feat: migrate secrets to Infisical

.gitea/workflows/export-isac-data.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: shd-build-staging
+  group: shd-build-host-maintenance
   cancel-in-progress: false
 
 jobs:
@@ -25,15 +25,32 @@ jobs:
           compose() {
             docker compose --env-file "$deploy_environment" -f "$compose_file" "$@"
           }
-          restart_services() {
-            compose up -d --no-build app scheduler
-          }
-          trap restart_services EXIT
           snapshot_name="isac-stage-${GITHUB_RUN_ID}.json"
+          volume_snapshot="/app/data/exports/$snapshot_name"
+          remove_volume_snapshot=false
+          cleanup() {
+            exit_status=$?
+            trap - EXIT
+            if [ "$remove_volume_snapshot" = true ]; then
+              compose run --rm --no-deps app rm -f "$volume_snapshot" || true
+            fi
+            if ! compose up -d --no-build app scheduler; then
+              if [ "$exit_status" -eq 0 ]; then exit_status=1; fi
+            fi
+            exit "$exit_status"
+          }
+          trap cleanup EXIT
           compose stop scheduler app
-          compose run --rm --no-deps app node scripts/isac-data-export.mjs "/app/data/exports/$snapshot_name"
-          compose run --rm --no-deps -v "$GITHUB_WORKSPACE:/export" app \
-            cp "/app/data/exports/$snapshot_name" /export/isac-stage.json
+          app_container="$(compose ps --all --quiet app)"
+          if [ -z "$app_container" ]; then
+            echo "The stopped staging app container could not be found." >&2
+            exit 1
+          fi
+          remove_volume_snapshot=true
+          compose run --rm --no-deps app node scripts/isac-data-export.mjs "$volume_snapshot"
+          docker cp "$app_container:$volume_snapshot" "$GITHUB_WORKSPACE/isac-stage.json"
+          compose run --rm --no-deps app rm -f "$volume_snapshot"
+          remove_volume_snapshot=false
 
       - name: Publish ISAC snapshot
         uses: actions/upload-artifact@v3