name: Download artifact
description: Download and decrypt an artifact.

inputs:
  name:
    description: 'The name of the artifact.'
    required: true
  path:
    description: 'Download to a specified path.'
    required: false
    default: ./
  encryptionSecret:
    description: 'The secret to use for decrypting the artifact.'
    required: true

runs:
  using: "composite"
  steps:
    - name: Install 7zip
      uses: ./.github/actions/setup_bazel_nix
      with:
        nixTools: |
          _7zz

    - name: Create temporary directory
      id: tempdir
      shell: bash
      run: echo "directory=$(mktemp -d)" >> "$GITHUB_OUTPUT"

    - name: Download the artifact
      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
      with:
        name: ${{ inputs.name }}
        path: ${{ steps.tempdir.outputs.directory }}

    - name: Decrypt and unzip archive
      shell: bash
      run: |
        mkdir -p ${{ inputs.path }}
        7zz x -p'${{ inputs.encryptionSecret }}' -bso0 -bsp0 -t7z -o"${{ inputs.path }}" ${{ steps.tempdir.outputs.directory }}/archive.7z