspace ID)	Yes	-
environment	Environment slug (dev, staging, prod)	No	prod
secret_path	Path to secrets folder	No	/
domain	URL of the Infisical instance	No	https://infisical.lemarechal.eu

License

MIT