main.yml

name: Fetch Secrets from AWS Secrets Manager

on:
  workflow_dispatch:

permissions:
  id-token: write  
  contents: read

jobs:
  fetch-secrets:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Configure AWS credentials from OIDC
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: ${{ secrets.ROLE_ARN }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Fetch secret from AWS Secrets Manager
        id: fetch-secret
        run: |
          secret_value=$(aws secretsmanager get-secret-value --secret-id ${{ secrets.SECRET_NAME }} --query SecretString --output text)
          echo "::add-mask::$secret_value"
          echo "SECRET_VALUE=$secret_value" >> $GITHUB_ENV

      - name: Set up Python environment
        uses: actions/setup-python@v5 
        with:
          python-version: '3.10'

      - name: Run Python script with API secret
        run: python3 github-api.py
        env:
          API_SECRET: ${{ env.SECRET_VALUE }}