read cloudbuild manifest, find secrets, pull them from Secrets Manager, and display in a way where they can be saved in env.

pull_secrets.sh

#! /usr/bin/env sh
set -o pipefail

FILEPATH=$1; shift;

function pull_secrets {
	MANIFEST=$1; shift;
	SECRETS=$(cat "${MANIFEST}" | jq -r '.availableSecrets.secretManager[] | .env + "=" + .versionName');

	PROJECT_ID=$(gcloud projects list --filter $(gcloud config get project) --format="value(PROJECT_NUMBER)")

	for SECRET in ${SECRETS[@]}; do
		 SECRET_ENV=$(echo "$SECRET" | cut -d '=' -f 1);
		SECRET_PATH=$(echo "$SECRET" | cut -d '=' -f 2);
		SECRET_NAME=$(echo "$SECRET_PATH" | cut -d '/' -f 4);
		echo "export ${SECRET_ENV}=\"$(gcloud secrets versions access latest --secret=$SECRET_NAME --project=$PROJECT_ID)\"";
	done
}

set -e
test -r "$FILEPATH" -a -f "$FILEPATH" || \
	(>&2 echo "Error: file \"$FILEPATH\" not found or unreadable"; exit 255);

pull_secrets "$FILEPATH";