ci: one-off copy of the release secrets into the release environment

Author: EtienneLescot

.github/workflows/copy-release-secrets.yml

@@ -0,0 +1,54 @@
+name: Copy release secrets (one-off)
+
+# Runs once, from the throwaway branch tmp/copy-release-secrets, never from main.
+# Copies the release credentials from repository secrets into the `release`
+# environment, so nobody has to re-type them. The token needs temporary
+# "Secrets" and "Environments" write permissions for this run only.
+# Delete the branch once the run is green.
+
+on:
+  push:
+    branches: [tmp/copy-release-secrets]
+
+permissions: {}
+
+jobs:
+  copy:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ secrets.OPENSCREEN_RELEASE_TOKEN }}
+      REPO: ${{ github.repository }}
+      OPENSCREEN_RELEASE_TOKEN: ${{ secrets.OPENSCREEN_RELEASE_TOKEN }}
+      MAC_CERTIFICATE_P12: ${{ secrets.MAC_CERTIFICATE_P12 }}
+      MAC_CERTIFICATE_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
+      MAC_CSC_NAME: ${{ secrets.MAC_CSC_NAME }}
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+      AZURE_AD_TENANT_ID: ${{ secrets.AZURE_AD_TENANT_ID }}
+      AZURE_AD_APPLICATION_CLIENT_ID: ${{ secrets.AZURE_AD_APPLICATION_CLIENT_ID }}
+      AZURE_AD_APPLICATION_SECRET: ${{ secrets.AZURE_AD_APPLICATION_SECRET }}
+      SELLER_ID: ${{ secrets.SELLER_ID }}
+      WINGET_ACC_TOKEN: ${{ secrets.WINGET_ACC_TOKEN }}
+      HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+      AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+    steps:
+      - name: Copy each secret into the release environment
+        run: |
+          set -euo pipefail
+          failed=0
+          for name in OPENSCREEN_RELEASE_TOKEN MAC_CERTIFICATE_P12 MAC_CERTIFICATE_PASSWORD \
+            MAC_CSC_NAME APPLE_ID APPLE_TEAM_ID APPLE_APP_SPECIFIC_PASSWORD AZURE_AD_TENANT_ID \
+            AZURE_AD_APPLICATION_CLIENT_ID AZURE_AD_APPLICATION_SECRET SELLER_ID \
+            WINGET_ACC_TOKEN HOMEBREW_TAP_TOKEN AUR_SSH_PRIVATE_KEY; do
+            value="${!name}"
+            if [ -z "$value" ]; then
+              echo "::error::$name is empty at repository level, not copied"
+              failed=1
+              continue
+            fi
+            # printf keeps the value byte for byte; gh reads it from stdin.
+            printf '%s' "$value" | gh secret set "$name" --env release --repo "$REPO"
+            echo "copied $name"
+          done
+          exit "$failed"