SRE-904: Extract the secret handoff into shared actions

[claude]

Requested by Tim Diekmann · Slack thread

SRE-904

Before

The encrypted job-boundary handoff from #99 lives as inline openssl steps in housekeeping-dependencies.yml, and any other workflow wanting the same pattern (hashintel/hash#9192) has to carry its own copy — two implementations of the same security-sensitive shell to keep in sync.

After

Two generic composite actions own the mechanics, and workflows state only intent:

• .github/actions/encrypt-secret — value + encryption_key in, base64 encrypted_value out (openssl enc -aes-256-cbc -pbkdf2 -salt), guarded with fail-loud : "${VAR:?}" so a missing secret stops the run before anything is handed over.
• .github/actions/decrypt-secret — encrypted_value + encryption_key in, value out; every plaintext line is ::add-mask::ed before the value is written to GITHUB_OUTPUT, and multi-line values are supported via a heredoc with a random delimiter.

housekeeping-dependencies.yml now uses them via the repo's $/ convention in place of its inline steps — same secret (RENOVATE_TOKEN_ENC_KEY), same job outputs, same masking-before-anything-else ordering, so behavior is unchanged. The encrypt/decrypt round-trip (single- and multi-line values, wrong-key and empty-input failure paths) was verified with dummy values.

hashintel/hash#9192 will consume these by pinned SHA once merged, instead of carrying local copies.

Note for #9192 re-pointing: these actions were authored here against the agreed interface (value/encrypted_value/encryption_key); when re-pointing #9192, verify its call sites match these input/output names exactly.

[cursor]

PR Summary

Medium Risk
Touches CI secret handling and token handoff between jobs; behavior should be equivalent but decrypt output naming and multi-line masking differ slightly from the removed inline steps.

Overview
Moves the AES-256-CBC + PBKDF2 job-boundary secret handoff out of inline shell in housekeeping-dependencies.yml into reusable composite actions encrypt-secret and decrypt-secret, so other workflows can share one implementation instead of duplicating security-sensitive openssl steps.

The Renovate workflow now calls those actions for mint/decrypt and wires RENOVATE_TOKEN from steps.app-token.outputs.value. PR path filters include the new action directories. decrypt-secret masks each line of multi-line plaintext before writing output and uses a random heredoc delimiter for safe multi-line GITHUB_OUTPUT—a small hardening vs the previous single-line ::add-mask::.

^{Reviewed by Cursor Bugbot for commit 98535f8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 98535f8. Configure here.}

[cursor]

Decrypt strips trailing newlines

Medium Severity

Capturing openssl decrypt output in $() drops all trailing newlines before masking and writing value. The action advertises multi-line support, so secrets that require a final newline (for example PEM or SSH keys) will not round-trip faithfully for callers such as hash#9192.

 

^{Reviewed by Cursor Bugbot for commit 98535f8. Configure here.}