name: Download artifact
description: Download and decrypt an artifact.

inputs:
  name:
    description: 'The name of the artifact.'
    required: true
  path:
    description: 'Download to a specified path.'
    required: false
    default: ./
  encryptionSecret:
    description: 'The secret to use for decrypting the artifact.'
    required: true

runs:
  using: "composite"
  steps:
    - name: Install unzip
      uses: ./.github/actions/setup_bazel_nix
      with:
        nixTools: |
          unzip

    - name: Create temporary directory
      id: tempdir
      shell: bash
      run: echo "directory=$(mktemp -d)" >> "$GITHUB_OUTPUT"

    - name: Download the artifact
      uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe # v4.1.2
      with:
        name: ${{ inputs.name }}
        path: ${{ steps.tempdir.outputs.directory }}

    - name: Decrypt and unzip archive
      shell: bash
      run: |
        mkdir -p ${{ inputs.path }}
        unzip -P '${{ inputs.encryptionSecret }}' -qq -d ${{ inputs.path }} ${{ steps.tempdir.outputs.directory }}/archive.zip