name: decrypt SOPS secrets
description: installs SOPS if missing and decrypts all *.sops.* files using an age key

inputs:
  sops-age-key:
    description: age private key SOPS_AGE_KEY
    required: true

runs:
  using: "composite"
  steps:
    - name: install SOPS
      shell: bash
      env:
        ## renovate: datasource=github-releases depName=getsops/sops
        SOPS_VERSION: v3.13.3 ## latest
      run: |
        set -euo pipefail

        command -v sops >/dev/null && exit 0

        os=$(uname -s | tr '[:upper:]' '[:lower:]')
        arch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
        asset="sops-${SOPS_VERSION}.${os}.${arch}"
        url="https://github.com/getsops/sops/releases/download/${SOPS_VERSION}"

        tmp=$(mktemp -d)
        trap 'rm -rf "$tmp"' EXIT

        curl -fsSL -o "$tmp/$asset" "$url/$asset" \
          -o "$tmp/checksums.txt" "$url/sops-${SOPS_VERSION}.checksums.txt"
        (cd "$tmp" && grep " ${asset}$" checksums.txt | shasum -a 256 -c -)

        chmod +x "$tmp/$asset"
        sudo mv "$tmp/$asset" /usr/local/bin/sops

    - name: decrypt .sops files
      shell: bash
      env:
        SOPS_AGE_KEY: ${{ inputs.sops-age-key }}
      run: |
        set -euo pipefail
        echo "searching for SOPS files to decrypt..."

        while IFS= read -r -d '' file; do
          dir=$(dirname "$file"); base=$(basename "$file")
          output_file="$dir/${base/.sops/}"

          echo "decrypting '$file' to '$output_file'"
          tmp=$(mktemp "$dir/.sops-decrypt.XXXXXX")
          if ! sops --decrypt "$file" > "$tmp" || [ ! -s "$tmp" ]; then
            echo "decryption of '$file' failed or produced empty output" >&2
            rm -f "$tmp"
            exit 1
          fi

          chmod 600 "$tmp"
          mv "$tmp" "$output_file"
        done < <(find . -type f -name "*.sops.*" -not -name ".sops.yaml" -print0)
        echo "SOPS decryption complete."