#!/usr/bin/env ruby

# frozen_string_literal: true

require "octokit"
require "git_helpers"

# High level flow:

# Get max secret_lifetime (in days?)

# Loop over vault applications

# Loop over secrets in each application (how intense is this? will we need to rate-limit?)

# For each secret, grab from the metadata the last-modified timestamp (details forthcoming)

# Compare the last-modified timestamp to current timestamp, if age is > secret_lifetime, secret needs to be rolled
  # Add the application/secret to a list of secrets that need to be rotated

# Exit loop

# Possible section here where we try to ascertain ownership of the cred -- service catalog? based on the application name alone?

# Loop over each secret that needs to be rotated:

# Look for issues with the name "[application/secret] needs to be rotated"

# If it exists, skip, possibly add some periodic reminder (will need to figure out what our auditing/turnaround will be for this short and longterm -- shortterm will be pretty hairy)

# If not, create an issue using the template in this repo with the above name
