How to use Bitwarden adapter for secrets in Github Action for continuous deploy

[dmarczal]

I setup the secrets like this:

SECRETS=$(kamal secrets fetch --adapter bitwarden --account [email protected] --from ITEM REGISTRY_PASSWORD RAILS_MASTER_KEY REGISTRY_USERNAME)

RAILS_MASTER_KEY=$(kamal secrets extract RAILS_MASTER_KEY $SECRETS)

KAMAL_REGISTRY_USERNAME=$(kamal secrets extract REGISTRY_USERNAME $SECRETS)
KAMAL_REGISTRY_PASSWORD=$(kamal secrets extract REGISTRY_PASSWORD $SECRETS)

But how can I pass the password of Bitwarden to run this in Github Actions?

My CD setup is:

name: Deploy

on:
  push:
    branches:
      - production
jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      DOCKER_BUILDKIT: 1
      RAILS_ENV: production
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.3.4
          bundler-cache: true
      - run: gem install kamal

      - name: Set up SSH
        env:
          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
        run: |
          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
          ssh-keyscan ${{ vars.REMOTE_HOST }} >> ~/.ssh/known_hosts || echo "failed"
          chmod 600 ~/.ssh/id_ed25519
          chmod 644 ~/.ssh/known_hosts

      - uses: docker/setup-buildx-action@v3

      - name: Install BW CLI
        run: |
          sudo snap install bw

      - name: Deploy
        run: |
          bw login ${{ vars.BW_USER }} ${{ secrets.BW_PASSWORD }}
          kamal lock release
          kamal deploy

How can I pass Master password to the kamal?

[tuladhar]

Instead of using email and master password, it is recommended to use API key for automated workflows, see here.