push-1password-secrets-to-gha.yaml

name: "Push secrets from 1Password to Github Actions"

permissions:
  id-token: write
  contents: read

on:
  push:
    branches:
      - "push-secrets-*"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs:
  push-github-secrets:
    name: "Push Github Secret"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install 1Password CLI
        uses: 1password/install-cli-action@143a85f84a90555d121cde2ff5872e393a47ab9f # v1.0.0

      - name: Load GH token
        id: op-gh-token
        uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2.0.0
        with:
          export-env: false
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          GITHUB_TOKEN: op://pulumi/gh-pulumi-runner-token/credential

      - uses: pulumi/auth-actions@80dec0d5e009a11565cbf87d9ef9103fc7d24198 # v1.0.0
        with:
          organization: conda-forge
          requested-token-type: urn:pulumi:token-type:access_token:personal
          scope: user:conda-forge-bot

      - uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6.0.0
        with:
          command: up
          refresh: true
          stack-name: conda-forge/sync-secrets-gha/secrets
          work-dir: "./sync-secrets-gha"
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          GITHUB_TOKEN: ${{ steps.op-gh-token.outputs.GITHUB_TOKEN }}