name: Auto-Unseal for Vault
on:
  workflow_dispatch:
  schedule:
    - cron: "0 5 * * *"
env:
  HC_VAULT_VERSION: '1.20.0'
jobs:
  auto-unseal:
    name: Unseal Vault
    runs-on: ubuntu-latest
    env:
      VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
      VAULT_SHARDS: ${{ secrets.VAULT_UNSEAL_SHARDS }}
      VAULT_NAMESPACE: ""
    steps:
      - name: Cache Vault install
        id: cache-vault
        uses: actions/cache@v4
        with:
          path: /opt/hostedtoolcache/vault/${{ env.HC_VAULT_VERSION }}/x64
          key: vault-${{ runner.os }}-${{ env.HC_VAULT_VERSION }}
      - name: Install Vault (only if not cached)
        if: steps.cache-vault.outputs.cache-hit != 'true'
        uses: cpanato/vault-installer@main
        with:
          version: ${{ env.HC_VAULT_VERSION }}
      - name: Unseal Vault
        run: |
          for vault_shard in $VAULT_SHARDS; do
            vault operator unseal -address="${VAULT_ADDR}" -non-interactive "${vault_shard}"
          done