@mp-lb/arcnet 0.1.0 → 0.2.0

package/src/secrets/writeSecretsWorkflow.ts

@@ -0,0 +1,83 @@
+import { mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { stringify } from "yaml";
+import { safeTargetPath } from "../safeTargetPath.js";
+import type { SecretsConfig } from "./config.js";
+import { wireSecretsWorkflows } from "./wireSecretsWorkflows.js";
+
+export const writeSecretsWorkflow = (
+  config: SecretsConfig,
+  root: string,
+  configFile: string,
+) => {
+  const path = safeTargetPath(
+    root,
+    ".github/workflows/validate-arcnet-secrets.yaml",
+  );
+
+  const marker =
+    "# Generated by arcnet secrets; configure sources in .arcnet/secrets.json.\n";
+
+  if (existsSync(path) && !readFileSync(path, "utf8").startsWith(marker))
+    throw new Error(
+      "Existing validate-arcnet-secrets.yaml is not ArcNet-managed; move it before continuing.",
+    );
+  if (configFile !== ".arcnet/secrets.json")
+    throw new Error(
+      "Generated CI requires the standard .arcnet/secrets.json location.",
+    );
+  mkdirSync(dirname(path), { recursive: true });
+
+  const env = Object.fromEntries(
+    config.sources
+      .flatMap((source) => [
+        source.keyEnv,
+        ...(!source.snapshot && source.tokenEnv ? [source.tokenEnv] : []),
+      ])
+      .map((key) => [key, `\u0024{{ secrets.${key} }}`]),
+  );
+
+  writeFileSync(
+    path,
+    marker +
+      stringify({
+        name: "Validate ArcNet secrets",
+        on: {
+          workflow_dispatch: {},
+          push: {
+            branches: ["main"],
+            paths: [
+              ".arcnet/**",
+              ".github/workflows/validate-arcnet-secrets.yaml",
+              "package.json",
+              "pnpm-lock.yaml",
+            ],
+          },
+        },
+        permissions: { contents: "read" },
+        jobs: {
+          validate: {
+            if: `github.repository == '${config.repository}' && github.ref == 'refs/heads/main'`,
+            "runs-on": "ubuntu-latest",
+            "timeout-minutes": 10,
+            steps: [
+              {
+                uses: "actions/checkout@v4",
+                with: { "persist-credentials": false },
+              },
+              { uses: "pnpm/action-setup@v4" },
+              { uses: "actions/setup-node@v4", with: { "node-version": 22 } },
+              { run: "pnpm install --frozen-lockfile --ignore-scripts" },
+              {
+                name: "Decrypt, merge and validate selected keys",
+                run: "pnpm exec arcnet env check",
+                env,
+              },
+            ],
+          },
+        },
+      }),
+  );
+
+  wireSecretsWorkflows(dirname(path), env);
+};