- name: Authenticate to {{org}}
  run: |
    # The key file goes to the runner temp dir, never the workspace: the
    # workspace is what upload-artifact and the caches collect. RUNNER_TEMP is
    # emptied at the end of the job, and mktemp creates the file 0600, which a
    # plain `>` redirect (umask, usually 0644) does not.
    KEY_FILE="$(mktemp "${RUNNER_TEMP:-${TMPDIR:-/tmp}}/server.key.XXXXXX")"
    trap 'rm -f "$KEY_FILE"' EXIT
    printf '%s\n' "$SFDX_JWT_SECRET_KEY" > "$KEY_FILE"
    sf org login jwt --client-id "$SFDX_CONSUMER_KEY" --jwt-key-file "$KEY_FILE" --username "$SFDX_USERNAME" --instance-url "${SFDX_INSTANCE_URL:-https://login.salesforce.com}" --alias {{org}} {{setDefaultFlag}}
  env:
    SFDX_CONSUMER_KEY: ${{ secrets.SFDX_CONSUMER_KEY }}
    SFDX_JWT_SECRET_KEY: ${{ secrets.SFDX_JWT_SECRET_KEY }}
    SFDX_USERNAME: ${{ secrets.SFDX_USERNAME }}
    SFDX_INSTANCE_URL: ${{ secrets.SFDX_INSTANCE_URL }}