Add scoped Cloudflare token secret helper

scripts/fj-set-cloudflare-token-secret.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${root}"
+
+host="${EVERY_CHANNEL_FORGE_HOST:-https://git.every.channel}"
+repo="${EVERY_CHANNEL_FORGE_REPO:-every-channel/every.channel}"
+secret_name="${EVERY_CHANNEL_FORGE_CLOUDFLARE_SECRET_NAME:-CLOUDFLARE_API_TOKEN}"
+token_file="${1:-}"
+
+token="${CLOUDFLARE_API_TOKEN:-}"
+if [[ -z "${token}" && -n "${token_file}" ]]; then
+  if [[ ! -f "${token_file}" ]]; then
+    echo "error: token file not found: ${token_file}" >&2
+    exit 2
+  fi
+  token="$(<"${token_file}")"
+fi
+if [[ -z "${token}" && ! -t 0 ]]; then
+  token="$(cat)"
+fi
+token="$(printf '%s' "${token}" | tr -d '\r\n')"
+
+if [[ -z "${token}" ]]; then
+  echo "error: provide CLOUDFLARE_API_TOKEN, a token file path, or token on stdin" >&2
+  exit 2
+fi
+
+if ! command -v fj >/dev/null 2>&1; then
+  echo "error: fj not found in PATH (run: nix develop)" >&2
+  exit 2
+fi
+
+"${root}/scripts/fj-auth-forge.sh" >/dev/null
+
+# Upsert by delete/create because fj currently exposes create/delete.
+fj -H "${host}" actions -r "${repo}" secrets delete "${secret_name}" >/dev/null 2>&1 || true
+fj -H "${host}" actions -r "${repo}" secrets create "${secret_name}" "${token}" >/dev/null
+
+echo "ok: set ${secret_name} on ${repo} via ${host}"