From 488658f8655c2c8d13fcd8746ba21ff9bbe98081 Mon Sep 17 00:00:00 2001
From: Andrei Jiroh Halili <ajhalili2006@andreijiroh.xyz>
Date: Tue, 8 Jul 2025 15:12:35 +0000
Subject: [PATCH] feat: add decryption failure count and warn if decryption
 fails

also some localdev debugging improvements btw
---
 index.js | 51 +++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 47 insertions(+), 4 deletions(-)

diff --git a/index.js b/index.js
index 3d71181..c8e73c3 100644
--- a/index.js
+++ b/index.js
@@ -1,17 +1,41 @@
 const core = require('@actions/core')
 
+function getBoolInputEnv() {
+    const bool = process.env["INPUT_INJECT_ENV_VARS"]
+    const trueValue = ['true', 'True', 'TRUE']
+    const falseValue = ['false', 'False', 'FALSE']
+
+    if (process.env.INPUT_INJECT_ENV_VARS === undefined) {
+        try {
+            return core.getBooleanInput("inject-env-vars", {required: false})
+        } catch(err) {
+            core.warning(err)
+            return false
+        }
+    }
+
+    if (trueValue.includes(bool)) return true
+    if (falseValue.includes(bool)) return false
+}
+
 const opts = {
     path: process.env["INPUT_PATH"] || core.getInput("path", { required: true }),
     key: process.env["INPUT_KEY"] || core.getInput("key", { required: true }),
-    injectVars: Boolean(process.env["INPUT_INJECT_ENV_VARS"]) || core.getBooleanInput("inject-env-vars", {required: false})
+    injectVars: getBoolInputEnv()
 }
 
+core.group("options debug", () => {
+    core.debug(JSON.stringify(opts, null, 2))
+})
+
 /* Placeholder object for parsed secrets after decryption */
 const secretsTmp = {}
 const dotenvPlain = {}
+let failCount = 0
 
 // Load up encryption key for CI secrets first
 if (opts.key) {
+    core.debug("loading dotenvx private key as env var")
     process.env["DOTENV_PRIVATE_KEY_CI"] = opts.key
     process.env["DOTENV_PRIVATE_KEY"] = opts.key
 }
@@ -33,7 +57,9 @@ Object.keys(secretsTmp).forEach(key => {
 
     // warn user on failed-to-encrypt secrets
     if (value.startsWith("encrypted:")) {
-        core.warning(`decryption failed for key ${key}, check your inputs/secrets`)
+        core.warning(`decryption failed for key ${key}, check your inputs/secrets if key is correct`);
+        failCount++
+        core.debug(`fail count now at ${failCount}`)
     }
 
     // Automatically mask decrypted secrets when prefixed with "encrypted:" using plain old dotenv pakcage
@@ -51,20 +77,37 @@ Object.keys(secretsTmp).forEach(key => {
 core.group("Parsed data (w/o decryption)", () => {
     core.info(JSON.stringify(dotenvPlain, null, 2))
 })
+
 core.group("dotenv-keys meta configs", () => {
     core.info(JSON.stringify({
         loaded: true,
         loader: "github-actions",
-        last_loaded_dir: process.cwd()
+        last_loaded_dir: process.cwd(),
+        decryption_failure: failCount > 0 || false,
+        decryption_fail_count: failCount
     }, null, 2))
 })
 
 core.setOutput("DOTENV_KEYS_LOADER", "github-actions")
 core.setOutput("DOTENV_KEYS_LOADED", "true")
 core.setOutput("LAST_DOTENV_DIR", process.cwd())
+if (failCount > 0) {
+    core.setOutput("DOTENV_DECRYPTION_FAILURE", "true")
+    core.setOutput("DOTENV_DECRYPTION_FAIL_COUNT", failCount)
+} else {
+    core.setOutput("DOTENV_DECRYPTION_FAILURE", "false")
+    core.setOutput("DOTENV_DECRYPTION_FAIL_COUNT", "0")
+}
 
 if (opts.injectVars === true) {
     core.exportVariable("DOTENV_KEYS_LOADER", "github-actions")
     core.exportVariable("DOTENV_KEYS_LOADED", "true")
     core.exportVariable("LAST_DOTENV_DIR", process.cwd())
-}
\ No newline at end of file
+    if (failCount > 0) {
+        core.exportVariable("DOTENV_DECRYPTION_FAILURE", "true")
+        core.exportVariable("DOTENV_DECRYPTION_FAIL_COUNT", failCount)
+    } else {
+        core.exportVariable("DOTENV_DECRYPTION_FAILURE", "false")
+        core.exportVariable("DOTENV_DECRYPTION_FAIL_COUNT", "0")
+    }
+}
-- 
2.51.2