version: '1.0'

variables:
  github_org: myorganization
  github_repo: myrepo
  environment: production

providers:
  github:
    kind: github
    auth:
      kind: token
      config:
        # For repository-level secrets: Classic PAT works
        # For environment secrets: Requires Fine-grained PAT
        token: ${GITHUB_TOKEN}

secrets:
  # API Key for production environment
  - name: api_key
    kind: random_string
    config:
      length: 32
      charset: alphanumeric
    targets:
      # Store in local .env for development
      - provider: local
        kind: file
        config:
          path: .env
          format: dotenv
      
      # Store as GitHub Actions repository secret (works with Classic PAT)
      - provider: github
        kind: github_secret
        config:
          owner: ${github_org}
          repo: ${github_repo}
      
      # Store as environment-specific secret (requires Fine-grained PAT)
      # Classic PATs will fail with "Resource not accessible by personal access token"
      - provider: github
        kind: github_secret
        config:
          owner: ${github_org}
          repo: ${github_repo}
          environment: ${environment}  # Requires Fine-grained PAT!

  # Database password
  - name: database_password
    kind: random_password
    config:
      length: 32
      special: true
      exclude_characters: '"@/\`'
    targets:
      - provider: github
        kind: github_secret
        config:
          owner: ${github_org}
          repo: ${github_repo}
          environment: production

  # JWT signing key
  - name: jwt_secret
    kind: random_string
    config:
      length: 64
      charset: alphanumeric
    targets:
      - provider: github
        kind: github_secret
        config:
          owner: ${github_org}
          repo: ${github_repo}

metadata:
  project: github-actions-secrets
  owner: platform-team
  description: GitHub Actions secrets management example
