Use shell parsing for LOWER bundled secret

.forgejo/workflows/deploy-cfn.yml

@@ -69,51 +69,39 @@ jobs:
                 exit 0
             fi
 
-            python3 - <<'PY'
-              import json
-              import os
+              # Expected LOWER format is multiline KEY=VALUE entries.
+              # Example:
+              # AWS_ACCESS_KEY_ID=...
+              # AWS_SECRET_ACCESS_KEY=...
+              # AWS_SESSION_TOKEN=...   (optional)
+              # AWS_DEFAULT_REGION=us-east-1
+              while IFS= read -r line; do
+                l="$(echo "$line" | sed 's/^ *//;s/ *$//')"
+                [ -z "$l" ] && continue
+                [ "${l#\#}" != "$l" ] && continue
+                case "$l" in
+                  *=*) ;;
+                  *) continue ;;
+                esac
 
-              keys = [
-                  "AWS_ACCESS_KEY_ID",
-                  "AWS_SECRET_ACCESS_KEY",
-                  "AWS_SESSION_TOKEN",
-                  "AWS_DEFAULT_REGION",
-                  "AWS_REGION",
-              ]
+                key="${l%%=*}"
+                value="${l#*=}"
+                key="$(echo "$key" | sed 's/^ *//;s/ *$//')"
+                value="$(echo "$value" | sed 's/^ *//;s/ *$//')"
 
-              lower = os.environ.get("LOWER", "")
-              parsed = {}
-
-              # Format 1: JSON object
-              try:
-                  obj = json.loads(lower)
-                  if isinstance(obj, dict):
-                      parsed = {str(k): str(v) for k, v in obj.items() if v is not None}
-              except Exception:
-                  pass
-
-              # Format 2: dotenv style lines: KEY=VALUE
-              if not parsed:
-                  for line in lower.splitlines():
-                      s = line.strip()
-                      if not s or s.startswith("#") or "=" not in s:
-                          continue
-                      k, v = s.split("=", 1)
-                      parsed[k.strip()] = v.strip().strip('"').strip("'")
-
-              env_path = os.environ["GITHUB_ENV"]
-              with open(env_path, "a", encoding="utf-8") as f:
-                  for k in keys:
-                      if os.environ.get(k):
-                          continue
-                      v = parsed.get(k)
-                      if v:
-                          f.write(f"{k}={v}\\n")
-
-                  # Accept AWS_REGION in bundle as region source.
-                  if not os.environ.get("AWS_DEFAULT_REGION") and parsed.get("AWS_REGION"):
-                      f.write(f"AWS_DEFAULT_REGION={parsed['AWS_REGION']}\\n")
-              PY
+                case "$key" in
+                  AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN|AWS_DEFAULT_REGION|AWS_REGION)
+                    if [ -n "$value" ]; then
+                      echo "$key=$value" >> "$GITHUB_ENV"
+                      if [ "$key" = "AWS_REGION" ]; then
+                        echo "AWS_DEFAULT_REGION=$value" >> "$GITHUB_ENV"
+                      fi
+                    fi
+                    ;;
+                esac
+              done <<EOF
+              $LOWER
+              EOF
 
       - name: Check required AWS secrets
         run: |