Add ability to provide RSA public encrypted secrets for actions_secret

[patrickmarabeas]

Throwing things at the wall to see what sticks. Trying to solve the problem of secrets management with as little overhead as possible. This should be viewed as a POC at present.

CC @jcudit @anGie44 #468

---

Provides the ability to supply a publicly RSA encrypted value and env
var of where to find the private pem string to the github_actions_secret
resource.

Values are decrypted and then encrypted once again by the resource. This
will result in no secrets being stored in plain text in either the
repository or state file.

Adds:

• encrypted_value parameter
• private_key_env parameter

One of either plaintext_value or encrypted_value is required.

---

Setup

openssl genrsa -f4 -out private.pem 2048

# The resulting string is placed in a env var (in this example it's PEM)

openssl rsa -in private.pem -outform PEM -pubout -out key.pub

# The resulting public key file is committed to the config repository for use

Use

Developers run the following command to encrypt a value

echo "my secret" | openssl rsautl -encrypt -inkey key.pub -pubin | base64

> prYKYFUcfMaCHxyJ9pcf6H7UJKMoPrITC9/AHxVJh0nXDrpyWGh . . .

Encrypted value used in encrypted_value parameter

resource "github_actions_secret" "example_secret" {
  repository       = "test"
  secret_name      = "TEST"
  encrypted_value  = "prYKYFUcfMaCHxyJ9pcf6H7UJKMoPrITC9/AHxVJh0nXDrpyWGh . . ."
  private_key_env  = "PEM"
}

Output

Terraform state created

{
  . . .
  "resources": [
    {
      "mode": "managed",
      "type": "github_actions_secret",
      "name": "example_secret",
      "provider": "provider.github",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "created_at": "default",
            "encrypted_value": "prYKYFUcfMaCHxyJ9pcf6H7UJKMoPrITC9/AHxVJh0nXDrpyWGh . . .",
            "id": "test:TEST",
            "plaintext_value": "",
            "private_key_env": "PEM",
            "repository": "test",
            "secret_name": "TEST",
            "updated_at": "default"
          },
          "private": ""
        }
      ]
    }
  ]
  . . .
}

A Github Workflow with the following config

on:
  push:
    branches: [master]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - run: |
          echo "my secret"
          echo "you can't see my secret"
        env:
          TEST: ${{ secrets.TEST }}

Produces

***
you can't see ***

[nickfloyd]

👋 Hey Friends, this issue has been automatically marked as stale because it has no recent activity. It will be closed if no further activity occurs. Please add the Status: Pinned label if you feel that this issue needs to remain open/active. Thank you for your contributions and help in keeping things tidy!

[github-actions]

👋 Hey Friends, this pull request has been automatically marked as stale because it has no recent activity. It will be closed if no further activity occurs. Please add the Status: Pinned label if you feel that this issue needs to remain open/active. Thank you for your contributions and help in keeping things tidy!