auto-publish-pr.yaml

name: Auto-Publish PR
on:
  workflow_call:
    inputs:
      pr-number:
        type: string
        required: true

jobs:
  prepare:
    runs-on: ubuntu-latest
    name: Prepare PR data
    outputs:
      target-branch: ${{ steps.get-branch.outputs.target-branch }}
      overlay-branch: ${{ steps.get-branch.outputs.overlay-branch }}
      overlay-repo: ${{ steps.get-branch.outputs.overlay-repo }}
      overlay-commit: ${{ steps.get-branch.outputs.overlay-commit }}
      workspace: ${{ steps.get-branch.outputs.workspace }}
      pr-number: ${{ steps.get-branch.outputs.pr-number }}
      image-repository-prefix: ${{ steps.get-branch.outputs.image-repository-prefix }}

    permissions:
      statuses: write

    steps:
      - name: Get PR branch data
        id: get-branch
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_PR_NUMBER: ${{ inputs.pr-number }}
        with:
          script: |
            const prNumber = Number(core.getInput('pr_number'));
            const currentPullRequest = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: prNumber
            });
            const targetBranch = currentPullRequest.data.base.ref;
            core.setOutput('target-branch', targetBranch);
            const prBranch = currentPullRequest.data.head.ref;
            core.setOutput('overlay-branch', prBranch);
            const prRepo = currentPullRequest.data.head.repo.full_name;
            core.setOutput('overlay-repo', prRepo);
            core.setOutput('pr-number', prNumber);
            const prCommit = currentPullRequest.data.head.sha;
            core.setOutput('overlay-commit', prCommit);
            let workspace = '';

            const matches = prBranch.match(/^workspaces\/release-.+__(.+)$/);
            if (matches && matches.length == 2) {
              workspace = `workspaces/${matches[1]}`;
            } else {
              const prFiles = await github.rest.pulls.listFiles({
                owner: context.repo.owner,
                repo: context.repo.repo,
                pull_number: prNumber
              });
              const workspaces = [ ... new Set(prFiles.data
                .map(f => f.filename.match(/^workspaces\/([^\/]+)\/.*/))
                .filter(match => match)
                .map(match => match[1])
              )];
              if (workspaces.length === 1) {
                workspace = `workspaces/${workspaces[0]}`;
              }
            }
            core.setOutput('workspace', workspace);
            if (workspace === '') {
              core.warning(`PR #${prNumber} does not touch exactly 1 workspace — skipping publish`);
              return;
            }

            const workflowRun = await github.rest.actions.getWorkflowRun({
              owner: context.repo.owner,
              repo: context.repo.repo,
              run_id: '${{ github.run_id }}',
            });
            await github.rest.repos.createCommitStatus({
              owner: context.repo.owner,
              repo: context.repo.repo,
              sha: prCommit,
              description: 'publish',
              state: 'pending',
              target_url: workflowRun.data.html_url,
              context: 'publish',
            });

            core.setOutput('image-repository-prefix',
              `ghcr.io/${context.repo.owner}/${context.repo.repo}`.toLowerCase());

  check-up-to-date:
    name: Check versions.json is up-to-date
    needs: prepare
    if: needs.prepare.outputs.workspace != ''
    runs-on: ubuntu-latest

    permissions:
      pull-requests: write

    steps:
      - name: Compare versions.json with base branch
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_TARGET_BRANCH: ${{ needs.prepare.outputs.target-branch }}
          INPUT_OVERLAY_BRANCH: ${{ needs.prepare.outputs.overlay-branch }}
          INPUT_OVERLAY_REPO: ${{ needs.prepare.outputs.overlay-repo }}
          INPUT_PR_NUMBER: ${{ needs.prepare.outputs.pr-number }}
        with:
          script: |
            const prNumber = Number(core.getInput('pr_number'));
            const path = 'versions.json';
            const releaseBranch = core.getInput('target_branch');
            if (! releaseBranch?.startsWith('release-') && ! releaseBranch?.startsWith('main') ) {
              core.notice(`Current PR is not based on a release branch.`);
              return;
            }
            const { data: sourceFile } = await github.rest.repos.getContent({
              owner: context.repo.owner,
              repo: context.repo.repo,
              path,
              ref: releaseBranch,
            });
            if (!('type' in sourceFile) || sourceFile.type !== 'file') {
              core.setFailed(`\`${path}\` is not a file on branch \`${releaseBranch}\``);
              return;
            }
            const sourceContent = Buffer.from(
              sourceFile.content,
              (Buffer.isEncoding(sourceFile.encoding) ? sourceFile.encoding : 'utf-8')
            ).toString('utf-8');

            const prRepository = core.getInput('overlay_repo');
            const prBranch = core.getInput('overlay_branch');
            const owner = prRepository.split('/')[0];
            const repo = prRepository.split('/')[1];
            const { data: targetFile } = await github.rest.repos.getContent({
              owner,
              repo,
              path,
              ref: prBranch,
            });
            if (!('type' in targetFile) || targetFile.type !== 'file') {
              core.warning(`\`${path}\` is not a file on branch ${prBranch}`);
              return;
            }
            const targetContent = Buffer.from(
              targetFile.content,
              (Buffer.isEncoding(targetFile.encoding) ? targetFile.encoding : 'utf-8')
            ).toString('utf-8');

            if (sourceContent !== targetContent) {
              core.setFailed(`PR not up-to-date with the release branch`);
              const body = `The \`versions.json\` file in your PR doesn't match the one in release branch ${releaseBranch}\nTry updating it by adding the \`/update-versions\` PR comment.`;
              await github.rest.issues.createComment({
                issue_number: prNumber,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: body
              });
            }

  detect-changes:
    name: Detect change scope
    needs: prepare
    if: needs.prepare.outputs.workspace != ''
    runs-on: ubuntu-latest
    outputs:
      only-metadata-changed: ${{ steps.check.outputs.only-metadata-changed }}
    steps:
      - name: Check if only metadata files changed
        id: check
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_WORKSPACE: ${{ needs.prepare.outputs.workspace }}
          INPUT_PR_NUMBER: ${{ needs.prepare.outputs.pr-number }}
        with:
          script: |
            const prNumber = Number(core.getInput('pr_number'));
            const prFiles = await github.rest.pulls.listFiles({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: prNumber,
            });
            const workspace = core.getInput('workspace');
            const metadataPrefix = `${workspace}/metadata/`;
            const onlyMetadata = prFiles.data.length > 0 &&
              prFiles.data.every(f => f.filename.startsWith(metadataPrefix));
            core.setOutput('only-metadata-changed', String(onlyMetadata));
            core.info(`Only metadata changed: ${onlyMetadata}`);
            if (onlyMetadata) {
              core.info('Build will be skipped - only metadata files were modified.');
            }

  validate-metadata-only:
    name: Validate metadata (metadata-only change)
    needs:
      - prepare
      - detect-changes
    if: |
      needs.prepare.outputs.workspace != '' &&
      needs.detect-changes.outputs.only-metadata-changed == 'true'
    runs-on: ubuntu-latest

    outputs:
      metadata-validation-passed: ${{ steps.validate-metadata.outputs.validation-passed }}
      metadata-validation-errors: ${{ steps.validate-metadata.outputs.validation-errors }}
      metadata-validation-error-count: ${{ steps.validate-metadata.outputs.validation-error-count }}

    steps:
      - name: Checkout overlay repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ needs.prepare.outputs.overlay-repo }}
          ref: ${{ needs.prepare.outputs.overlay-branch }}
          path: overlay-repo

      - name: Read source configuration
        id: source-config
        env:
          WORKSPACE: ${{ needs.prepare.outputs.workspace }}
        run: |
          source_json=$(cat "overlay-repo/${WORKSPACE}/source.json")
          plugins_repo=$(echo "${source_json}" | jq -r '.repo' | sed 's;https://github.com/;;')
          plugins_repo_ref=$(echo "${source_json}" | jq -r '."repo-ref"')
          plugins_repo_flat=$(echo "${source_json}" | jq -r '."repo-flat" // false')
          if [[ "${plugins_repo_flat}" == "true" ]]; then
            plugins_root="."
          else
            plugins_root="${WORKSPACE}"
          fi
          echo "plugins-repo=${plugins_repo}" >> $GITHUB_OUTPUT
          echo "plugins-repo-ref=${plugins_repo_ref}" >> $GITHUB_OUTPUT
          echo "plugins-root=${plugins_root}" >> $GITHUB_OUTPUT

          backstage_version=$(jq -r '.backstage' overlay-repo/versions.json)
          echo "backstage-version=${backstage_version}" >> $GITHUB_OUTPUT

          node_version=$(jq -r '.node' overlay-repo/versions.json)
          echo "node-version=${node_version}" >> $GITHUB_OUTPUT

      - name: Checkout plugins repository (flat)
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        if: steps.source-config.outputs.plugins-root == '.'
        with:
          repository: ${{ steps.source-config.outputs.plugins-repo }}
          ref: ${{ steps.source-config.outputs.plugins-repo-ref }}
          path: source-repo

      - name: Checkout plugins repository (workspace)
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        if: steps.source-config.outputs.plugins-root != '.'
        with:
          repository: ${{ steps.source-config.outputs.plugins-repo }}
          ref: ${{ steps.source-config.outputs.plugins-repo-ref }}
          sparse-checkout: |
            ${{ steps.source-config.outputs.plugins-root }}
          sparse-checkout-cone-mode: false
          path: source-repo

      - name: Setup Node.js ${{ steps.source-config.outputs.node-version }}
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: ${{ steps.source-config.outputs.node-version }}

      - name: Validate Catalog Metadata
        id: validate-metadata
        uses: redhat-developer/rhdh-plugin-export-utils/validate-metadata@main
        with:
          overlay-root: ${{ github.workspace }}/overlay-repo/${{ needs.prepare.outputs.workspace }}
          plugins-root: ${{ github.workspace }}/source-repo/${{ steps.source-config.outputs.plugins-root }}
          target-backstage-version: ${{ steps.source-config.outputs.backstage-version }}
          image-repository-prefix: ${{ needs.prepare.outputs.image-repository-prefix }}

  export:
    name: Publish PR Dynamic Plugin Images
    needs:
      - prepare
      - check-up-to-date
      - detect-changes
    if: |
      always() &&
      needs.prepare.result == 'success' &&
      needs.prepare.outputs.workspace != '' &&
      (needs.check-up-to-date.result == 'success' || needs.check-up-to-date.result == 'skipped') &&
      needs.detect-changes.outputs.only-metadata-changed != 'true'

    uses: redhat-developer/rhdh-plugin-export-utils/.github/workflows/export-workspaces-as-dynamic.yaml@main
    with:
      overlay-branch: ${{ needs.prepare.outputs.overlay-branch }}
      overlay-repo: ${{ needs.prepare.outputs.overlay-repo }}
      workspace-path: ${{ needs.prepare.outputs.workspace }}
      publish-container: true
      image-repository-prefix: ${{ needs.prepare.outputs.image-repository-prefix }}
      image-tag-prefix: ${{ format('pr_{0}__', needs.prepare.outputs.pr-number) }}
      image-registry-user: ${{ github.actor }}

    secrets:
      image-registry-password: ${{ secrets.GITHUB_TOKEN }}

    permissions:
      contents: write
      attestations: write
      packages: write
      id-token: write

  check-backstage-compatibility:
    name: Check workspace backstage compatibility
    needs:
      - prepare
      - detect-changes
    if: |
      needs.prepare.outputs.workspace != '' &&
      needs.detect-changes.outputs.only-metadata-changed != 'true'

    uses: redhat-developer/rhdh-plugin-export-utils/.github/workflows/check-backstage-compatibility.yaml@main
    with:
      overlay-branch: ${{ needs.prepare.outputs.overlay-branch }}
      overlay-repo: ${{ needs.prepare.outputs.overlay-repo }}
      workspace-path: ${{ needs.prepare.outputs.workspace }}
      artifact-name-suffix: -pr-${{ needs.prepare.outputs.pr-number }}

  add-completion-comment:
    needs:
      - prepare
      - check-up-to-date
      - detect-changes
      - export
      - check-backstage-compatibility
      - validate-metadata-only
    if: always() && needs.prepare.outputs.workspace != ''
    runs-on: ubuntu-latest

    permissions:
      statuses: write
      pull-requests: write

    steps:
      - name: Download compatibility report
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        continue-on-error: true
        with:
          name: backstage-compatibility-report-pr-${{ needs.prepare.outputs.pr-number }}
          path: ./

      - name: Add completion comment
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_OVERLAY_COMMIT: ${{ needs.prepare.outputs.overlay-commit }}
          INPUT_OVERLAY_REPO: ${{ needs.prepare.outputs.overlay-repo }}
          INPUT_OVERLAY_BRANCH: ${{ needs.prepare.outputs.overlay-branch }}
          INPUT_WORKSPACE: ${{ needs.prepare.outputs.workspace }}
          INPUT_PR_NUMBER: ${{ needs.prepare.outputs.pr-number }}
          INPUT_PUBLISHED_EXPORTS: ${{ needs.export.outputs.published-exports }}
          INPUT_FAILED_EXPORTS: ${{ needs.export.outputs.failed-exports }}
          INPUT_ONLY_METADATA_CHANGED: ${{ needs.detect-changes.outputs.only-metadata-changed }}
          INPUT_METADATA_VALIDATION_PASSED: ${{ needs.export.outputs.metadata-validation-passed || needs.validate-metadata-only.outputs.metadata-validation-passed }}
          INPUT_METADATA_VALIDATION_ERRORS: ${{ needs.export.outputs.metadata-validation-errors || needs.validate-metadata-only.outputs.metadata-validation-errors }}
          INPUT_METADATA_VALIDATION_ERROR_COUNT: ${{ needs.export.outputs.metadata-validation-error-count || needs.validate-metadata-only.outputs.metadata-validation-error-count }}
          INPUT_CHECK_UP_TO_DATE_RESULT: ${{ needs.check-up-to-date.result }}
          INPUT_EXPORT_RESULT: ${{ needs.export.result }}
          INPUT_CHECK_BACKSTAGE_COMPATIBILITY_RESULT: ${{ needs.check-backstage-compatibility.result }}
          INPUT_VALIDATE_METADATA_RESULT: ${{ needs.validate-metadata-only.result }}
          INPUT_DETECT_CHANGES_RESULT: ${{ needs.detect-changes.result }}
        with:
          script: |
            const fs = require('fs');
            const prNumber = Number(core.getInput('pr_number'));
            const onlyMetadataChanged = core.getInput('only_metadata_changed') === 'true';
            const checkUpToDateResult = core.getInput('check_up_to_date_result');
            const exportResult = core.getInput('export_result');
            const checkBackstageCompatibilityResult = core.getInput('check_backstage_compatibility_result');
            const workflowRun = await github.rest.actions.getWorkflowRun({
              owner: context.repo.owner,
              repo: context.repo.repo,
              run_id: '${{ github.run_id }}'
            });

            let success;
            let publishSuccess;
            if (checkUpToDateResult === 'failure') {
              success = false;
              publishSuccess = false;
            } else if (onlyMetadataChanged) {
              const validateResult = core.getInput('validate_metadata_result');
              const detectResult = core.getInput('detect_changes_result');
              success = (validateResult === 'success' || validateResult === 'skipped') &&
                        (detectResult === 'success' || detectResult === 'skipped');
              publishSuccess = false;
            } else {
              publishSuccess = exportResult === 'success';
              success = publishSuccess && checkBackstageCompatibilityResult === 'success';
            }

            await github.rest.repos.createCommitStatus({
              owner: context.repo.owner,
              repo: context.repo.repo,
              sha: core.getInput('overlay_commit'),
              description: 'publish',
              state: success ? 'success' : 'failure',
              target_url: workflowRun.data.html_url,
              context: 'publish',
            });

            let body;
            if (checkUpToDateResult === 'failure') {
              body = `[Publish workflow](${workflowRun.data.html_url}) — blocked: \`versions.json\` is not up-to-date with the base branch.`;
            } else if (onlyMetadataChanged) {
              body = `[Publish workflow](${workflowRun.data.html_url}) — build skipped (only metadata files changed).`;
            } else {
              body = `[Publish workflow](${workflowRun.data.html_url}) has completed with ${ publishSuccess ? 'success' : 'failure' }.`;

              const publishedExports = core.getMultilineInput('published_exports');
              const failedExports = core.getMultilineInput('failed_exports');
              if (publishedExports.length + failedExports.length > 0) {
                if (failedExports.length > 0) {
                  body += '\n\n#### Publishing process\n';
                  body += `❌ Plugins with errors during export or container image publishing:`;
                  failedExports.forEach(line => {
                    body += `\n  - ${line}`;
                  });
                } else {
                  body += '\n\n#### Publishing process\n✅ Finished successfully.';
                }
                if (publishedExports.length > 0) {
                  body += `\n- Published container images:`;
                  publishedExports.forEach(line => {
                    body += `\n  - ${line}`;
                  });
                }
              }

              const reportPath = 'backstage-compatibility-report.md';
              if (fs.existsSync(reportPath)) {
                const reportContent = fs.readFileSync(reportPath, 'utf8');
                body = `${body}\n\n${reportContent}`;
              }
            }

            const metadataValidationPassed = core.getInput('metadata_validation_passed');
            const metadataValidationErrorCount = core.getInput('metadata_validation_error_count');
            const metadataValidationErrorsJson = core.getInput('metadata_validation_errors');

            if (metadataValidationPassed === 'true') {
              body += '\n\n#### Metadata Validation\n✅ All metadata files validated successfully.';
            } else if (metadataValidationErrorCount && metadataValidationErrorCount !== '0') {
              let metadataSection = '\n\n#### Metadata Validation\n';
              metadataSection += `❌ Found **${metadataValidationErrorCount}** validation error(s):\n\n`;
              metadataSection += '| File | Kind | Message |\n|------|------|---------|\n';

              try {
                const errors = JSON.parse(metadataValidationErrorsJson || '[]');
                for (const error of errors) {
                  const escapedMessage = (error.message || '').replace(/\|/g, '\\|');
                  metadataSection += `| ${error.file} | ${error.kind} | ${escapedMessage} |\n`;
                }
              } catch (e) {
                metadataSection += `| - | - | Failed to parse errors: ${metadataValidationErrorsJson} |\n`;
              }

              body += metadataSection;
            }

            if (publishSuccess) {
              const [repoOwner, repoName] = core.getInput('overlay_repo').split('/');
              try {
                await github.rest.repos.getContent({
                  owner: repoOwner,
                  repo: repoName,
                  path: `${core.getInput('workspace')}/e2e-tests/package.json`,
                  ref: core.getInput('overlay_branch'),
                });
                body += '\n\nRunning e2e tests\n/test e2e-ocp-helm';
              } catch {
                body += '\n\nNo E2E tests available for this workspace.';
              }
            }

            await github.rest.issues.createComment({
              issue_number: prNumber,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: body
            });

      - name: Stage published exports
        if: needs.export.outputs.published-exports != ''
        env:
          PUBLISHED_EXPORTS: ${{ needs.export.outputs.published-exports }}
          WORKSPACE: ${{ needs.prepare.outputs.workspace }}
          OVERLAY_BRANCH: ${{ needs.prepare.outputs.overlay-branch }}
          OVERLAY_REPO: ${{ needs.prepare.outputs.overlay-repo }}
          OVERLAY_COMMIT: ${{ needs.prepare.outputs.overlay-commit }}
          PR_NUMBER: ${{ needs.prepare.outputs.pr-number }}
          TARGET_BRANCH: ${{ needs.prepare.outputs.target-branch }}
        run: |
          mkdir -p published-exports
          cat > published-exports/meta.json <<EOF
          {"workspace":"${WORKSPACE}","overlayBranch":"${OVERLAY_BRANCH}","overlayRepo":"${OVERLAY_REPO}","overlayCommit":"${OVERLAY_COMMIT}","pr":${PR_NUMBER},"targetBranch":"${TARGET_BRANCH}"}
          EOF
          printf "%s\n" "$PUBLISHED_EXPORTS" > published-exports/published-exports.txt

      - name: Upload published-exports artifact
        if: needs.export.outputs.published-exports != ''
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: published-exports-pr-${{ needs.prepare.outputs.pr-number }}
          path: published-exports/
          if-no-files-found: error
          retention-days: 7