secrets-encrypt-and-push.yml

name: Export and Encrypt Secrets

on:
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  export-secrets:
    runs-on: ubuntu-latest
    steps:

    - name: Import GPG key
      run: |
        echo "${{ secrets.EXT_SECRETS_GPG_PUBLIC_KEY }}" | gpg --import
        gpg --list-keys

    - name: Export and Encrypt Secrets
      id: encrypt
      env:
        ENV: ${{ vars.EXT_SECRETS_ENV }}
      run: |
        mkdir -p secrets/${ENV}
        echo '${{ toJson(secrets) }}' > secrets.json
        cat secrets.json | jq -r 'keys[] as $k | "\($k):\(.[$k])"' | while IFS=: read -r name value; do
          if [[ ${#name} -eq 3 ]]; then
            echo -n "$value" | gpg --batch --yes --trust-model always --encrypt --armor -r "$(gpg --list-keys --with-colons | awk -F: '$1 == "uid" { print $10 }' | head -1)" > "secrets/dev/$name.pgp"
          fi
        done
        echo "List created files"
        ls -la secrets/dev

    - name: Checkout participants-secrets repo
      uses: actions/checkout@v4
      env:
        REPO_TOKEN: ${{ secrets.EXT_SECRETS_REPO_TOKEN }}
      with:
        repository: WorldHealthOrganization/tng-participants-secrets
        ref: main
        path: participants-secrets
        token: ${{ secrets.EXT_SECRETS_REPO_TOKEN }}

    - name: Copy secret files to participants-secrets folder
      env:
        ENV: ${{ vars.EXT_SECRETS_ENV }}
      run: |

        cd participants-secrets
        # Create or update the dev folder
        mkdir -p ${ENV}
        cp -r ../secrets/${ENV}/* ${ENV}/
        echo "The secrets in the ${ENV} folder are:"
        ls -la ${ENV}/ 

    - name: Create Pull Request
      uses: peter-evans/create-pull-request@v7
      with:
        token: ${{ secrets.EXT_SECRETS_REPO_TOKEN }}
        commit-message: Add encrypted secrets from tng-participants-dev
        title: Add encrypted secrets
        body: This PR adds the encrypted secrets to the dev folder.
        path: participants-secrets