name: Sync Secrets to Registry

# 将本仓库 Gitea CI/CD secrets 明文写回注册中心 (Registry 配置管理中心) 的 MCP 服务
# 目标: service-iboard 项目 (proj-msid70ql-6xbq4w)
# 触发: 仅手动 (workflow_dispatch)
# 依赖 secret:
#   - REGISTRY_MCP_TOKEN  : 注册中心 MCP 访问令牌 (在注册中心 🔑Token 管理 里生成)
#   - 其余 secret 与三个构建 workflow 引用的保持一致 (未设置则跳过对应键)
# 注意: 传输为明文 http, 请保证注册中心仅内网可达; 若可访问则改用 https

on:
  workflow_dispatch:
    inputs:
      dry_run:
        description: '仅预演不写入 (true=只打印计划)'
        required: false
        default: 'false'

jobs:
  sync-secrets:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      REGISTRY_MCP_URL: http://bh.vps.honor3.com:8008/mcp
      REGISTRY_PROJECT_ID: proj-msid70ql-6xbq4w
      REGISTRY_IDC: '1'
      REGISTRY_ENVIRONMENT: '1'
    steps:
      - uses: https://gitea.com/actions/checkout@v4

      - name: Setup Node
        uses: https://gitea.com/actions/setup-node@v4
        with:
          node-version: 22

      - name: Sync secrets via MCP
        run: |
          if [ "${{ inputs.dry_run }}" = "true" ]; then
            node scripts/sync-registry.mjs --dry-run
          else
            node scripts/sync-registry.mjs
          fi
        env:
          REGISTRY_MCP_TOKEN: ${{ secrets.REGISTRY_MCP_TOKEN }}
          MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          JWT_SECRET: ${{ secrets.JWT_SECRET }}
          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}