name: Sync

on:
  workflow_dispatch:

permissions: {}

jobs:
  prepare:
    name: Prepare
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
    outputs:
      gh_key: ${{ steps.secrets.outputs.GH-APP-KEY }}
    steps:
      - name: Log in to Azure
        uses: bitwarden/gh-actions/azure-login@main
        with:
          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
          client_id: ${{ secrets.AZURE_CLIENT_ID }}

      - name: Get Azure Key Vault secrets
        id: secrets
        uses: bitwarden/gh-actions/get-keyvault-secrets@main
        with:
          keyvault: ci-shared-kv
          secrets: "GH-APP-ID,GH-APP-KEY"

      - name: Log out from Azure
        uses: bitwarden/gh-actions/azure-logout@main

  sync:
    name: Sync downstream repo
    needs: prepare
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Check out platform repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: myorg/platform
          token: ${{ needs.prepare.outputs.gh_key }}

      - name: Trigger downstream sync
        env:
          GH_TOKEN: ${{ needs.prepare.outputs.gh_key }}
        run: gh api repos/myorg/platform/dispatches -f event_type=sync