feat: add chain and fullchain certificate file support

action.yml

@@ -65,9 +65,17 @@ inputs:
     default: '10m'
 
   cert-path:
-    description: 'Path to save the certificate PEM'
+    description: 'Path to save the certificate PEM (leaf only)'
     required: false
     default: './cert.pem'
+  chain-path:
+    description: 'Path to save the intermediate chain PEM'
+    required: false
+    default: './chain.pem'
+  fullchain-path:
+    description: 'Path to save the full chain PEM (leaf + intermediates)'
+    required: false
+    default: './fullchain.pem'
   key-path:
     description: 'Path to save the private key PEM (issue only)'
     required: false
@@ -114,8 +122,14 @@ outputs:
     description: 'Key size (e.g., 256, 2048)'
     value: ${{ steps.run.outputs.key-size }}
   cert-path:
-    description: 'Absolute path to the saved certificate PEM'
+    description: 'Absolute path to the saved certificate PEM (leaf only)'
     value: ${{ steps.run.outputs.cert-path }}
+  chain-path:
+    description: 'Absolute path to the saved intermediate chain PEM'
+    value: ${{ steps.run.outputs.chain-path }}
+  fullchain-path:
+    description: 'Absolute path to the saved full chain PEM (leaf + intermediates)'
+    value: ${{ steps.run.outputs.fullchain-path }}
   key-path:
     description: 'Absolute path to the saved private key PEM (issue only)'
     value: ${{ steps.run.outputs.key-path }}
@@ -145,6 +159,8 @@ runs:
         INPUT_POLL_INTERVAL: ${{ inputs.poll-interval }}
         INPUT_POLL_TIMEOUT: ${{ inputs.poll-timeout }}
         INPUT_CERT_PATH: ${{ inputs.cert-path }}
+        INPUT_CHAIN_PATH: ${{ inputs.chain-path }}
+        INPUT_FULLCHAIN_PATH: ${{ inputs.fullchain-path }}
         INPUT_KEY_PATH: ${{ inputs.key-path }}
         INPUT_CSR_PATH: ${{ inputs.csr-path }}
         INPUT_CLI_VERSION: ${{ inputs.cli-version }}

entrypoint.sh

@@ -83,6 +83,8 @@ execute_issue() {
     --key-out "${INPUT_KEY_PATH}"
     --csr-out "${INPUT_CSR_PATH}"
     --out "${INPUT_CERT_PATH}"
+    --chain-out "${INPUT_CHAIN_PATH}"
+    --fullchain-out "${INPUT_FULLCHAIN_PATH}"
   )
   [[ "${INPUT_AUTO_RENEW}" == "true" ]] && args+=(--auto-renew)
   [[ "${INPUT_WAIT}" == "true" ]] && args+=(--wait)
@@ -116,6 +118,22 @@ execute_renew() {
       --no-color \
       cert download "${INPUT_CERT_ID}" \
       --out "${INPUT_CERT_PATH}" > /dev/null
+
+    KK_API_KEY="${INPUT_API_KEY}" krakenkey \
+      --api-url "${INPUT_API_URL}" \
+      --output json \
+      --no-color \
+      cert download "${INPUT_CERT_ID}" \
+      --format chain \
+      --out "${INPUT_CHAIN_PATH}" 2>/dev/null || true
+
+    KK_API_KEY="${INPUT_API_KEY}" krakenkey \
+      --api-url "${INPUT_API_URL}" \
+      --output json \
+      --no-color \
+      cert download "${INPUT_CERT_ID}" \
+      --format fullchain \
+      --out "${INPUT_FULLCHAIN_PATH}" 2>/dev/null || true
   fi
 }
 
@@ -126,6 +144,22 @@ execute_download() {
     --no-color \
     cert download "${INPUT_CERT_ID}" \
     --out "${INPUT_CERT_PATH}"
+
+  KK_API_KEY="${INPUT_API_KEY}" krakenkey \
+    --api-url "${INPUT_API_URL}" \
+    --output json \
+    --no-color \
+    cert download "${INPUT_CERT_ID}" \
+    --format chain \
+    --out "${INPUT_CHAIN_PATH}" 2>/dev/null || true
+
+  KK_API_KEY="${INPUT_API_KEY}" krakenkey \
+    --api-url "${INPUT_API_URL}" \
+    --output json \
+    --no-color \
+    cert download "${INPUT_CERT_ID}" \
+    --format fullchain \
+    --out "${INPUT_FULLCHAIN_PATH}" 2>/dev/null || true
 }
 
 # ── 5. Parse output and set Action outputs ───────────────────────
@@ -165,12 +199,16 @@ set_outputs() {
 
   {
     echo "cert-path=$(realpath "${INPUT_CERT_PATH}" 2>/dev/null || echo "${INPUT_CERT_PATH}")"
+    echo "chain-path=$(realpath "${INPUT_CHAIN_PATH}" 2>/dev/null || echo "${INPUT_CHAIN_PATH}")"
+    echo "fullchain-path=$(realpath "${INPUT_FULLCHAIN_PATH}" 2>/dev/null || echo "${INPUT_FULLCHAIN_PATH}")"
     echo "key-path=$(realpath "${INPUT_KEY_PATH}" 2>/dev/null || echo "${INPUT_KEY_PATH}")"
     echo "csr-path=$(realpath "${INPUT_CSR_PATH}" 2>/dev/null || echo "${INPUT_CSR_PATH}")"
   } >> "${GITHUB_OUTPUT}"
 
   [[ -f "${INPUT_KEY_PATH}" ]] && chmod 0600 "${INPUT_KEY_PATH}"
   [[ -f "${INPUT_CERT_PATH}" ]] && chmod 0644 "${INPUT_CERT_PATH}"
+  [[ -f "${INPUT_CHAIN_PATH}" ]] && chmod 0644 "${INPUT_CHAIN_PATH}"
+  [[ -f "${INPUT_FULLCHAIN_PATH}" ]] && chmod 0644 "${INPUT_FULLCHAIN_PATH}"
 }
 
 # ── 6. Error handler ────────────────────────────────────────────