action.yml

name: 'Setup wfctl'
description: 'Install the wfctl CLI tool for workflow engine operations'
inputs:
  version:
    description: 'wfctl version to install (e.g., "v0.3.51", "latest")'
    required: false
    default: 'latest'
  token:
    description: 'GitHub token for downloading releases'
    required: false
    default: ${{ github.token }}
  install-dir:
    description: 'Directory to install wfctl into. When set, sudo is not used and the directory is appended to GITHUB_PATH. Defaults to /usr/local/bin (existing behavior).'
    required: false
    default: ''
  update-timeout-seconds:
    description: 'Maximum time to allow an existing wfctl binary to self-update before falling back to release download.'
    required: false
    default: '300'
  skip-update:
    description: 'Set to true to skip wfctl update attempts when an existing binary does not match the requested version.'
    required: false
    default: 'false'
  download-timeout-seconds:
    description: 'Maximum time for each curl download request.'
    required: false
    default: '60'
  download-connect-timeout-seconds:
    description: 'Maximum time for curl to establish a connection.'
    required: false
    default: '30'
runs:
  using: 'composite'
  steps:
    - name: Determine version
      id: version
      shell: bash
      env:
        GH_TOKEN: ${{ inputs.token }}
      run: |
        set -euo pipefail
        if [ "${{ inputs.version }}" = "latest" ]; then
          auth_args=()
          if [ -n "${GH_TOKEN}" ]; then
            auth_args=(-H "Authorization: Bearer ${GH_TOKEN}")
          fi
          VERSION=$(curl -fsSL "${auth_args[@]}" \
            -H "Accept: application/vnd.github+json" \
            https://api.github.com/repos/GoCodeAlone/workflow/releases/latest |
            sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' |
            head -n 1)
        else
          VERSION="${{ inputs.version }}"
        fi
        if [ -z "${VERSION}" ]; then
          echo "::error::Unable to resolve wfctl version from GoCodeAlone/workflow releases" >&2
          exit 1
        fi
        echo "Resolved wfctl version: ${VERSION}"
        echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
    - name: Determine OS and arch
      id: platform
      shell: bash
      run: |
        OS=$(uname -s | tr '[:upper:]' '[:lower:]')
        ARCH=$(uname -m)
        case "$ARCH" in
          x86_64) ARCH="amd64" ;;
          aarch64|arm64) ARCH="arm64" ;;
        esac
        echo "os=${OS}" >> "$GITHUB_OUTPUT"
        echo "arch=${ARCH}" >> "$GITHUB_OUTPUT"
    - name: Resolve install directory
      id: install
      shell: bash
      run: |
        set -euo pipefail
        if [ -n "${{ inputs.install-dir }}" ]; then
          INSTALL_DIR="${{ inputs.install-dir }}"
          mkdir -p "${INSTALL_DIR}"
          INSTALL_DIR="$(cd "${INSTALL_DIR}" && pwd -P)"
          echo "install_dir=${INSTALL_DIR}" >> "$GITHUB_OUTPUT"
          echo "use_sudo=false" >> "$GITHUB_OUTPUT"
        else
          echo "install_dir=/usr/local/bin" >> "$GITHUB_OUTPUT"
          echo "use_sudo=true" >> "$GITHUB_OUTPUT"
        fi
    - name: Resolve cache path
      id: cache-path
      shell: bash
      run: |
        CACHE_ROOT="${RUNNER_TOOL_CACHE:-${RUNNER_TEMP}}/setup-wfctl"
        CACHE_DIR="${CACHE_ROOT}/${{ steps.version.outputs.version }}/${{ steps.platform.outputs.os }}-${{ steps.platform.outputs.arch }}"
        echo "dir=${CACHE_DIR}" >> "$GITHUB_OUTPUT"
        echo "bin=${CACHE_DIR}/wfctl" >> "$GITHUB_OUTPUT"
    - name: Reuse or update existing wfctl
      id: existing
      shell: bash
      env:
        TARGET_VERSION: ${{ steps.version.outputs.version }}
        UPDATE_TIMEOUT_SECONDS: ${{ inputs.update-timeout-seconds }}
        SKIP_UPDATE: ${{ inputs.skip-update }}
        REQUESTED_INSTALL_DIR: ${{ inputs.install-dir }}
        RESOLVED_INSTALL_DIR: ${{ steps.install.outputs.install_dir }}
      run: |
        set -euo pipefail

        current_version() {
          WFCTL_NO_UPDATE_CHECK=1 wfctl version 2>/dev/null | tr -d '[:space:]'
        }

        run_wfctl_update() {
          if command -v timeout >/dev/null 2>&1; then
            timeout "${UPDATE_TIMEOUT_SECONDS}s" env WFCTL_NO_UPDATE_CHECK=1 wfctl update
          else
            WFCTL_NO_UPDATE_CHECK=1 wfctl update
          fi
        }

        if ! existing_wfctl="$(command -v wfctl 2>/dev/null)"; then
          echo "No existing wfctl found on PATH; downloading ${TARGET_VERSION}."
          echo "use_existing=false" >> "$GITHUB_OUTPUT"
          exit 0
        fi

        existing_version="$(current_version || true)"
        if [ "${existing_version}" = "${TARGET_VERSION}" ]; then
          echo "Using existing wfctl ${TARGET_VERSION} from ${existing_wfctl}."
          echo "use_existing=true" >> "$GITHUB_OUTPUT"
          exit 0
        fi

        if [ "${SKIP_UPDATE}" = "true" ]; then
          echo "Found wfctl ${existing_version:-unknown} at ${existing_wfctl}; skipping wfctl update for pinned ${TARGET_VERSION}."
          echo "use_existing=false" >> "$GITHUB_OUTPUT"
          exit 0
        fi

        if [ -n "${REQUESTED_INSTALL_DIR}" ]; then
          existing_dir="$(cd "$(dirname "${existing_wfctl}")" && pwd -P)"
          install_dir="$(mkdir -p "${RESOLVED_INSTALL_DIR}" && cd "${RESOLVED_INSTALL_DIR}" && pwd -P)"
          if [ "${existing_dir}" != "${install_dir}" ]; then
            echo "Found wfctl ${existing_version:-unknown} at ${existing_wfctl}; requested install-dir is ${install_dir}, so skipping update of unrelated PATH binary."
            echo "use_existing=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
        fi

        if [ ! -w "${existing_wfctl}" ] || [ ! -w "$(dirname "${existing_wfctl}")" ]; then
          echo "Found wfctl ${existing_version:-unknown} at ${existing_wfctl}, but it is not writable by this runner; using release download for ${TARGET_VERSION}."
          echo "use_existing=false" >> "$GITHUB_OUTPUT"
          exit 0
        fi

        echo "Found wfctl ${existing_version:-unknown} at ${existing_wfctl}; attempting wfctl update for ${TARGET_VERSION}."
        if run_wfctl_update; then
          hash -r
          updated_version="$(current_version || true)"
          if [ "${updated_version}" = "${TARGET_VERSION}" ]; then
            echo "Updated existing wfctl to ${TARGET_VERSION}."
            echo "use_existing=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "wfctl update produced ${updated_version:-unknown}; expected ${TARGET_VERSION}. Falling back to release download."
        else
          echo "wfctl update failed or timed out. Falling back to release download."
        fi
        echo "use_existing=false" >> "$GITHUB_OUTPUT"
    - name: Cache wfctl
      if: steps.existing.outputs.use_existing != 'true'
      uses: actions/cache@v5
      id: cache
      with:
        path: ${{ steps.cache-path.outputs.dir }}
        key: wfctl-${{ steps.version.outputs.version }}-${{ steps.platform.outputs.os }}-${{ steps.platform.outputs.arch }}
    - name: Download wfctl
      if: steps.existing.outputs.use_existing != 'true' && steps.cache.outputs.cache-hit != 'true'
      shell: bash
      env:
        GH_TOKEN: ${{ inputs.token }}
        CURL_CONNECT_TIMEOUT_SECONDS: ${{ inputs.download-connect-timeout-seconds }}
        CURL_MAX_TIME_SECONDS: ${{ inputs.download-timeout-seconds }}
      run: |
        set -euo pipefail
        VERSION="${{ steps.version.outputs.version }}"
        OS="${{ steps.platform.outputs.os }}"
        ARCH="${{ steps.platform.outputs.arch }}"
        CACHE_DIR="${{ steps.cache-path.outputs.dir }}"
        CACHE_BIN="${{ steps.cache-path.outputs.bin }}"
        # Release assets use hyphen separators and are bare binaries (no .tar.gz)
        ASSET="wfctl-${OS}-${ARCH}"
        URL="https://github.com/GoCodeAlone/workflow/releases/download/${VERSION}/${ASSET}"
        CHECKSUMS_URL="https://github.com/GoCodeAlone/workflow/releases/download/${VERSION}/checksums.txt"
        echo "Downloading wfctl ${VERSION} for ${OS}/${ARCH}..."
        auth_args=()
        if [ -n "${GH_TOKEN}" ]; then
          auth_args=(-H "Authorization: token ${GH_TOKEN}")
        fi
        curl_args=(
          --fail
          --show-error
          --silent
          --location
          --connect-timeout "${CURL_CONNECT_TIMEOUT_SECONDS}"
          --max-time "${CURL_MAX_TIME_SECONDS}"
        )
        curl "${curl_args[@]}" "${auth_args[@]}" "${CHECKSUMS_URL}" -o /tmp/wfctl-checksums.txt
        expected_sha="$(awk -v asset="${ASSET}" '$2 == asset {print $1}' /tmp/wfctl-checksums.txt)"
        if [ -z "${expected_sha}" ]; then
          echo "::error::checksums.txt does not list ${ASSET} for ${VERSION}" >&2
          exit 1
        fi
        curl "${curl_args[@]}" "${auth_args[@]}" "${URL}" -o /tmp/wfctl
        if command -v sha256sum >/dev/null 2>&1; then
          actual_sha="$(sha256sum /tmp/wfctl | awk '{print $1}')"
        else
          actual_sha="$(shasum -a 256 /tmp/wfctl | awk '{print $1}')"
        fi
        if [ "${actual_sha}" != "${expected_sha}" ]; then
          echo "::error::wfctl checksum mismatch for ${ASSET}: expected ${expected_sha}, got ${actual_sha}" >&2
          exit 1
        fi
        echo "Verified wfctl ${VERSION} ${ASSET} sha256:${actual_sha}"
        mkdir -p "${CACHE_DIR}"
        mv /tmp/wfctl "${CACHE_BIN}"
        chmod +x "${CACHE_BIN}"
    - name: Install wfctl
      if: steps.existing.outputs.use_existing != 'true'
      shell: bash
      run: |
        set -euo pipefail
        CACHE_BIN="${{ steps.cache-path.outputs.bin }}"
        INSTALL_DIR="${{ steps.install.outputs.install_dir }}"
        if [ "${{ steps.install.outputs.use_sudo }}" = "true" ]; then
          sudo install -m 0755 "${CACHE_BIN}" "${INSTALL_DIR}/wfctl"
        else
          install -m 0755 "${CACHE_BIN}" "${INSTALL_DIR}/wfctl"
        fi
    - name: Add install directory to PATH
      if: steps.existing.outputs.use_existing != 'true'
      shell: bash
      run: echo "${{ steps.install.outputs.install_dir }}" >> "$GITHUB_PATH"
    - name: Verify installation
      shell: bash
      env:
        TARGET_VERSION: ${{ steps.version.outputs.version }}
        INSTALL_DIR: ${{ steps.install.outputs.install_dir }}
        USE_EXISTING: ${{ steps.existing.outputs.use_existing }}
      run: |
        set -euo pipefail
        if [ "${USE_EXISTING}" = "true" ]; then
          WFCTL_BIN="$(command -v wfctl)"
        else
          WFCTL_BIN="${INSTALL_DIR}/wfctl"
        fi
        actual_version="$(WFCTL_NO_UPDATE_CHECK=1 "${WFCTL_BIN}" version | tr -d '[:space:]')"
        if [ "${actual_version}" != "${TARGET_VERSION}" ]; then
          echo "::error::Expected wfctl ${TARGET_VERSION} from ${WFCTL_BIN}, got ${actual_version}" >&2
          exit 1
        fi
        echo "Verified wfctl ${actual_version} from ${WFCTL_BIN}"