name: Check SOPS sync

on:
  push:
  pull_request:

jobs:
  check-sops-sync:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install tools
        run: |
          sudo apt-get update
          sudo apt-get install -y openssl
          curl -fsSL https://github.com/getsops/sops/releases/latest/download/sops-v3.x.linux.amd64 \
            -o /tmp/sops
          sudo install -m 0755 /tmp/sops /usr/local/bin/sops
          curl -fsSL https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \
            -o /tmp/yq
          sudo install -m 0755 /tmp/yq /usr/local/bin/yq

      - name: Configure SOPS age key
        if: ${{ secrets.SOPS_AGE_KEY != '' }}
        run: |
          mkdir -p "${HOME}/.config/sops/age"
          printf '%s' '${{ secrets.SOPS_AGE_KEY }}' > "${HOME}/.config/sops/age/keys.txt"
          chmod 600 "${HOME}/.config/sops/age/keys.txt"

      - name: Check SOPS sync
        env:
          SOPS_SYNC_HMAC_KEY: ${{ secrets.SOPS_SYNC_HMAC_KEY }}
        run: scripts/ci/check-sops-sync