Error when using secrets, ^,^ being added

[vaisov-gemba]

TL;DR

When using multiple secrets in the secrets input for google-github-actions/deploy-cloudrun, additional ^,^ characters appear unexpectedly, preventing successful deployment.

Expected behavior

I expected the gcloud run deploy command to execute without unexpected characters and to deploy successfully, with each secret correctly assigned to its respective environment variable or volume path.

Observed behavior

The gcloud run deploy command failed to run correctly. Unexpected ^,^ characters were added in front of the first secret and between secrets, resulting in a failed deployment.

Action YAML

name: Deploy ExampleApp to Cloud Run

on:
  workflow_dispatch:
  push:
    branches:
      - development-pipeline

jobs:
  build:
    permissions:
      contents: 'read'
      id-token: 'write'

    runs-on: ubuntu-latest
    environment: ${{ github.ref == 'refs/heads/development' && 'development' || github.ref == 'refs/heads/testing' && 'testing' || github.ref == 'refs/heads/staging' && 'staging' || github.ref == 'refs/heads/main' && 'production' }}
        
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      
      - name: Authenticate to GCP
        uses: google-github-actions/auth@v2
        with:
          project_id: 'example-project-id'
          workload_identity_provider: 'projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/example-pool/providers/github'

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@v2
        with:
          project_id: 'example-project-id'

      - name: Configure Docker for Google Artifact Registry 
        run: gcloud auth configure-docker region-docker.pkg.dev

      - name: Build and Push Container
        run: |
          docker build -t "region-docker.pkg.dev/example-project-id/api-services/example-app:${{ github.run_id }}" -f Dockerfile_exampleapp .
          docker push "region-docker.pkg.dev/example-project-id/api-services/example-app:${{ github.run_id }}"

      - id: 'deploy'
        uses: 'google-github-actions/deploy-cloudrun@v2'
        with:          
          service: 'example-app'
          region: 'example-region'
          image: 'region-docker.pkg.dev/example-project-id/api-services/example-app:${{ github.run_id }}'
          secrets: |-
            EXAMPLE_SECRET_ONE=example_secret_one:latest
            EXAMPLE_SECRET_TWO=example_secret_two:latest
            EXAMPLE_SECRET_THREE=example_secret_three:latest
            EXAMPLE_SECRET_FOUR=example_secret_four:latest
            /path/to/certificates/example-cert-path=example_cert_secret:latest
            /path/to/creds/example-cred-path=example_cred_secret:latest
          flags: '--ingress=internal --min-instances=1 --max-instances=1 --service-account=example-sa@example-project-id.iam.gserviceaccount.com --vpc-connector=example-connector --vpc-egress=private-ranges-only'

      - name: 'Use output'
        run: 'curl "${{ steps.deploy.outputs.url }}"'

Log output

Run google-github-actions/deploy-cloudrun@v2
  
Successfully authenticated
Running: gcloud run deploy example-app --image example-region-docker.pkg.dev/example-project-id/api-services/example-app:1234567890 --update-secrets ^,^EXAMPLE_SECRET_ONE=dev_example_secret_one:latest EXAMPLE_SECRET_TWO=dev_example_secret_two:latest EXAMPLE_SECRET_THREE=dev_example_secret_three:latest EXAMPLE_SECRET_FOUR=dev_example_secret_four:latest /path/to/certificates/example-cert-path=dev_example_cert:latest /path/to/creds/example-cred-path=dev_example_cred:latest --update-labels ^,^managed-by=github-actions,commit-sha=abcdef1234567890 --format json --region example-region --ingress internal --min-instances 1 --max-instances 1 --service-account [email protected] --vpc-connector example-connector --vpc-egress private-ranges-only
Error: google-github-actions/deploy-cloudrun failed with: failed to execute gcloud command `gcloud run deploy example-app --image example-region-docker.pkg.dev/example-project-id/api-services/example-app:1234567890 --update-secrets ^,^EXAMPLE_SECRET_ONE=dev_example_secret_one:latest EXAMPLE_SECRET_TWO=dev_example_secret_two:latest EXAMPLE_SECRET_THREE=dev_example_secret_three:latest EXAMPLE_SECRET_FOUR=dev_example_secret_four:latest /path/to/certificates/example-cert-path=dev_example_cert:latest /path/to/creds/example-cred-path=dev_example_cred:latest --update-labels ^,^managed-by=github-actions,commit-sha=abcdef1234567890 --format json --region example-region --ingress internal --min-instances 1 --max-instances 1 --service-account [email protected] --vpc-connector example-connector --vpc-egress private-ranges-only

Additional information

Same happens also if I provide secrets in one line (space separated)