From 41ee2c60afeb20ae321e27a7388ada776b7df30b Mon Sep 17 00:00:00 2001
From: Ivo Hlavaty <ivo.hlavaty@solarwinds.com>
Date: Tue, 12 Dec 2023 11:50:17 +0100
Subject: [PATCH] secrets pipeline

---
 .github/workflows/secrets-management.yaml | 26 +++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/secrets-management.yaml

diff --git a/.github/workflows/secrets-management.yaml b/.github/workflows/secrets-management.yaml
new file mode 100644
index 0000000..0797ee9
--- /dev/null
+++ b/.github/workflows/secrets-management.yaml
@@ -0,0 +1,26 @@
+
+---
+name: sync secrets
+on:   # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - engops_maintenance 
+permissions:
+  id-token: write
+  contents: read
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Login to Azure
+        uses: azure/login@v1
+        with:
+          client-id: ${{ vars.GH_APP_ORG_ENGOPS_MAINTENANCE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_SWI_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_ITSANDBOX_SUBSCRIPTION_ID }}
+      - name: 'set-org-secret'
+        run: |
+          echo "Syncing CODECOV_TOKEN ..."
+          SECRET="CODECOV_TOKEN"
+          SECRET_NAME="vividcortex--ewma--${SECRET//_/-}"
+          [ ! -z "${{ secrets.CODECOV_TOKEN }}" ] && az keyvault secret set --name "$SECRET_NAME" --vault-name "gh-scs" --value "${{ secrets.CODECOV_TOKEN }}"