feat: add optional secret-name input to fetch a single secret

[claude]

Requested by Daniel · Slack thread

Before

The action could only fetch every secret in a path. Getting one secret meant pulling the whole folder and picking it out of the exported env vars.

After

An optional secret-name input fetches just that one secret.

- uses: Infisical/secrets-action@v1
  with:
    client-id: ${{ secrets.MACHINE_IDENTITY_CLIENT_ID }}
    client-secret: ${{ secrets.MACHINE_IDENTITY_CLIENT_SECRET }}
    project-slug: my-project
    env-slug: dev
    secret-path: "/my-path"
    secret-name: "DATABASE_URL"

How

When secret-name is set, getRawSecret() calls GET /api/v3/secrets/raw/{secretName} and normalizes the response into the same key/value map getRawSecrets() returns, so every downstream export path (export-type, file-output-path, masking) is unchanged. When it is unset, behavior is identical to before. recursive is meaningless for a single secret, so it emits a core.warning and is ignored. A 404 fails the step with the secret name, path and environment in the message instead of silently exporting nothing. dist/index.cjs is regenerated.

Two notes for reviewers:

• This uses v3 to stay consistent with every other call in the action. The public docs now document GET /api/v4/secrets/{secretName}; moving to v4 would be a separate change across the whole client.
• The endpoint also supports type (shared vs personal) and version; these are not exposed as inputs, to keep the diff minimal.

Testing

npx tsc --noEmit and npm run build are clean and dist/ was regenerated. The repo has no test infrastructure, so this was verified against a mock Infisical server covering: secret-name unset (unchanged list call), secret-name set (single-secret call, value masked), secret-name + recursive (warning, single-secret call), and a 404 (exit 1 with a descriptive error).

---

Generated by Claude Code

[greptile-apps]

Greptile Summary

Adds an optional secret-name action input that fetches and exports one secret through the existing Infisical v3 API flow.

• Routes configured single-secret requests through getRawSecret while preserving the existing bulk-fetch behavior.
• Normalizes the single-secret response into the existing export map shape.
• Warns when recursive is combined with single-secret mode and improves missing-secret errors.
• Documents the new input and regenerates the distributed action bundle.

Confidence Score: 5/5

The PR appears safe to merge with no concrete changed-code failure or SSRF path identified.

The new branch uses an encoded path segment, retains the established project and environment scoping parameters, and returns the same key/value shape consumed by the existing export paths.

Important Files Changed

Filename	Overview
src/infisical.ts	Adds the encoded v3 single-secret request, response normalization, and contextual 404 handling without establishing a concrete contract or security defect.
src/index.ts	Selects single- versus bulk-secret fetching from the optional input and warns when recursion is inapplicable.
action.yaml	Declares the optional secret-name action input consistently with its runtime handling.
README.md	Documents single-secret usage, export behavior, recursion semantics, and missing-secret failure behavior.
dist/index.cjs	Regenerates the executable action bundle with the source implementation.
dist/index.cjs.map	Regenerates the source map alongside the distributed bundle.

_{Reviews (1): Last reviewed commit: "Add optional secret-name input to fetch ..." | Re-trigger Greptile}