name: decrypt SOPS secrets
description: installs SOPS and decrypts all *.sops.* files using an age key

inputs:
  sops-age-key:
    description: age private key SOPS_AGE_KEY
    required: true

runs:
  using: "composite"
  steps:
    - name: resolve SOPS target
      shell: bash
      env:
        ## renovate: datasource=github-releases depName=getsops/sops
        SOPS_VERSION: v3.13.3 ## latest
      run: |
        set -euo pipefail

        os=$(uname -s | tr '[:upper:]' '[:lower:]')
        arch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')

        {
          echo "SOPS_VERSION=$SOPS_VERSION"
          echo "SOPS_OS=$os"
          echo "SOPS_ARCH=$arch"
        } >> "$GITHUB_ENV"

    - name: restore cached SOPS
      id: sops-cache
      uses: actions/cache@v4
      with:
        path: ${{ runner.temp }}/sops
        key: sops-${{ runner.os }}-${{ runner.arch }}-${{ env.SOPS_VERSION }}

    - name: install SOPS
      if: steps.sops-cache.outputs.cache-hit != 'true'
      shell: bash
      run: |
        set -euo pipefail

        asset="sops-${SOPS_VERSION}.${SOPS_OS}.${SOPS_ARCH}"
        url="https://github.com/getsops/sops/releases/download/${SOPS_VERSION}"

        tmp=$(mktemp -d)
        trap 'rm -rf "$tmp"' EXIT

        curl -fsSL -o "$tmp/$asset" "$url/$asset" \
          -o "$tmp/checksums.txt" "$url/sops-${SOPS_VERSION}.checksums.txt"
        (cd "$tmp" && grep " ${asset}$" checksums.txt | shasum -a 256 -c -)

        mkdir -p "$RUNNER_TEMP/sops"
        chmod +x "$tmp/$asset"
        mv "$tmp/$asset" "$RUNNER_TEMP/sops/sops"

    - name: add SOPS to PATH
      shell: bash
      run: |
        set -euo pipefail

        chmod +x "$RUNNER_TEMP/sops/sops"
        echo "$RUNNER_TEMP/sops" >> "$GITHUB_PATH"

    - name: decrypt .sops files
      shell: bash
      env:
        SOPS_AGE_KEY: ${{ inputs.sops-age-key }}
      run: |
        set -euo pipefail

        echo "searching for SOPS files to decrypt..."

        while IFS= read -r -d '' file; do
          dir=$(dirname "$file"); base=$(basename "$file")
          output_file="$dir/${base/.sops/}"

          echo "decrypting '$file' to '$output_file'"

          tmp=$(mktemp "$dir/.sops-decrypt.XXXXXX")

          if ! sops --decrypt "$file" > "$tmp" || [ ! -s "$tmp" ]; then
            echo "decryption of '$file' failed or produced empty output" >&2
            rm -f "$tmp"
            exit 1
          fi

          chmod 600 "$tmp"
          mv "$tmp" "$output_file"
        done < <(find . -type f -name "*.sops.*" -not -name ".sops.yaml" -print0)

        echo "SOPS decryption complete."