Allow to get secrets from file (#5509)

cli/exec/exec.go

@@ -25,6 +25,7 @@ import (
 	"runtime"
 	"strings"
 
+	"codeberg.org/6543/xyaml"
 	"github.com/drone/envsubst"
 	"github.com/oklog/ulid/v2"
 	"github.com/rs/zerolog/log"
@@ -169,6 +170,25 @@ func execWithAxis(ctx context.Context, c *cli.Command, file, repoPath string, ax
 			Value: val,
 		})
 	}
+	if secretsFile := c.String("secrets-file"); secretsFile != "" {
+		fileContent, err := os.ReadFile(secretsFile)
+		if err != nil {
+			return err
+		}
+
+		var m map[string]string
+		err = xyaml.Unmarshal(fileContent, &m)
+		if err != nil {
+			return err
+		}
+
+		for key, val := range m {
+			secrets = append(secrets, compiler.Secret{
+				Name:  key,
+				Value: val,
+			})
+		}
+	}
 
 	pipelineEnv := make(map[string]string)
 	for _, env := range c.StringSlice("env") {

cli/exec/flags.go

@@ -78,6 +78,11 @@ var flags = []cli.Flag{
 		Name:    "secrets",
 		Usage:   "map of secrets, ex. 'secret=\"val\",secret2=\"value2\"'",
 	},
+	&cli.StringFlag{
+		Sources: cli.EnvVars("WOODPECKER_SECRETS_FILE"),
+		Name:    "secrets",
+		Usage:   "path to yaml file with secrets map",
+	},
 
 	//
 	// backend options for pipeline compiler