demo-sops.yml

name: Encrypt Secret Manifest and Save in Repository

on: push


jobs:
  encrypt_and_save:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      id-token: 'write'

    steps:

      - name: Checkout repository
        uses: actions/checkout@v4

      - name: 'Authenticate to Google Cloud'
        id: 'auth'
        uses: 'google-github-actions/auth@v2'
        with:
          token_format: 'access_token'
          project_id: 'k8s-k3s'
          workload_identity_provider: 'projects/488768844240/locations/global/workloadIdentityPools/demo-pool/providers/github-provider'
          service_account: 'terraform@k8s-k3s.iam.gserviceaccount.com'
    
      - id: 'secrets'
        uses: 'google-github-actions/get-secretmanager-secrets@v2'
        with:
          secrets: |-
            token:k8s-k3s/demo