wrkflw/examples/secrets-demo/secrets-workflow.yml

name: Comprehensive Secrets Demo
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  # Basic environment variable secrets
  env-secrets:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      
      - name: Use GitHub Token
        run: |
          echo "Fetching user info from GitHub API"
          curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            https://api.github.com/user | jq '.login'
      
      - name: Use API Key
        env:
          API_KEY: ${{ secrets.API_KEY }}
        run: |
          echo "API Key length: ${#API_KEY}"
          # Key will be masked in logs automatically
          
      - name: Database connection
        run: |
          echo "Connecting to database with credentials"
          echo "User: ${{ secrets.DB_USER }}"
          echo "Password: [MASKED]"
          # Password would be: ${{ secrets.DB_PASSWORD }}

  # Provider-specific secrets
  provider-secrets:
    runs-on: ubuntu-latest
    steps:
      - name: Use file-based secrets
        run: |
          echo "File secret: ${{ secrets.file:FILE_SECRET }}"
          
      - name: Use environment with prefix
        run: |
          echo "Prefixed secret: ${{ secrets.env:PREFIXED_KEY }}"
          
      - name: Use Vault secret (if configured)
        run: |
          # This would work if Vault provider is configured
          echo "Vault secret: ${{ secrets.vault:api-key }}"
          
      - name: Use AWS Secrets Manager (if configured)  
        run: |
          # This would work if AWS provider is configured
          echo "AWS secret: ${{ secrets.aws:prod/database/password }}"

  # Real-world integration examples
  github-integration:
    runs-on: ubuntu-latest
    steps:
      - name: Create GitHub issue
        run: |
          curl -X POST \
            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            -H "Accept: application/vnd.github.v3+json" \
            -H "Content-Type: application/json" \
            https://api.github.com/repos/${{ github.repository }}/issues \
            -d '{
              "title": "Automated issue from wrkflw",
              "body": "This issue was created automatically by wrkflw secrets demo",
              "labels": ["automation", "demo"]
            }'
      
      - name: List repository secrets (admin only)
        run: |
          # This would require admin permissions
          curl -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            https://api.github.com/repos/${{ github.repository }}/actions/secrets

  # Docker registry integration
  docker-integration:
    runs-on: ubuntu-latest
    steps:
      - name: Login to Docker Hub
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: |
          echo "Logging into Docker Hub"
          echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
          
      - name: Pull private image
        run: |
          docker pull private-registry.com/myapp:latest
          
      - name: Push image
        run: |
          docker tag myapp:latest "${{ secrets.DOCKER_USERNAME }}/myapp:${{ github.sha }}"
          docker push "${{ secrets.DOCKER_USERNAME }}/myapp:${{ github.sha }}"

  # Cloud provider integration
  aws-integration:
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS credentials
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          echo "Configuring AWS CLI"
          aws configure set aws_access_key_id "$AWS_ACCESS_KEY_ID"
          aws configure set aws_secret_access_key "$AWS_SECRET_ACCESS_KEY"
          aws configure set default.region "$AWS_DEFAULT_REGION"
          
      - name: List S3 buckets
        run: |
          aws s3 ls
          
      - name: Deploy to S3
        run: |
          echo "Deploying to S3 bucket"
          aws s3 sync ./build/ s3://${{ secrets.S3_BUCKET_NAME }}/

  # Database operations
  database-operations:
    runs-on: ubuntu-latest
    steps:
      - name: PostgreSQL operations
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          PGPASSWORD: ${{ secrets.DB_PASSWORD }}
        run: |
          echo "Connecting to PostgreSQL database"
          psql "$DATABASE_URL" -c "SELECT version();"
          
      - name: MongoDB operations
        env:
          MONGO_CONNECTION_STRING: ${{ secrets.MONGO_CONNECTION_STRING }}
        run: |
          echo "Connecting to MongoDB"
          mongosh "$MONGO_CONNECTION_STRING" --eval "db.stats()"

  # API testing with secrets
  api-testing:
    runs-on: ubuntu-latest
    steps:
      - name: Test external API
        env:
          API_ENDPOINT: ${{ secrets.API_ENDPOINT }}
          API_KEY: ${{ secrets.API_KEY }}
        run: |
          echo "Testing API endpoint"
          curl -X GET \
            -H "Authorization: Bearer $API_KEY" \
            -H "Content-Type: application/json" \
            "$API_ENDPOINT/health"
            
      - name: Test webhook
        run: |
          curl -X POST \
            -H "Content-Type: application/json" \
            -d '{"event": "test", "source": "wrkflw"}' \
            "${{ secrets.WEBHOOK_URL }}"

  # Deployment with secrets
  deployment:
    runs-on: ubuntu-latest
    needs: [env-secrets, api-testing]
    if: github.ref == 'refs/heads/main'
    steps:
      - name: Deploy to staging
        env:
          DEPLOY_KEY: ${{ secrets.STAGING_DEPLOY_KEY }}
          STAGING_HOST: ${{ secrets.STAGING_HOST }}
        run: |
          echo "Deploying to staging environment"
          echo "$DEPLOY_KEY" | base64 -d > deploy_key
          chmod 600 deploy_key
          ssh -i deploy_key -o StrictHostKeyChecking=no \
            deploy@"$STAGING_HOST" 'cd /app && git pull && ./deploy.sh'
            
      - name: Notify deployment
        env:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
        run: |
          curl -X POST -H 'Content-type: application/json' \
            --data '{"text":"Deployment completed successfully"}' \
            "$SLACK_WEBHOOK"

  # Security testing
  security-demo:
    runs-on: ubuntu-latest
    steps:
      - name: Demonstrate secret masking
        run: |
          echo "This secret will be masked: ${{ secrets.DEMO_SECRET }}"
          echo "Even in complex strings: prefix_${{ secrets.DEMO_SECRET }}_suffix"
          
      - name: Show environment (secrets masked)
        run: |
          env | grep -E "(SECRET|TOKEN|PASSWORD|KEY)" || echo "No secrets visible in environment"
          
      - name: Test secret validation
        run: |
          # This would fail if secret doesn't exist
          if [ -z "${{ secrets.REQUIRED_SECRET }}" ]; then
            echo "ERROR: Required secret is missing"
            exit 1
          else
            echo "Required secret is present"
          fi