---
# template source: https://github.com/bretfisher/docker-build-workflow/blob/main/templates/call-docker-build.yaml
name: Hashicorp Vault

on: [push,pull_request]
  # push: &helmPaths # turns out gitea don't handle well the paths filter
  #   paths:
  #     - '*/\.yaml'
  #     - '*/\.tpl'
  #     - '*/NOTES.txt'
  #     - '*/\.helmignore'
  # pull_request: *helmPaths

# cancel any previously-started, yet still active runs of this workflow on the same branch
concurrency:
  group: ${{ github.ref }}-${{ github.workflow }}
  cancel-in-progress: true

jobs:
  gitea_vault_auth:
    name: Auth with gitea for vault
    runs-on: ubuntu-latest
    outputs:
      gitea_vault_jwt: ${{steps.gitea_vault_jwt.outputs.access_token}}
    steps:
      - uses: actions/checkout@v4

      - name: Auth with gitea for vault
        id: gitea_vault_jwt
        run: |
          VAULT_AUTH_JWT=`echo -n "${{ secrets.get_gitea_vault_jwt__sh_b64 }}" | base64 -d | sh \
           | tee /dev/tty | tail -n 1 | awk '{print $NF}'`
          echo "access_token=$VAULT_AUTH_JWT" >> $GITHUB_OUTPUT

  tofu:
    name: Library charts ${{ matrix.chart }}
    needs:
      - gitea_vault_auth
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/opentofu/opentofu:latest
      env:
        TERRAFORM_VAULT_AUTH_JWT: ${{ needs.gitea_vault_auth.outputs.access_token }}
    steps:

      - uses: actions/checkout@v4
      - tofu -chdir=hashicorp-vault/iac init
      - tofu -chdir=hashicorp-vault/iac apply -no-color -auto-approve