name: decrypt SOPS secrets
description: installs SOPS and decrypts all *.sops.* files using an age key

inputs:
  sops-age-key:
    description: age private key SOPS_AGE_KEY
    required: true

runs:
  using: "composite"
  steps:
    - name: install SOPS
      shell: bash
      env:
        ## renovate: datasource=github-releases depName=getsops/sops
        SOPS_VERSION: v3.13.3 ## latest
      run: |
        set -euo pipefail

        os=$(uname -s | tr '[:upper:]' '[:lower:]')
        arch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
        asset="sops-${SOPS_VERSION}.${os}.${arch}"
        url="https://github.com/getsops/sops/releases/download/${SOPS_VERSION}"

        curl -fsSL -o "$asset" "${url}/${asset}" -o checksums.txt "${url}/sops-${SOPS_VERSION}.checksums.txt"
        grep " ${asset}$" checksums.txt | shasum -a 256 -c -

        chmod +x "$asset"
        sudo mv "$asset" /usr/local/bin/sops
        rm checksums.txt

    - name: decrypt .sops files
      shell: bash
      env:
        SOPS_AGE_KEY: ${{ inputs.sops-age-key }}
      run: |
        set -euo pipefail

        echo "searching for SOPS files to decrypt..."

        ## decrypt every *.sops.* file (except .sops.yaml)
        while IFS= read -r -d '' file; do
          dir=$(dirname "$file"); base=$(basename "$file")
          output_file="$dir/${base/.sops/}"

          echo "decrypting '$file' to '$output_file'"

          tmp=$(mktemp)
          sops --decrypt "$file" > "$tmp"
          [ -s "$tmp" ] || { echo "decryption of '$file' produced empty output" >&2; exit 1; }
          chmod 600 "$tmp"
          mv "$tmp" "$output_file"
        done < <(find . -type f -name "*.sops.*" -not -name ".sops.yaml" -print0)

        echo "SOPS decryption complete."