test-positive-secret-2.yml

name: Test that encryption keys used
on:
#  # Uncomment when test added first time to register workflow and comment it back after workflow would be registered
#  #
#  # Added pull_request to register workflow from the PR.
#  # Read more https://stackoverflow.com/questions/63362126/github-actions-how-to-run-a-workflow-created-on-a-non-master-branch-from-the-wo
#  pull_request: {}
  workflow_dispatch: {}

jobs:
  setup:
    runs-on: ubuntu-latest
    steps:
      - name: Setup
        run: echo "Do setup"
    outputs:
      secret: kdsafh847382492

  test:
    runs-on: ubuntu-latest
    continue-on-error: true
    needs: [setup]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set outputs
        id: masked
        run: |
          echo '::add-mask::test'
          echo This is a test
          echo "masked-result=test" >> $GITHUB_OUTPUT
          echo "non-masked-result=example" >> $GITHUB_OUTPUT

      - uses: ./
        id: current
        with:
          secret: ${{ needs.setup.outputs.secret }}
          op: encode
          in: ${{ steps.masked.outputs.masked-result }}

    outputs:
      masked-result: "${{ steps.current.outputs.out }}"
      non-masked-result: "${{ steps.masked.outputs.non-masked-result }}"

  assert:
    runs-on: ubuntu-latest
    needs: [setup, test]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - uses: ./
        id: masked-result
        with:
          secret: ${{ needs.setup.outputs.secret }}
          op: decode
          in: ${{ needs.test.outputs.masked-result }}

      - uses: nick-fields/assert-action@v2
        with:
          expected: 'test'
          actual: "${{ steps. masked-result.outputs.out }}"

  teardown:
    runs-on: ubuntu-latest
    needs: [assert]
    if: ${{ always() }}
    steps:
      - name: Tear down
        run: echo "Do Tear down"