name: Set Langfuse keys (self-verifying)

# Injects the Langfuse project API keys into the live Application's inline
# values, then proves chat still answers by driving POST /api/chat. Reverts
# automatically if it does not -- chat outranks tracing.

on:
  workflow_dispatch: {}

jobs:
  set-keys:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - name: Set keys, verify, self-revert on failure
        env:
          ARGOCD_PRACTICE_URL: ${{ secrets.ARGOCD_PRACTICE_URL }}
          ARGOCD_PRACTICE_PASSWORD: ${{ secrets.ARGOCD_PRACTICE_PASSWORD }}
          LANGFUSE_PUBLIC_KEY: ${{ secrets.LANGFUSE_PUBLIC_KEY }}
          LANGFUSE_SECRET_KEY: ${{ secrets.LANGFUSE_SECRET_KEY }}
        run: python3 .github/scripts/set_langfuse_keys.py