{{- if not .Values.secrets.githubApp.existingSecret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "specwright.githubSecretName" . }}
  labels:
    {{- include "specwright.labels" . | nindent 4 }}
type: Opaque
stringData:
  GH_APP_ID: {{ .Values.secrets.githubApp.appId | quote }}
  GH_PRIVATE_KEY: {{ .Values.secrets.githubApp.privateKey | quote }}
  GH_WEBHOOK_SECRET: {{ .Values.secrets.githubApp.webhookSecret | quote }}
  GH_INSTALLATION_ID: {{ .Values.secrets.githubApp.installationId | quote }}
{{- end }}
---
{{- if not .Values.secrets.anthropic.existingSecret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "specwright.anthropicSecretName" . }}
  labels:
    {{- include "specwright.labels" . | nindent 4 }}
type: Opaque
stringData:
  ANTHROPIC_API_KEY: {{ .Values.secrets.anthropic.apiKey | quote }}
{{- end }}
---
{{- if and .Values.secrets.neon.databaseUrl (not .Values.secrets.neon.existingSecret) }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "specwright.neonSecretName" . }}
  labels:
    {{- include "specwright.labels" . | nindent 4 }}
type: Opaque
stringData:
  DATABASE_URL: {{ .Values.secrets.neon.databaseUrl | quote }}
{{- end }}
---
{{- if and .Values.secrets.gcp.serviceAccountKey (not .Values.secrets.gcp.existingSecret) }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "specwright.gcpSecretName" . }}
  labels:
    {{- include "specwright.labels" . | nindent 4 }}
type: Opaque
stringData:
  GCP_SERVICE_ACCOUNT_KEY: {{ .Values.secrets.gcp.serviceAccountKey | quote }}
  GOOGLE_CLOUD_PROJECT: {{ .Values.secrets.gcp.project | quote }}
  GOOGLE_CLOUD_LOCATION: {{ .Values.secrets.gcp.location | quote }}
{{- end }}
---
{{- if and .Values.secrets.auth0.domain (not .Values.secrets.auth0.existingSecret) }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "specwright.auth0SecretName" . }}
  labels:
    {{- include "specwright.labels" . | nindent 4 }}
type: Opaque
stringData:
  AUTH0_DOMAIN: {{ .Values.secrets.auth0.domain | quote }}
  AUTH0_CLIENT_ID: {{ .Values.secrets.auth0.clientId | quote }}
  AUTH0_CLIENT_SECRET: {{ .Values.secrets.auth0.clientSecret | quote }}
  {{- if .Values.secrets.auth0.audience }}
  AUTH0_AUDIENCE: {{ .Values.secrets.auth0.audience | quote }}
  {{- end }}
  {{- if .Values.secrets.auth0.deviceClientId }}
  AUTH0_DEVICE_CLIENT_ID: {{ .Values.secrets.auth0.deviceClientId | quote }}
  {{- end }}
{{- end }}
---
{{- if and .Values.secrets.mcp.apiKey (not .Values.secrets.mcp.existingSecret) }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "specwright.fullname" . }}-mcp
  labels:
    {{- include "specwright.labels" . | nindent 4 }}
type: Opaque
stringData:
  MCP_API_KEY: {{ .Values.secrets.mcp.apiKey | quote }}
{{- end }}
---
{{- if and .Values.secrets.jira.host (not .Values.secrets.jira.existingSecret) }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "specwright.jiraSecretName" . }}
  labels:
    {{- include "specwright.labels" . | nindent 4 }}
type: Opaque
stringData:
  JIRA_HOST: {{ .Values.secrets.jira.host | quote }}
  JIRA_EMAIL: {{ .Values.secrets.jira.email | quote }}
  JIRA_API_TOKEN: {{ .Values.secrets.jira.apiToken | quote }}
{{- end }}
---
{{- if and .Values.secrets.posthog.apiKey (not .Values.secrets.posthog.existingSecret) }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "specwright.posthogSecretName" . }}
  labels:
    {{- include "specwright.labels" . | nindent 4 }}
type: Opaque
stringData:
  POSTHOG_KEY: {{ .Values.secrets.posthog.apiKey | quote }}
{{- end }}
