From 3d34d5c5e15b30a9f196068a974455e89338e2e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?qwang1113=20=28=E7=8E=8B=E5=BC=BA=29?= <qwang@onekey.so>
Date: Sun, 31 May 2026 21:22:56 +0800
Subject: [PATCH] ci: add KMS fetch-and-decrypt verification workflow

Manual workflow_dispatch that exercises fetch-kms-secrets end-to-end
(OIDC -> STS -> KMS -> hybrid decrypt) and prints masked values + lengths
to confirm fetch/decrypt works downstream. uses: points at the fork for
verification; re-point to OneKeyHQ/actions before the upstream PR.
---
 .github/workflows/kms-fetch-verify.yml | 51 ++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 .github/workflows/kms-fetch-verify.yml

diff --git a/.github/workflows/kms-fetch-verify.yml b/.github/workflows/kms-fetch-verify.yml
new file mode 100644
index 000000000000..e1a6a18eb125
--- /dev/null
+++ b/.github/workflows/kms-fetch-verify.yml
@@ -0,0 +1,51 @@
+# End-to-end verification of the fetch-kms-secrets action:
+# GitHub OIDC -> Volcengine STS -> KMS GetSecretValue -> hybrid decrypt -> $GITHUB_ENV.
+# It only prints non-sensitive signals; every decrypted value is GitHub-masked (***).
+#
+# Triggers: manual dispatch (secret-names passed in) and push to this branch
+# (auto-verify, falling back to a hard-coded test secret name). The push trigger's
+# test name and the fork `uses:` are verification-only — drop them and re-point
+# `uses:` to OneKeyHQ/actions (pinned SHA) before the upstream PR.
+name: KMS Fetch Verify
+
+on:
+  workflow_dispatch:
+    inputs:
+      secret-names:
+        description: 'KMS secret name(s) to fetch, one per line — passed at run time'
+        required: true
+  push:
+    branches: [feat/kms-fetch-verify]
+    paths: ['.github/workflows/kms-fetch-verify.yml']
+
+permissions:
+  id-token: write # required so the runner can mint a GitHub OIDC token
+  contents: read
+
+jobs:
+  verify:
+    name: Fetch + decrypt + print (masked)
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Fetch secrets from KMS
+        id: kms
+        uses: qwang1113/actions/fetch-kms-secrets@feat/fetch-kms-secrets
+        with:
+          volc-account-id: ${{ vars.VOLC_ACCOUNT_ID }}
+          volc-role-trn: ${{ vars.VOLC_ROLE_TRN }}
+          volc-kms-region: ${{ vars.VOLC_KMS_REGION }}
+          secret-names: ${{ inputs['secret-names'] || 'test_access_key_name' }}
+          decrypt-private-key: ${{ secrets.KMS_DECRYPT_PRIVATE_KEY }}
+
+      - name: Print verification signals
+        env:
+          FETCHED_KEYS: ${{ steps.kms.outputs.fetched-keys }}
+        run: |
+          echo "fetched-keys (names only): $FETCHED_KEYS"
+          # For each decrypted key now in the job env, print the masked value plus
+          # its length. A non-zero length proves fetch + decrypt produced content;
+          # GitHub renders the value itself as *** because the action masked it.
+          for key in $(echo "$FETCHED_KEYS" | jq -r '.[]'); do
+            value="${!key}"
+            echo "  $key = $value  (length=${#value})"
+          done