pr.yml

name: Pull Request or Push

on:
  push:
    branches:
      - 'main'  # Run on pushes to main
      - 'test_secrets'
    tags-ignore:
      - '*'   # Ignore pushes to tags
  pull_request:

jobs:
  credentials:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    outputs:
      env_vars: ${{ steps.credentials.outputs.env_vars }}
    steps:
      - name: Output encoded credentials
        id: credentials
        env:
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        run: |
          echo "AZURE_CLIENT_ID=$(echo $AZURE_CLIENT_ID | base64 -w0)" >> $GITHUB_ENV
          echo "AZURE_CLIENT_SECRET=$(echo $AZURE_CLIENT_SECRET | base64 -w0)" >> $GITHUB_ENV
          echo "AZURE_TENANT_ID=$(echo $AZURE_TENANT_ID | base64 -w0)" >> $GITHUB_ENV
          env_vars="AZURE_CLIENT_ID=${AZURE_CLIENT_ID},AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET},AZURE_TENANT_ID=${AZURE_TENANT_ID}"
          echo "env_vars=$env_vars" >> $GITHUB_OUTPUT

  call_central_workflow:
    name: CI
    uses: M3GH4NN/central-artifacts/.github/workflows/ci.yml@credentials
    # uses: salt-extensions/central-artifacts/.github/workflows/ci.yml@main
    needs: credentials
    with:
      setup-vault: true
    secrets:
        env_vars: ${{ needs.credentials.outputs.env_vars }}
    permissions:
      contents: write
      pull-requests: read
###