Bootstrap Stage 12 staging Modal secrets

Author: anth-volk

.github/scripts/stage12-bootstrap-modal-token-secrets.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# One-use transfer of established GitHub Modal credentials to GCP Secret Manager.
+
+set -euo pipefail
+set +x
+
+: "${MODAL_TOKEN_ID:?MODAL_TOKEN_ID is required}"
+: "${MODAL_TOKEN_SECRET:?MODAL_TOKEN_SECRET is required}"
+
+project="policyengine-simulation-entry"
+deploy_account="sim-entry-gh-deployer@policyengine-simulation-entry.iam.gserviceaccount.com"
+
+active_account="$(gcloud auth list --filter=status:ACTIVE --format='value(account)')"
+if [[ "${active_account}" != "${deploy_account}" ]]; then
+  echo "Unexpected GCP deployment identity" >&2
+  exit 1
+fi
+
+add_if_empty() {
+  local secret_name="$1"
+  local value="$2"
+  local enabled_version
+  gcloud secrets describe "${secret_name}" \
+    --project "${project}" >/dev/null
+  enabled_version="$(
+    gcloud secrets versions list "${secret_name}" \
+      --project "${project}" \
+      --filter 'state=ENABLED' \
+      --format 'value(name)' \
+      --limit 1
+  )"
+  if [[ -z "${enabled_version}" ]]; then
+    printf '%s' "${value}" |
+      gcloud secrets versions add "${secret_name}" \
+        --project "${project}" \
+        --data-file=- \
+        --quiet >/dev/null
+  fi
+}
+
+add_if_empty "stage12-staging-modal-token-id" "${MODAL_TOKEN_ID}"
+add_if_empty "stage12-staging-modal-token-secret" "${MODAL_TOKEN_SECRET}"
+
+for secret_name in \
+  stage12-staging-modal-token-id \
+  stage12-staging-modal-token-secret; do
+  enabled_version="$(
+    gcloud secrets versions list "${secret_name}" \
+      --project "${project}" \
+      --filter 'state=ENABLED' \
+      --format 'value(name)' \
+      --limit 1
+  )"
+  if [[ -z "${enabled_version}" ]]; then
+    echo "Modal token transfer did not create an enabled secret version" >&2
+    exit 1
+  fi
+done
+
+echo "Both Stage 12 staging Modal token secrets now have an enabled version."

.github/workflows/stage12-bootstrap-staging-modal-secrets.yml

@@ -0,0 +1,30 @@
+name: One-use Stage 12 staging Modal secret bootstrap
+
+on:
+  push:
+    branches:
+      - stage12-bootstrap-staging-modal-secrets-20260915
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  transfer-existing-modal-token:
+    runs-on: ubuntu-latest
+    environment: beta
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ secrets.SIMULATION_ENTRYPOINT_GCP_WIF_PROVIDER }}
+          service_account: ${{ secrets.SIMULATION_ENTRYPOINT_GCP_DEPLOY_SERVICE_ACCOUNT }}
+
+      - uses: google-github-actions/setup-gcloud@v2
+
+      - name: Copy established Modal token to the pre-created GCP secrets
+        env:
+          MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
+          MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
+        run: bash .github/scripts/stage12-bootstrap-modal-token-secrets.sh