feat: support env_vars_file input

README.md

@@ -101,8 +101,30 @@ jobs:
     non-empty value is given, the field values will be overwritten (not
     merged). To remove all values, set the value to the literal string `{}`.
 
-    If both `env_vars` and `env_vars_file` are specified, the keys in
-    `env_vars` will take precedence over the keys in `env_vars_file`.
+    This is mutually-exclusive with `env_vars_file`.
+
+-   <a name="__input_env_vars_file"></a><a href="#user-content-__input_env_vars_file"><code>env_vars_file</code></a>: _(Optional)_ Path to a local file with definitions for all environment variables. This
+    is passed directly to the `--env-vars-file` flag of the underlying `gcloud
+    run deploy` command, which accepts either a YAML file or a `.env` file:
+
+    ```yaml
+    # YAML file
+    env_vars_file: '/path/to/env.yaml'
+
+    # .env file
+    env_vars_file: '/path/to/production.env'
+    ```
+
+    In a YAML file, each variable is a `KEY: VALUE` mapping. In a `.env` file,
+    each variable is a `KEY=VALUE` line.
+
+    Note that, consistent with `gcloud`, providing this file causes all
+    existing environment variables on the Cloud Run service to be removed
+    before the values from the file are applied (the file is authoritative).
+    For this reason, `env_vars_update_strategy` does not apply to
+    `env_vars_file`.
+
+    This is mutually-exclusive with `env_vars`.
 
 -   <a name="__input_env_vars_update_strategy"></a><a href="#user-content-__input_env_vars_update_strategy"><code>env_vars_update_strategy</code></a>: _(Required, default: `merge`)_ Controls how the environment variables are set on the Cloud Run service.
     If set to "merge", then the environment variables are _merged_ with any

action.yml

@@ -84,8 +84,33 @@ inputs:
       non-empty value is given, the field values will be overwritten (not
       merged). To remove all values, set the value to the literal string `{}`.
 
-      If both `env_vars` and `env_vars_file` are specified, the keys in
-      `env_vars` will take precedence over the keys in `env_vars_file`.
+      This is mutually-exclusive with `env_vars_file`.
+    required: false
+
+  env_vars_file:
+    description: |-
+      Path to a local file with definitions for all environment variables. This
+      is passed directly to the `--env-vars-file` flag of the underlying `gcloud
+      run deploy` command, which accepts either a YAML file or a `.env` file:
+
+      ```yaml
+      # YAML file
+      env_vars_file: '/path/to/env.yaml'
+
+      # .env file
+      env_vars_file: '/path/to/production.env'
+      ```
+
+      In a YAML file, each variable is a `KEY: VALUE` mapping. In a `.env` file,
+      each variable is a `KEY=VALUE` line.
+
+      Note that, consistent with `gcloud`, providing this file causes all
+      existing environment variables on the Cloud Run service to be removed
+      before the values from the file are applied (the file is authoritative).
+      For this reason, `env_vars_update_strategy` does not apply to
+      `env_vars_file`.
+
+      This is mutually-exclusive with `env_vars`.
     required: false
 
   env_vars_update_strategy:

src/main.ts

@@ -39,7 +39,6 @@ import {
   parseCSV,
   parseFlags,
   parseKVString,
-  parseKVStringAndFile,
   pinnedToHeadWarning,
   presence,
 } from '@google-github-actions/actions-utils';
@@ -103,6 +102,7 @@ export async function run(): Promise<void> {
     const gcloudVersion = await computeGcloudVersion(getInput('gcloud_version'));
     const gcloudComponent = presence(getInput('gcloud_component')); // Cloud SDK component version
     const envVars = getInput('env_vars'); // String of env vars KEY=VALUE,...
+    const envVarsFile = getInput('env_vars_file'); // Path to a file with env vars
     const envVarsUpdateStrategy = getInput('env_vars_update_strategy') || 'merge';
     const secrets = parseKVString(getInput('secrets')); // String of secrets KEY=VALUE,...
     const secretsUpdateStrategy = getInput('secrets_update_strategy') || 'merge';
@@ -135,6 +135,9 @@ export async function run(): Promise<void> {
     if (service && job) {
       throw new Error('Only one of `service` or `job` inputs can be set.');
     }
+    if (envVars && envVarsFile) {
+      throw new Error('Only one of `env_vars` or `env_vars_file` inputs can be set.');
+    }
 
     // Validate gcloud component input
     if (gcloudComponent && gcloudComponent !== 'alpha' && gcloudComponent !== 'beta') {
@@ -182,7 +185,7 @@ export async function run(): Promise<void> {
       }
 
       // Set optional flags from inputs
-      setEnvVarsFlags(deployCmd, envVars, envVarsUpdateStrategy);
+      setEnvVarsFlags(deployCmd, envVars, envVarsFile, envVarsUpdateStrategy);
       setSecretsFlags(deployCmd, secrets, secretsUpdateStrategy);
 
       if (wait) {
@@ -216,7 +219,7 @@ export async function run(): Promise<void> {
       }
 
       // Set optional flags from inputs
-      setEnvVarsFlags(deployCmd, envVars, envVarsUpdateStrategy);
+      setEnvVarsFlags(deployCmd, envVars, envVarsFile, envVarsUpdateStrategy);
       setSecretsFlags(deployCmd, secrets, secretsUpdateStrategy);
 
       if (tag) {
@@ -373,7 +376,12 @@ async function computeGcloudVersion(str: string): Promise<string> {
   return str;
 }
 
-function setEnvVarsFlags(cmd: string[], envVars: string, strategy: string) {
+function setEnvVarsFlags(cmd: string[], envVars: string, envVarsFile: string, strategy: string) {
+  if (envVarsFile) {
+    cmd.push('--env-vars-file', envVarsFile);
+    return;
+  }
+
   const compiledEnvVars = parseKVString(envVars);
   if (compiledEnvVars && Object.keys(compiledEnvVars).length > 0) {
     let flag = '';

tests/fixtures/env_vars.yaml

@@ -0,0 +1,2 @@
+FOO: bar
+ZIP: zap

tests/unit/main.test.ts

@@ -228,6 +228,33 @@ test('#run', { concurrency: true }, async (suite) => {
     assert.deepStrictEqual(envVars, { FOO: 'BAR' });
   });
 
+  await suite.test('sets envvars from a file', async (t) => {
+    const mocks = defaultMocks(t.mock, {
+      service: 'my-test-service',
+      env_vars_file: 'tests/fixtures/env_vars.yaml',
+    });
+
+    await run();
+
+    const args = mocks.getExecOutput.mock.calls?.at(0)?.arguments?.at(1);
+    assertMembers(args, ['--env-vars-file', 'tests/fixtures/env_vars.yaml']);
+  });
+
+  await suite.test('fails if env_vars and env_vars_file are both provided', async (t) => {
+    defaultMocks(t.mock, {
+      service: 'my-test-service',
+      env_vars: 'FOO=BAR',
+      env_vars_file: 'tests/fixtures/env_vars.yaml',
+    });
+
+    await assert.rejects(
+      async () => {
+        await run();
+      },
+      { message: /only one of .env_vars. or .env_vars_file. inputs can be set/ },
+    );
+  });
+
   await suite.test('merges secrets', async (t) => {
     const mocks = defaultMocks(t.mock, {
       service: 'my-test-service',