From 5f75c73236d1a3846c7cd947eef4f6df06ad430b Mon Sep 17 00:00:00 2001
From: Steven Welch <steven@makeitwork.cloud>
Date: Thu, 27 Aug 2026 21:47:30 -0600
Subject: [PATCH 1/2] feat(opentofu): support Namecheap API key

---
 .github/workflows/opentofu.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/opentofu.yml b/.github/workflows/opentofu.yml
index 25f6ecd..7bc4169 100644
--- a/.github/workflows/opentofu.yml
+++ b/.github/workflows/opentofu.yml
@@ -36,6 +36,8 @@ on:
         required: false
       SSH_KNOWN_HOSTS:
         required: false
+      NAMECHEAP_API_KEY:
+        required: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -198,6 +200,8 @@ jobs:
           known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}
       - name: OpenTofu Plan
         id: plan
+        env:
+          NAMECHEAP_API_KEY: ${{ secrets.NAMECHEAP_API_KEY }}
         run: |
           set -o pipefail
           export SHELLOPTS
@@ -283,4 +287,6 @@ jobs:
           key: ${{ secrets.SSH_PRIVATE_KEY }}
           known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}
       - name: OpenTofu Apply
+        env:
+          NAMECHEAP_API_KEY: ${{ secrets.NAMECHEAP_API_KEY }}
         run: make apply

From f5cc93a80b569c73aa72bce15f6a20cae624300a Mon Sep 17 00:00:00 2001
From: Steven Welch <steven@makeitwork.cloud>
Date: Thu, 27 Aug 2026 21:47:49 -0600
Subject: [PATCH 2/2] docs(opentofu): document Namecheap secret mapping

---
 README.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/README.md b/README.md
index 16cd85d..b421989 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,21 @@ jobs:
     uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
 ```
 
+### Namecheap
+
+Only repositories that manage Namecheap resources should map their repository
+Actions secret into the reusable workflow secret:
+
+```yaml
+jobs:
+  opentofu:
+    uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
+    secrets:
+      NAMECHEAP_API_KEY: ${{ secrets.NAMECHEAP_API_KEY }}
+```
+
+Do not add this mapping for consumers that do not use Namecheap.
+
 ## Available Workflows
 
 | Workflow | Description |