render-doppler-sync.yml

name: Sync Doppler Secrets to Render

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  sync-secrets:
    runs-on: ubuntu-latest
    steps:
      - name: Fetch Secrets from Doppler
        id: doppler
        uses: DopplerHQ/secrets-fetch-action@v1.2.0
        with:
          doppler-token: ${{ secrets.DOPPLER_TOKEN }}

      - name: Push Secrets to Render
        env:
          RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
          RENDER_SERVICE_ID: ${{ secrets.RENDER_SERVICE_ID }}
        run: |
          # Convert Doppler's flat JSON to Render's required format: [{"envVar": {"key": "K", "value": "V"}}]
          echo '${{ steps.doppler.outputs.secrets }}' | jq '[to_entries | .[] | {"envVar": {"key": .key, "value": (.value | tostring)}}]' > payload.json
          
          echo "Pushing secrets to Render Service: ${RENDER_SERVICE_ID}..."
          
          curl -X PUT "https://api.render.com/v1/services/${RENDER_SERVICE_ID}/env-vars" \
               -H "Accept: application/json" \
               -H "Authorization: Bearer ${RENDER_API_KEY}" \
               -H "Content-Type: application/json" \
               -d @payload.json
          
          echo "Successfully synced Doppler secrets to Render."