feat(infra): import also project secrets

.gitea/workflows/deploy-infrastructure.yml

@@ -19,6 +19,9 @@ on:
       infisical_cicd_token:
         description: "Infisical Service Token for CI/CD secrets"
         required: true
+      infisical_project_token:
+        description: "Infisical Service Token for project-specific secrets"
+        required: false
 
 jobs:
   deploy-to-proxmox:
@@ -48,7 +51,6 @@ jobs:
 
       - name: Fetch secrets from Infisical
         run: |
-          export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
           export INFISICAL_API_URL="${{ inputs.infisical_api_url || 'https://app.infisical.com' }}"
           export INFISICAL_DOMAIN="$INFISICAL_API_URL"
           export INFISICAL_DISABLE_UPDATE_CHECK=true
@@ -58,8 +60,14 @@ jobs:
             INFISICAL_ENV="${{ gitea.ref_name }}"
           fi
 
-          # Fetch all secrets in JSON format
-          echo "Exporting all secrets from Infisical..."
+          fetch_secrets() {
+            local token="$1"
+            if [ -z "$token" ]; then
+              return 0
+            fi
+
+            export INFISICAL_TOKEN="$token"
+            echo "Exporting secrets from Infisical..."
             infisical export --env="$INFISICAL_ENV" --format=json > secrets.json
             if [ $? -ne 0 ]; then
               echo "Error: Failed to fetch secrets from Infisical." >&2
@@ -89,6 +97,19 @@ jobs:
             done < <(jq -j 'if type == "array" then .[] | (.key, "\u0000", .value, "\u0000") else to_entries[] | (.key, "\u0000", .value, "\u0000") end' secrets.json)
 
             rm -f secrets.json
+          }
+
+          # Fetch general CI/CD secrets first
+          fetch_secrets "${{ secrets.infisical_cicd_token }}"
+
+          # Optionally fetch project-specific secrets
+          PROJECT_TOKEN="${{ secrets.infisical_project_token }}"
+          if [ -n "$PROJECT_TOKEN" ]; then
+            echo "Fetching project-specific secrets from Infisical..."
+            fetch_secrets "$PROJECT_TOKEN"
+          else
+            echo "No project-specific secrets token provided. Skipping."
+          fi
 
       - name: Verify Secrets
         run: |