name: Secrets

on:
  workflow_dispatch:
    inputs:
      environment:
        type: choice
        options: [preview, staging, production]
        required: true
      action:
        type: choice
        options: [check, push]
        required: true

permissions:
  contents: read

jobs:
  secrets:
    environment: "${{ inputs.environment }}"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm dlx trestlejs@latest secrets ${{ inputs.action }} --env ${{ inputs.environment }}
        env:
          TRESTLE_MASTER_KEY: "${{ secrets.TRESTLE_MASTER_KEY }}"
          CLOUDFLARE_API_TOKEN: "${{ secrets.CLOUDFLARE_API_TOKEN }}"
          CLOUDFLARE_ACCOUNT_ID: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}"