name: GitHub API token from 1Password
description: >
  Resolve the GitHub API token that setup-php authenticates with, via the
  1Password Connect instance running inside whichever cluster picked up this
  job. Mirrors thatguygriff/infra .gitea/actions/op-connect, which is not
  reachable from this repository.

inputs:
  connect-host:
    description: 1Password Connect host
    required: true
  op-connect-token-eris:
    description: 1Password Connect token for the eris cluster
    required: true
  op-connect-token-kallone:
    description: 1Password Connect token for the kallone cluster
    required: true
  op-connect-token-nemesis:
    description: 1Password Connect token for the nemesis cluster
    required: true

outputs:
  token:
    description: GitHub API token, for the GITHUB_TOKEN env of a setup-php step
    value: ${{ steps.load.outputs.GH_API_TOKEN }}

runs:
  using: composite
  steps:
    # Connect is addressed at a cluster-local Service, so the token has to match
    # the cluster the job landed on. A value with no match would configure no
    # host at all and fail somewhere less obvious.
    - name: Check RUNNER_CLUSTER is recognised
      shell: bash
      run: |
        case "${RUNNER_CLUSTER:-}" in
          eris|kallone|nemesis) echo "Runner cluster: $RUNNER_CLUSTER" ;;
          "") echo "::error::RUNNER_CLUSTER is unset; no 1Password Connect token can be selected"; exit 1 ;;
          *)  echo "::error::RUNNER_CLUSTER='$RUNNER_CLUSTER' has no matching 1Password Connect token"; exit 1 ;;
        esac

    - name: Configure Connect (eris)
      if: env.RUNNER_CLUSTER == 'eris'
      uses: 1password/load-secrets-action/configure@v2
      with:
        connect-host: ${{ inputs.connect-host }}
        connect-token: ${{ inputs.op-connect-token-eris }}

    - name: Configure Connect (kallone)
      if: env.RUNNER_CLUSTER == 'kallone'
      uses: 1password/load-secrets-action/configure@v2
      with:
        connect-host: ${{ inputs.connect-host }}
        connect-token: ${{ inputs.op-connect-token-kallone }}

    - name: Configure Connect (nemesis)
      if: env.RUNNER_CLUSTER == 'nemesis'
      uses: 1password/load-secrets-action/configure@v2
      with:
        connect-host: ${{ inputs.connect-host }}
        connect-token: ${{ inputs.op-connect-token-nemesis }}

    # export-env stays false so the token surfaces as a step output rather than
    # entering the job environment, where `composer install` would run third
    # party package scripts alongside it.
    - name: Load GitHub API token
      id: load
      uses: 1password/load-secrets-action@v2
      with:
        export-env: false
      env:
        GH_API_TOKEN: "op://Unsupervised/GitHub Personal Access Token for Gitea/token"

    - name: Verify token loaded
      shell: bash
      env:
        GH_API_TOKEN: ${{ steps.load.outputs.GH_API_TOKEN }}
      run: |
        test -n "$GH_API_TOKEN" || { echo "::error::GitHub API token is empty after loading from 1Password"; exit 1; }
        echo "GitHub API token loaded"