export-workspaces-as-dynamic.yaml

name: Export Plugins Workspaces as Dynamic
on:
  workflow_call:
    secrets:
      image-registry-password:
        description: Password to be used to push to container image registry
        required: false
    
    inputs:
      image-registry-user:
        description: User name to be used to push to container image registry
        type: string
        required: false

      node-version:
        description: node-version to execute the export
        type: string
        required: false
        default: ''

      janus-cli-version:
        description: Version of the janus-idp/cli package.
        type: string
        required: false
        default: ''

      cli-package:
        description: Alternative CLI package to use for plugin export instead of @janus-idp/cli.
        type: string
        required: false
        default: ""

      upload-project-on-error:
        description: Upload the complete project as a workflow artifact in case of error in order to troubleshoot.
        required: false
        type: boolean
        default: false
      
      workspace-path:
        description: Relative path of a single workspace on which the export workflow should be applied.
        required: false
        type: string

      overlay-branch:
        description: Branch of the overlay structure (current branch by default).
        type: string
        required: false
        default: ''

      overlay-repo:
        description: Repository of the overlay structure (`github.repository` by default).
        type: string
        required: false
        default: ''
  
      publish-container:
        description: Publish a container image for the dynamic plugins
        required: false
        default: false
        type: boolean

      image-repository-prefix:
        description: Repository prefix of the dynamic plugin container images
        type: string
        required: false
  
      image-tag-prefix:
        description: Optional prefix to prepend to the plugin version in the image tag
        type: string
        required: false
  
      last-publish-commit:
        description: Optional commit ID of the last successful publishing of plugin container images
        type: string
        required: false

    outputs:
      published-exports:
        value: '${{ jobs.export.outputs.published-exports }}'

      failed-exports:
        value: '${{ jobs.export.outputs.failed-exports }}'

      metadata-validation-passed:
        description: Whether the metadata validation passed (true/false)
        value: '${{ jobs.export.outputs.metadata-validation-passed }}'

      metadata-validation-errors:
        description: JSON array of metadata validation errors
        value: '${{ jobs.export.outputs.metadata-validation-errors }}'

      metadata-validation-error-count:
        description: Number of metadata validation errors found
        value: '${{ jobs.export.outputs.metadata-validation-error-count }}'
        
jobs:
  prepare:
    runs-on: ubuntu-latest

    name: Prepare
    outputs:
      node-version: ${{ steps.set-env-vars.outputs.NODE_VERSION }}
      janus-cli-version: ${{ steps.set-env-vars.outputs.JANUS_CLI_VERSION }}
      cli-package: ${{ steps.set-env-vars.outputs.CLI_PACKAGE }}
      backstage-version: ${{ steps.set-env-vars.outputs.BACKSTAGE_VERSION }}
      workspaces: ${{ steps.gather-workspaces.outputs.workspaces }}
      overlay-repo-ref: ${{ steps.set-overlay-repo-ref.outputs.OVERLAY_REPO_REF }}
      overlay-repo: ${{ steps.set-overlay-repo.outputs.OVERLAY_REPO }}

    steps:
      - name: Validate Inputs
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          INPUT_WORKSPACE_PATH: ${{ inputs.workspace-path }}
        with:
          script: |
            const workspacePath = core.getInput('workspace_path');
            if (workspacePath.startsWith('/') ||workspacePath.includes('..')) {
              core.setFailed(`Invalid workspace path: ${workspacePath}`);
            }

      - name: Set overlay_ref
        id: set-overlay-repo-ref
        env:
          INPUT_OVERLAY_BRANCH: ${{ inputs.overlay-branch }}
        run: |
          if [[ "${INPUT_OVERLAY_BRANCH}" != "" ]]
          then
            echo "OVERLAY_REPO_REF=${INPUT_OVERLAY_BRANCH}" >> $GITHUB_OUTPUT
          else
            echo "OVERLAY_REPO_REF=${{ github.head_ref || github.ref_name }}" >> $GITHUB_OUTPUT
          fi

      - name: Set overlay_repo
        id: set-overlay-repo
        env:
          INPUT_OVERLAY_REPO: ${{ inputs.overlay-repo }}
        run: |
          if [[ "${INPUT_OVERLAY_REPO}" != "" ]]
          then
            echo "OVERLAY_REPO=${INPUT_OVERLAY_REPO}" >> $GITHUB_OUTPUT
          else
            echo "OVERLAY_REPO=${{ github.repository }}" >> $GITHUB_OUTPUT
          fi
  
      - name: Checkout overlay repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ steps.set-overlay-repo-ref.outputs.OVERLAY_REPO_REF }}
          repository:  ${{ steps.set-overlay-repo.outputs.OVERLAY_REPO }}

      # github.job_workflow_sha is this reusable workflow's commit — do not use
      # GITHUB_WORKFLOW_REF (caller branch, e.g. overlays release-1.10). RHDHBUGS-3554
      - name: Checkout export-utils compatibility helpers
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: redhat-developer/rhdh-plugin-export-utils
          ref: ${{ github.job_workflow_sha }}
          path: _export-utils
          sparse-checkout: common/scripts/backstage-version-compatible.sh
          sparse-checkout-cone-mode: false

      - name: Set environment variables
        id: set-env-vars
        shell: bash {0}
        env:
          INPUT_NODE_VERSION: ${{ inputs.node-version }}
          INPUT_JANUS_CLI_VERSION: ${{ inputs.janus-cli-version }}
          INPUT_CLI_PACKAGE: ${{ inputs.cli-package }}
        run: |
          versions=$(cat versions.json)

          NODE_VERSION=$(echo ${versions} | jq -r "if (\"${INPUT_NODE_VERSION}\" == \"\") then (.node // \"20.x\") else \"${INPUT_NODE_VERSION}\" end")
          echo "NODE_VERSION=${NODE_VERSION}" >> $GITHUB_OUTPUT

          JANUS_CLI_VERSION=$(echo ${versions} | jq -r "if (\"${INPUT_JANUS_CLI_VERSION}\" == \"\") then (.cli // \"^3.0.0\") else \"${INPUT_JANUS_CLI_VERSION}\" end")
          echo "JANUS_CLI_VERSION=$JANUS_CLI_VERSION" >> $GITHUB_OUTPUT

          CLI_PACKAGE=$(echo ${versions} | jq -r "if (\"${INPUT_CLI_PACKAGE}\" == \"\") then (.\"cliPackage\" // \"@janus-idp/cli\") else \"${INPUT_CLI_PACKAGE}\" end")
          echo "CLI_PACKAGE=$CLI_PACKAGE" >> $GITHUB_OUTPUT

          BACKSTAGE_VERSION=$(echo ${versions} | jq -r ".backstage")
          echo "BACKSTAGE_VERSION=$BACKSTAGE_VERSION" >> $GITHUB_OUTPUT

      - name: Install semver
        run: npm install semver -g

      - name: Gather workspaces
        id: gather-workspaces
        shell: bash
        env:
          INPUT_WORKSPACE_PATH: ${{ inputs.workspace-path }}
          OVERLAY_REPO: ${{ steps.set-overlay-repo.outputs.OVERLAY_REPO }}
          OVERLAY_REPO_REF: ${{ steps.set-overlay-repo-ref.outputs.OVERLAY_REPO_REF }}
          TARGET_BACKSTAGE_VERSION: ${{ steps.set-env-vars.outputs.BACKSTAGE_VERSION }}
        run: |
          if [[ "${OVERLAY_REPO}" != "${{ github.repository }}" ]]; then
            echo "Exporting overlay workspaces from branch \`${OVERLAY_REPO_REF}\` of repository \`${OVERLAY_REPO}\`"
          else
            echo "Exporting overlay workspaces from branch \`${OVERLAY_REPO_REF}\`"
          fi
          echo ""

          # shellcheck source=common/scripts/backstage-version-compatible.sh
          source _export-utils/common/scripts/backstage-version-compatible.sh

          workspacePath=''
          if [[ "${INPUT_WORKSPACE_PATH}" != "" ]]
          then
            workspacePath="${INPUT_WORKSPACE_PATH}"
          elif [[ "${{ github.head_ref }}" == "workspaces/"* ]]
          then
            workspacePath="$(echo '${{ github.head_ref }}' | sed -e 's:workspaces/[^_]*__\(.*\)$:workspaces/\1:')"
          fi

          json=$(
            echo -n '['
            for d in $(find workspaces  -mindepth 1 -maxdepth 1 -type d)
            do
              if [[ "${workspacePath}" != "" ]] && [[ "${workspacePath}" != "$d" ]]
              then
                continue
              fi

              if [[ -f "${d}/plugins-list.yaml" ]] && [[ -f "${d}/source.json" ]]
              then
                workspace=$(jq -c ". | with_entries(.key = \"plugins-\(.key)\" ) | . += { \"overlay-root\": \"${d}\", \"plugins-root\": (if .\"plugins-repo-flat\" then \".\" else \"${d}\" end)}" ${d}/source.json)
                workspace=$(echo "${workspace}" | sed -e 's;https://github.com/;;')

                # Effective backstage version for this workspace:
                # overlay backstage.json override takes priority over source.json
                workspaceBackstageVersion=$(jq -r '.["repo-backstage-version"] // empty' "${d}/source.json")
                if [[ -f "${d}/backstage.json" ]]
                then
                  workspaceBackstageVersion=$(jq -r '.version' "${d}/backstage.json")
                fi

                # Use bs_<target>__ prefix only for same major.minor (exact).
                # Best-effort (older minor) workspaces keep next__ until overridden.
                wsTagPrefix="next__"
                if [[ "${workspaceBackstageVersion}" != "" ]] && \
                   backstage_versions_minor_match "${workspaceBackstageVersion}" "${TARGET_BACKSTAGE_VERSION}"
                then
                  wsTagPrefix="bs_${TARGET_BACKSTAGE_VERSION}__"
                fi

                workspace=$(echo "${workspace}" | jq -c ". += {\"computed-image-tag-prefix\": \"${wsTagPrefix}\"}")
                echo -n "${comma} ${workspace}"
                comma=','
              fi
            done
            echo -n ']'
          )
          echo "Workspaces to export:"
          echo "$json"

          if [[ "$json" == "[]" ]]
          then
            echo ::error title=No workspaces to export::No workspace has been found to run the workflow on.
            exit 1
          fi

          echo "workspaces=${json}" >> $GITHUB_OUTPUT
  export:
    name: Export ${{ matrix.workspace.overlay-root }}
    needs: prepare
    uses: redhat-developer/rhdh-plugin-export-utils/.github/workflows/export-dynamic.yaml@main
    strategy:
      fail-fast: false
      matrix:
        workspace: ${{ fromJSON(needs.prepare.outputs.workspaces) }}

    with:
      plugins-repo: ${{ matrix.workspace.plugins-repo }}
      plugins-repo-ref: ${{ matrix.workspace.plugins-repo-ref }}
      plugins-repo-backstage-version: ${{ matrix.workspace.plugins-repo-backstage-version }}
      plugins-root: ${{ matrix.workspace.plugins-root }}
      overlay-repo: ${{ needs.prepare.outputs.overlay-repo }}
      overlay-repo-ref: ${{ needs.prepare.outputs.overlay-repo-ref }}
      overlay-root: ${{ matrix.workspace.overlay-root }}
      node-version: ${{ needs.prepare.outputs.node-version }}
      janus-cli-version: ${{ needs.prepare.outputs.janus-cli-version }}
      cli-package: ${{ needs.prepare.outputs.cli-package }}
      upload-project-on-error: ${{ inputs.upload-project-on-error }}
      publish-container: ${{ inputs.publish-container }}
      image-repository-prefix: ${{ inputs.image-repository-prefix }}
      image-tag-prefix: ${{ inputs.image-tag-prefix != '' && inputs.image-tag-prefix || matrix.workspace.computed-image-tag-prefix }}
      computed-image-tag-prefix: ${{ matrix.workspace.computed-image-tag-prefix }}
      target-backstage-version: ${{ needs.prepare.outputs.backstage-version }}
      last-publish-commit: ${{ inputs.last-publish-commit }}
      image-registry-user: ${{ inputs.image-registry-user }}

    secrets:
      image-registry-password: ${{ secrets.image-registry-password }}

    permissions:
      contents: write
      packages: write
      attestations: write
      id-token: write