From bd66e0b8b6b57abcedec4d69d07ddde7dbbec3fc Mon Sep 17 00:00:00 2001
From: Till Klampaeckel <till@php.net>
Date: Thu, 19 Mar 2026 16:08:49 +0100
Subject: [PATCH] feat: support api key

this commit adds support for api key in the GitHub Action and adds
notices that username/password is deprecated.

related: pngmbh/issues#2177
---
 README.md  | 40 ++++++++++++++++++++++++++++------------
 action.yml | 43 +++++++++++++++++++++++++++++++++++++------
 2 files changed, 65 insertions(+), 18 deletions(-)

diff --git a/README.md b/README.md
index 0dd85e1..b93817d 100644
--- a/README.md
+++ b/README.md
@@ -20,16 +20,31 @@ A GitHub Action to install and configure [`quantum-cli`](https://cli.planetary-q
 
 ## Inputs
 
-| Input | Required | Description |
-|-------|----------|-------------|
-| `username` | Yes | Your Quantum username |
-| `password` | Yes | Your Quantum password |
+You must provide **either** `api-key` **or** both `username` and `password`. You cannot use both methods together.
+
+| Input | Description |
+|-------|-------------|
+| `api-key` | Your Quantum API key (recommended) |
+| `username` | Your Quantum username (**deprecated**, use `api-key` instead) |
+| `password` | Your Quantum password (**deprecated**, use `api-key` instead) |
 
 ## Usage
 
 For detailed documentation on the `quantum-cli`, please refer to our [docs](https://docs.planetary-quantum.com/).
 
-### Basic example
+### Using API key (recommended)
+
+```yaml
+steps:
+  - uses: hostwithquantum/setup-quantum-cli@main
+    with:
+      api-key: ${{ secrets.QUANTUM_API_KEY }}
+  - run: quantum-cli auth status
+```
+
+### Using username/password (deprecated)
+
+> **Warning**: username/password authentication is deprecated. Please migrate to `api-key`.
 
 ```yaml
 steps:
@@ -37,8 +52,7 @@ steps:
     with:
       username: ${{ secrets.QUANTUM_USERNAME }}
       password: ${{ secrets.QUANTUM_PASSWORD }}
-
-  - run: quantum-cli validate
+  - run: quantum-cli auth status
 ```
 
 ### Full workflow example
@@ -57,13 +71,12 @@ jobs:
       - uses: actions/checkout@v6
       - uses: hostwithquantum/setup-quantum-cli@main
         with:
-          username: ${{ secrets.QUANTUM_USERNAME }}
-          password: ${{ secrets.QUANTUM_PASSWORD }}
+          api-key: ${{ secrets.QUANTUM_API_KEY }}
       - run: quantum-cli auth status
       - run: quantum-cli stack deploy
         env:
           QUANTUM_ENDPOINT: my-cluster
-          QUANTUM_SATCK: my-app
+          QUANTUM_STACK: my-app
 ```
 
 ### Windows example
@@ -76,8 +89,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: hostwithquantum/setup-quantum-cli@main
         with:
-          username: ${{ secrets.QUANTUM_USERNAME }}
-          password: ${{ secrets.QUANTUM_PASSWORD }}
+          api-key: ${{ secrets.QUANTUM_API_KEY }}
       - run: quantum-cli.exe auth status
 ```
 
@@ -85,6 +97,10 @@ jobs:
 
 The action sets the following environment variables for subsequent steps:
 
+When using API key:
+- `QUANTUM_API_KEY` — your API key
+
+When using username/password (deprecated):
 - `QUANTUM_USER` — your username
 - `QUANTUM_PASSWORD` — your password
 
diff --git a/action.yml b/action.yml
index f89e36d..7738799 100644
--- a/action.yml
+++ b/action.yml
@@ -5,14 +5,39 @@ branding:
   color: 'red'
 inputs:
   username:
-    required: true
-    description: username
+    required: false
+    description: Your Quantum username (required if not using api-key)
   password:
-    required: true
-    description: password
+    required: false
+    description: Your Quantum password (required if not using api-key)
+  api-key:
+    required: false
+    description: Your Quantum API key (alternative to username/password)
 runs:
   using: "composite"
   steps:
+  - name: validate inputs
+    run: |
+      HAS_USERNAME="${{ inputs.username != '' }}"
+      HAS_PASSWORD="${{ inputs.password != '' }}"
+      HAS_API_KEY="${{ inputs.api-key != '' }}"
+
+      if [ "$HAS_API_KEY" = "true" ]; then
+        if [ "$HAS_USERNAME" = "true" ] || [ "$HAS_PASSWORD" = "true" ]; then
+          echo "::error title=Invalid inputs::Cannot use api-key together with username/password. Use either api-key OR username+password."
+          exit 1
+        fi
+      else
+        if [ "$HAS_USERNAME" != "true" ] || [ "$HAS_PASSWORD" != "true" ]; then
+          echo "::error title=Missing credentials::Must provide either api-key OR both username and password."
+          exit 1
+        fi
+      fi
+    shell: bash
+  - name: deprecation warning (username/password)
+    if: inputs.api-key == ''
+    run: echo "::warning title=Deprecated::username/password authentication is deprecated. Please migrate to api-key."
+    shell: bash
   - name: install quantum-cli (Linux)
     if: runner.os == 'Linux'
     run: |
@@ -68,7 +93,13 @@ runs:
     if: runner.os == 'Windows'
     run: quantum-cli.exe -v
     shell: pwsh
-  - run: echo "QUANTUM_USER=${{ inputs.username }}" >> "$GITHUB_ENV"
+  - name: set credentials (username/password)
+    if: inputs.api-key == ''
+    run: |
+      echo "QUANTUM_USER=${{ inputs.username }}" >> "$GITHUB_ENV"
+      echo "QUANTUM_PASSWORD=${{ inputs.password }}" >> "$GITHUB_ENV"
     shell: bash
-  - run: echo "QUANTUM_PASSWORD=${{ inputs.password }}" >> "$GITHUB_ENV"
+  - name: set credentials (api-key)
+    if: inputs.api-key != ''
+    run: echo "QUANTUM_API_KEY=${{ inputs.api-key }}" >> "$GITHUB_ENV"
     shell: bash