Add edge-sso template and workflows, rebuilt off main

.github/read-template-registry/action.yaml

@@ -32,11 +32,13 @@ runs:
         TEMPLATE_DIR: ${{ inputs.template_dir }}
       run: |
         echo "name=$(jq -r '.name' "$TEMPLATE_DIR/registry.json")" >> "$GITHUB_OUTPUT"
-        echo "template_id=$(jq -r '.template_id' "$TEMPLATE_DIR/registry.json")" >> "$GITHUB_OUTPUT"
+        echo "template_id=$(jq -r '.template_id // empty' "$TEMPLATE_DIR/registry.json")" >> "$GITHUB_OUTPUT"
         echo "descr=$(jq -r '.description' "$TEMPLATE_DIR/registry.json")" >> "$GITHUB_OUTPUT"
         echo "params=$(jq -c '.params' "$TEMPLATE_DIR/registry.json")" >> "$GITHUB_OUTPUT"
-        {
-          echo 'instructions<<EOF'
-          cat "$TEMPLATE_DIR/instructions.md"
-          echo 'EOF'
-        } >> "$GITHUB_OUTPUT"
+        if [ -f "$TEMPLATE_DIR/instructions.md" ]; then
+          {
+            echo 'instructions<<EOF'
+            cat "$TEMPLATE_DIR/instructions.md"
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+        fi

.github/workflows/_publish_js.yml

@@ -0,0 +1,93 @@
+name: Publish JS template
+
+# Reusable workflow: build one TypeScript app to wasm via fastedge-build and
+# publish it as a portal template. No Harbor/compiler image needed — the build
+# toolchain comes from npm. Callers pass the workspace root, the per-app build
+# command, and the resulting wasm path.
+
+on:
+  workflow_call:
+    inputs:
+      template:
+        description: Template name (job label)
+        required: true
+        type: string
+      working_directory:
+        description: Workspace root to run pnpm install in
+        required: true
+        type: string
+      build_command:
+        description: "Command that builds the wasm (e.g. pnpm -C otp-app build)"
+        required: true
+        type: string
+      output_path:
+        description: Built wasm destination (relative to repo root)
+        required: true
+        type: string
+      registry_dir:
+        description: Dir holding registry.json / instructions.md
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  build_and_publish:
+    name: Build and publish ${{ inputs.template }}
+    runs-on: [self-hosted, ubuntu-22-04, regular]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Import credentials from Vault
+        uses: hashicorp/vault-action@v3
+        id: creds
+        with:
+          url: https://puppet-vault.gc.onl
+          token: ${{ secrets.VAULT_TOKEN }}
+          secrets: |
+            secret/project_fastedge/gcore_api/preprod apitoken | PREPROD_API_KEY ;
+            secret/project_fastedge/gcore_api/preprod hostname | PREPROD_API_URL ;
+            secret/project_fastedge/gcore_api/prod apitoken | PROD_API_KEY ;
+            secret/project_fastedge/gcore_api/prod hostname | PROD_API_URL ;
+
+      - name: Setup Node.js and install dependencies
+        uses: ./.github/setup-node
+        with:
+          working_directory: ${{ inputs.working_directory }}
+
+      - name: Build ${{ inputs.template }}
+        working-directory: ${{ inputs.working_directory }}
+        run: ${{ inputs.build_command }}
+
+      - name: Read ${{ inputs.template }} registry
+        id: registry
+        uses: ./.github/read-template-registry
+        with:
+          template_dir: ${{ inputs.registry_dir }}
+
+      - name: Deploy ${{ inputs.template }} to preprod
+        uses: gcore-github-actions/fastedge/deploy-template@v1
+        with:
+          api_key: ${{ steps.creds.outputs.PREPROD_API_KEY }}
+          api_url: ${{ steps.creds.outputs.PREPROD_API_URL }}
+          wasm_file: ${{ inputs.output_path }}
+          template_name: ${{ steps.registry.outputs.name }}
+          short_descr: ${{ steps.registry.outputs.descr }}
+          long_descr: ${{ steps.registry.outputs.instructions }}
+          params: ${{ steps.registry.outputs.params }}
+
+      - name: Deploy ${{ inputs.template }} to prod
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: gcore-github-actions/fastedge/deploy-template@v1
+        with:
+          api_key: ${{ steps.creds.outputs.PROD_API_KEY }}
+          api_url: ${{ steps.creds.outputs.PROD_API_URL }}
+          wasm_file: ${{ inputs.output_path }}
+          template_name: ${{ steps.registry.outputs.name }}
+          template_id: ${{ steps.registry.outputs.template_id }}
+          short_descr: ${{ steps.registry.outputs.descr }}
+          long_descr: ${{ steps.registry.outputs.instructions }}
+          params: ${{ steps.registry.outputs.params }}

.github/workflows/_publish.yml → .github/workflows/_publish_rs.yml

@@ -1,12 +1,37 @@
-name: Publish template
+name: Publish Rust template
+
+# Reusable workflow: build one Rust cdylib to wasm and publish it as a portal
+# template. Simple templates (one dir = one package = one wasm) call this with
+# just `template:`. Templates whose layout doesn't follow that convention
+# (e.g. edge-sso filters living in a shared Cargo workspace) pass explicit
+# paths to override the defaults.
 
 on:
   workflow_call:
     inputs:
       template:
-        description: Template directory / package name to build and publish
+        description: Template name (job label + default for the paths below)
         required: true
         type: string
+      rust_package:
+        description: "Cargo package name (default: template)"
+        required: false
+        type: string
+      working_directory:
+        description: "Dir containing the Cargo project (default: template)"
+        required: false
+        type: string
+      output_path:
+        description: "Built wasm destination (default: <template>/wasm/<template>.wasm)"
+        required: false
+        type: string
+      registry_dir:
+        description: "Dir holding registry.json / instructions.md (default: template)"
+        required: false
+        type: string
+
+permissions:
+  contents: read
 
 jobs:
   build_and_publish:
@@ -40,22 +65,22 @@ jobs:
       - name: Build ${{ inputs.template }}
         uses: ./.github/build-rust
         with:
-          rust_package: ${{ inputs.template }}
-          working_directory: ${{ inputs.template }}
-          output_path: ${{ inputs.template }}/wasm/${{ inputs.template }}.wasm
+          rust_package: ${{ inputs.rust_package || inputs.template }}
+          working_directory: ${{ inputs.working_directory || inputs.template }}
+          output_path: ${{ inputs.output_path || format('{0}/wasm/{0}.wasm', inputs.template) }}
 
       - name: Read ${{ inputs.template }} registry
         id: registry
         uses: ./.github/read-template-registry
         with:
-          template_dir: ${{ inputs.template }}
+          template_dir: ${{ inputs.registry_dir || inputs.template }}
 
       - name: Deploy ${{ inputs.template }} to preprod
         uses: gcore-github-actions/fastedge/deploy-template@v1
         with:
           api_key: ${{ steps.creds.outputs.PREPROD_API_KEY }}
           api_url: ${{ steps.creds.outputs.PREPROD_API_URL }}
-          wasm_file: ${{ inputs.template }}/wasm/${{ inputs.template }}.wasm
+          wasm_file: ${{ inputs.output_path || format('{0}/wasm/{0}.wasm', inputs.template) }}
           template_name: ${{ steps.registry.outputs.name }}
           short_descr: ${{ steps.registry.outputs.descr }}
           long_descr: ${{ steps.registry.outputs.instructions }}
@@ -67,7 +92,7 @@ jobs:
         with:
           api_key: ${{ steps.creds.outputs.PROD_API_KEY }}
           api_url: ${{ steps.creds.outputs.PROD_API_URL }}
-          wasm_file: ${{ inputs.template }}/wasm/${{ inputs.template }}.wasm
+          wasm_file: ${{ inputs.output_path || format('{0}/wasm/{0}.wasm', inputs.template) }}
           template_name: ${{ steps.registry.outputs.name }}
           template_id: ${{ steps.registry.outputs.template_id }}
           short_descr: ${{ steps.registry.outputs.descr }}

.github/workflows/publish-harden-cookies.yml

@@ -8,9 +8,12 @@ on:
     paths:
       - 'harden-cookies/**'
 
+permissions:
+  contents: read
+
 jobs:
   publish:
-    uses: ./.github/workflows/_publish.yml
+    uses: ./.github/workflows/_publish_rs.yml
     with:
       template: harden-cookies
     secrets: inherit

.github/workflows/publish-html2md.yml

@@ -8,9 +8,12 @@ on:
     paths:
       - 'html2md/**'
 
+permissions:
+  contents: read
+
 jobs:
   publish:
-    uses: ./.github/workflows/_publish.yml
+    uses: ./.github/workflows/_publish_rs.yml
     with:
       template: html2md
     secrets: inherit

.github/workflows/publish-sso-cookie-auth.yml

@@ -0,0 +1,24 @@
+name: Publish sso-cookie-auth
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "edge-sso/core/**"
+      - "edge-sso/templates/cookie/auth-app/**"
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    uses: ./.github/workflows/_publish_js.yml
+    with:
+      template: sso-cookie-auth
+      working_directory: edge-sso
+      build_command: pnpm -C templates/cookie/auth-app build
+      output_path: edge-sso/templates/cookie/auth-app/wasm/cookie-auth-app.wasm
+      registry_dir: edge-sso/templates/cookie/auth-app
+    secrets: inherit

.github/workflows/publish-sso-cookie-filter.yml

@@ -0,0 +1,24 @@
+name: Publish sso-cookie-filter
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "edge-sso/core/**"
+      - "edge-sso/templates/cookie/cdn-filter/**"
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    uses: ./.github/workflows/_publish_rs.yml
+    with:
+      template: sso-cookie-filter
+      rust_package: sso-guard-cookie
+      working_directory: edge-sso
+      output_path: edge-sso/templates/cookie/cdn-filter/wasm/cookie_sso_guard.wasm
+      registry_dir: edge-sso/templates/cookie/cdn-filter
+    secrets: inherit

.github/workflows/publish-sso-gate-only-auth.yml

@@ -0,0 +1,25 @@
+name: Publish sso-gate-only-auth
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - 'edge-sso/core/**'
+      - 'edge-sso/templates/gate-only/auth-app/**'
+
+permissions:
+  contents: read
+
+
+jobs:
+  publish:
+    uses: ./.github/workflows/_publish_js.yml
+    with:
+      template: sso-gate-only-auth
+      working_directory: edge-sso
+      build_command: pnpm -C templates/gate-only/auth-app build
+      output_path: edge-sso/templates/gate-only/auth-app/wasm/gate-auth-app.wasm
+      registry_dir: edge-sso/templates/gate-only/auth-app
+    secrets: inherit

.github/workflows/publish-sso-gate-only-filter.yml

@@ -0,0 +1,24 @@
+name: Publish sso-gate-only-filter
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "edge-sso/core/**"
+      - "edge-sso/templates/gate-only/cdn-filter/**"
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    uses: ./.github/workflows/_publish_rs.yml
+    with:
+      template: sso-gate-only-filter
+      rust_package: sso-guard-gate-only
+      working_directory: edge-sso
+      output_path: edge-sso/templates/gate-only/cdn-filter/wasm/gate_sso_guard.wasm
+      registry_dir: edge-sso/templates/gate-only/cdn-filter
+    secrets: inherit

.github/workflows/publish-sso-header-auth.yml

@@ -0,0 +1,24 @@
+name: Publish sso-header-auth
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "edge-sso/core/**"
+      - "edge-sso/templates/header/auth-app/**"
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    uses: ./.github/workflows/_publish_js.yml
+    with:
+      template: sso-header-auth
+      working_directory: edge-sso
+      build_command: pnpm -C templates/header/auth-app build
+      output_path: edge-sso/templates/header/auth-app/wasm/headers-auth-app.wasm
+      registry_dir: edge-sso/templates/header/auth-app
+    secrets: inherit

.github/workflows/publish-sso-header-filter.yml

@@ -0,0 +1,24 @@
+name: Publish sso-header-filter
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - 'edge-sso/core/**'
+      - 'edge-sso/templates/header/cdn-filter/**'
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    uses: ./.github/workflows/_publish_rs.yml
+    with:
+      template: sso-header-filter
+      rust_package: sso-guard-header
+      working_directory: edge-sso
+      output_path: edge-sso/templates/header/cdn-filter/wasm/headers_sso_guard.wasm
+      registry_dir: edge-sso/templates/header/cdn-filter
+    secrets: inherit