Managed by Terraform

Author: tfin-admin

.github/workflows/export-secrets.yml

@@ -1,12 +1,14 @@
 # .github/workflows/export-secrets.yml
 name: Export Repository Secrets to AWS Secrets Manager
 on: 
+  push:
+    branches:
+      - migration_export
   workflow_dispatch:
     inputs:
       migration_id:
         description: 'Migration ID for grouping'
-        required: true
-        default: 'migration-2025'
+        required: false
 
 jobs:
   discover-environments:
@@ -17,15 +19,31 @@ jobs:
       id-token: write
     outputs:
       environments: ${{ steps.get-envs.outputs.environments }}
+      should_run: ${{ steps.check-migration.outputs.should_run }}
     steps:
+      - name: Check Migration ID
+        id: check-migration
+        run: |
+          MIGRATION_ID="${{ inputs.migration_id }}"
+          if [ -z "$MIGRATION_ID" ] || [ "$MIGRATION_ID" = "null" ]; then
+            echo "🔕 No migration_id provided - workflow triggered by push or empty input. Skipping export."
+            echo "To export secrets, run this workflow manually with a migration_id."
+            echo "should_run=false" >> $GITHUB_OUTPUT
+          else
+            echo "🚀 Migration ID: $MIGRATION_ID"
+            echo "should_run=true" >> $GITHUB_OUTPUT
+          fi
+          
       - name: Configure AWS Credentials
+        if: steps.check-migration.outputs.should_run == 'true'
         uses: aws-actions/configure-aws-credentials@v4
         with:
           role-to-assume: arn:aws:iam::094104989819:role/GithubActions
           role-session-name: github-secrets-export-discovery-${{ github.run_id }}
           aws-region: us-east-1
 
       - name: Discover Environments
+        if: steps.check-migration.outputs.should_run == 'true'
         id: get-envs
         env:
           GITHUB_TOKEN: ${{ secrets.MIGRATION_TOKEN || secrets.GITHUB_TOKEN }}
@@ -148,6 +166,7 @@ jobs:
       actions: read
       id-token: write
     needs: discover-environments
+    if: needs.discover-environments.outputs.should_run == 'true'
 
     steps:
       - name: Configure AWS Credentials