entrypoint.sh

#!/bin/sh
set -euo pipefail

# Mask certain variables from Github logs
echo "::add-mask::$TOWER_WORKSPACE_ID"
echo "::add-mask::$TOWER_API_ENDPOINT"
echo "::add-mask::$TOWER_ACCESS_TOKEN"
echo "::add-mask::$TOWER_COMPUTE_ENV"

# Unique per launch: all steps in a job share /github/workspace, so a name that
# collides makes one step's log (and error dump) include the others'.
LOG_FN="tower_action_$(date +'%Y_%m_%d-%H_%M')_$(uuidgen).log"
LOG_JSON="tower_action_"$(uuidgen)".json"

# EXIT trap so the scrub also runs when `tw launch` fails and `set -e` aborts.
scrub_secrets() {
    [ -n "${TOWER_ACCESS_TOKEN:-}" ] || return 0
    for f in "$LOG_FN" "$LOG_JSON"; do
        [ -f "$f" ] || continue
        sed -i "s|$TOWER_ACCESS_TOKEN|xxxxxx|g" "$f" || true
    done
}

# `tw` writes its errors to the log file, which is only cat'd on the success path.
# When the script aborts, print the (scrubbed) log so the reason for the failure is
# visible in the GitHub Actions log instead of only in the uploaded artifact.
on_exit() {
    STATUS=$?
    scrub_secrets
    if [ "$STATUS" -ne 0 ] && [ -f "$LOG_FN" ]; then
        echo "::error::Pipeline launch failed (exit code $STATUS) - Tower CLI log below"
        cat "$LOG_FN"
    fi
}
trap on_exit EXIT

# Manual curl of service-info
curl https://api.cloud.seqera.io/service-info >> $LOG_FN
echo -e "\n\n------\n\n" >> $LOG_FN

# Print the params input to a file
echo -e "$PARAMETERS" > params.json

# Print the pre-run script to a file
echo -e "$PRE_RUN_SCRIPT" > pre_run.sh

# Print the nextflow config  to a file
echo -e "$NEXTFLOW_CONFIG" > nextflow.config

# If wait is set to false then unset wait to disable waiting
if [ "$WAIT" = false ]; then unset WAIT; fi

# Verbose mode is opt-in: it makes the CLI log full request/response bodies
if [ "$VERBOSE" = false ]; then unset VERBOSE; fi

# Launch the pipeline
# We use capture the JSON as variable $OUT. We encode it as base64 to get around Github secrets filters but we still mask it anyway to make sure the details don't leak.
OUT=$(tw -o json ${VERBOSE:+"-v"} \
    launch \
    $PIPELINE \
    ${PARAMETERS:+"--params-file=params.json"} \
    ${WORKDIR:+"--work-dir=$WORKDIR"} \
    ${TOWER_COMPUTE_ENV:+"--compute-env=$TOWER_COMPUTE_ENV"} \
    ${REVISION:+"--revision=$REVISION"} \
    ${CONFIG_PROFILES:+"--profile=$CONFIG_PROFILES"} \
    ${RUN_NAME:+"--name=${RUN_NAME/:/_}"} \
    ${PRE_RUN_SCRIPT:+"--pre-run=pre_run.sh"} \
    ${NEXTFLOW_CONFIG:+"--config=nextflow.config"} \
    ${WAIT:+"--wait=$WAIT"} \
    2>> $LOG_FN | base64 -w 0)

# Base64 decode and extract specific value for output
export workflowId=$(echo $OUT | base64 -d | jq -r '.workflowId')
export workflowUrl=$(echo $OUT | base64 -d | jq -r '.workflowUrl')
export workspaceId=$(echo $OUT | base64 -d | jq -r '.workspaceId')
export workspaceRef=$(echo $OUT | base64 -d | jq -r '.workspaceRef')

# Hide the raw base64 blob from the logs for Github Actions. Not crucial but good practice.
echo "::add-mask::$OUT"

# We must remove quotes for the URL
WORKFLOW_URL=$(echo $workflowUrl | sed 's/"//g')

# Export to Github variables
echo "workflowId=$workflowId" >> $GITHUB_OUTPUT
echo "workflowUrl=$WORKFLOW_URL" >> $GITHUB_OUTPUT
echo "workspaceId=$workspaceId" >> $GITHUB_OUTPUT
echo "workspaceRef=$workspaceRef" >> $GITHUB_OUTPUT
echo "json='$(echo $OUT | base64 -d | jq -rc)'"  >> $GITHUB_OUTPUT

# Make the run easy to find: a clickable link in the job summary and a plain URL in the log
echo "🚀 Pipeline launched on Seqera Platform: $WORKFLOW_URL"
if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
    {
        echo "### 🚀 Pipeline launched on Seqera Platform"
        echo ""
        # Keep the run details out of the link text - workspaceRef contains square brackets
        echo "**[View the run in Seqera Platform]($WORKFLOW_URL)**"
        echo ""
        echo "- Workflow ID: \`$workflowId\`"
        echo "- Workspace: \`$workspaceRef\`"
        echo ""
    } >> "$GITHUB_STEP_SUMMARY"
fi

# Create output json file
echo $OUT | base64 -d > $LOG_JSON

scrub_secrets  # the trap fires after the cat below, so scrub here too

cat $LOG_FN