Enhance Windows config step with secrets handling

.github/workflows/build.yml

@@ -32,6 +32,7 @@ jobs:
       - name: Set configs
         run: |
           cp config_default.h config.h
+          cp secret_default.h secret.h
 
       - name: Compile Arduino project
         run: |

.github/workflows/deployment.yml

@@ -28,10 +28,47 @@ jobs:
 
       - name: Set configs (Windows)
         shell: powershell
-        run: |
-          $env:CONFIG_H | Out-File -Encoding ascii config.h
         env:
-          CONFIG_H: ${{ secrets.CONFIG_H }}
+          SECRETS_SHARE_PATH: ${{ secrets.SECRETS_SHARE_PATH }}
+          SECRETS_SHARE_USER: ${{ secrets.SECRETS_SHARE_USER }}
+          SECRETS_SHARE_PASS: ${{ secrets.SECRETS_SHARE_PASS }}
+          SECRETS_REPO_NAME:  ${{ secrets.SECRETS_REPO_NAME }}
+          DEVICE_NAME:        LSSensor
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $secretsDir = Join-Path $env:RUNNER_TEMP 'secrets'
+          $mounted = $false
+
+          try {
+              # Mount SMB share with read-only credentials
+              & net.exe use 'Z:' $env:SECRETS_SHARE_PATH /user:$env:SECRETS_SHARE_USER $env:SECRETS_SHARE_PASS | Out-Null
+              if ($LASTEXITCODE -ne 0) { throw "Failed to mount SMB share (exit $LASTEXITCODE)" }
+              $mounted = $true
+
+              # Clone Configuration repo from the share
+              if (Test-Path $secretsDir) { Remove-Item $secretsDir -Recurse -Force }
+              $repoSource = if ($env:SECRETS_REPO_NAME) { "Z:\$env:SECRETS_REPO_NAME" } else { 'Z:\' }
+              git clone --depth=1 $repoSource $secretsDir
+              if ($LASTEXITCODE -ne 0) { throw "git clone failed (exit $LASTEXITCODE)" }
+
+              # Run per-device deploy script
+              $deployScript = Join-Path $secretsDir "$env:DEVICE_NAME\deploy.ps1"
+              if (-not (Test-Path $deployScript)) { throw "deploy.ps1 not found at $deployScript" }
+
+              & $deployScript -OutputDir $env:GITHUB_WORKSPACE
+              if ($LASTEXITCODE -ne 0) { throw "deploy.ps1 failed (exit $LASTEXITCODE)" }
+          }
+          finally {
+              # Always clean up - whether the try block succeeded, threw, or was interrupted
+              if (Test-Path $secretsDir) {
+                  Remove-Item $secretsDir -Recurse -Force -ErrorAction SilentlyContinue
+              }
+              if ($mounted) {
+                  & net.exe use 'Z:' /delete /yes | Out-Null
+              }
+              # cleanup is best-effort; do not fail the step on a stale exit code
+              $global:LASTEXITCODE = 0
+          }
 
       - name: Compile Arduino project
         run: |

LSSensor.ino

@@ -2,6 +2,7 @@
 #include <MQTTClient.h>
 #include <SoftwareSerial.h>
 #include "config.h"
+#include "secret.h"
 #include <avr/wdt.h>
 
 #define LSSensorPIN1 2

config_default.h

@@ -1,9 +1 @@
-#define WifiSSID "WifiSSID"
-#define WifiPassword "WifiPassword"
-#define MQTTUsername "MQTTUsername"
-
-#define MQTTPassword "MQTTPassword"
-
-#define MQTTHost "MQTTHost"
-
-#define ELCONSUMPTION "ELCONSUMPTION"
+#define ELCONSUMPTION "ELCONSUMPTION"

secret_default.h

@@ -0,0 +1,5 @@
+#define WifiSSID "WifiSSID"
+#define WifiPassword "WifiPassword"
+#define MQTTUsername "MQTTUsername"
+#define MQTTPassword "MQTTPassword"
+#define MQTTHost "MQTTHost"