export-dynamic.yaml

name: Export Dynamic Plugin Packages
on:
  workflow_call:
    secrets:
      image-registry-password:
        description: Password to be used to push to container image registry
        required: false
  
    inputs:
      image-registry-user:
        description: User name to be used to push to container image registry
        type: string
        required: false

      node-version:
        description: node-version to execute the export
        type: string
        required: true
      janus-cli-version:
        description: Version of the janus-idp/cli package.
        type: string
        required: true        

      cli-package:
        description: Alternative CLI package to use for plugin export instead of @janus-idp/cli.
        type: string
        required: false
        default: "@janus-idp/cli"

      plugins-repo:
        description:
          Name of the repository that contains the backstage plugins to be exported as dynamic. For example
          backstage/backstage.
        type: string
        required: true
      plugins-repo-ref:
        description:
          Git ref (tag, branch or SHA) of the repository that contains the backstage plugins to be exported as dynamic.
          For example backstage/backstage.
        type: string
        required: true
      plugins-repo-backstage-version:
        description:
          Backstage version that the plugin sources are built against.
        type: string
        required: false
      plugins-root:
        description:
          Monorepo root relative folder, in the repository that contains the backstage plugins to be exported as
          dynamic.
        required: false
        type: string
        default: "."

      overlay-repo:
        description:
          Name of the repository that contains the list of backstage plugins to be exported as dynamic, as well as
          optional export directives and source overlays.
        required: true
        type: string
      overlay-repo-ref:
        description:
          Git ref (tag, branch or SHA) of the repository that contains the list of backstage plugins to be exported as
          dynamic, as well as optional export directives and source overlays.
        type: string
        required: true
      overlay-root:
        description:
          Relative path of the folder containing the plugins.yaml file, inisde the overlay repository.
        required: false
        type: string
        default: "."
  
      publish-container:
        description: Publish a container image for the dynamic plugins
        type: boolean
        default: false
        required: false

      target-backstage-version:
        description: Target Backstage version for validating OCI tag format in metadata (e.g., "1.42.5")
        type: string
        required: true

      image-repository-prefix:
        description: Repository prefix of the dynamic plugin container images
        type: string
        required: false

      image-tag-prefix:
        description: Optional prefix to prepend to the plugin version in the image tag
        type: string
        required: false

      computed-image-tag-prefix:
        description: >
          The computed image tag prefix reflecting backstage compatibility
          (e.g., "bs_1.48.3__" for compatible, "next__" for incompatible).
          Used by metadata validation to decide whether OCI tag checks apply.
        type: string
        required: false

      publish-release-assets:
        description:
          Whether the dynamic plugin archives should be published as GitHub release assets or pushed as workflow
          artifacts.
        required: false
        type: boolean
        default: ${{ github.ref_type == 'tag' && github.event_name == 'push' }}

      artifact-retention-days:
        description:
          Number of days the dynamic plugin archives will be kept as a workflow artifact (if not published as release
          assets).
        required: false
        type: number
        default: 1

      upload-project-on-error:
        description: Upload the complete project as a workflow artifact in case of error in order to troubleshoot.
        required: false
        type: boolean
        default: false

      last-publish-commit:
        description: Optional commit ID of the last successful publishing of plugin container images
        type: string
        required: false
            
    outputs:
      published-exports:
        value: '${{ jobs.export.outputs.published-exports }}'
      failed-exports:
        value: '${{ jobs.export.outputs.failed-exports }}'
      metadata-validation-passed:
        description: Whether the metadata validation passed (true/false)
        value: '${{ jobs.export.outputs.metadata-validation-passed }}'
      metadata-validation-errors:
        description: JSON array of metadata validation errors, empty array if validation passed
        value: '${{ jobs.export.outputs.metadata-validation-errors }}'
      metadata-validation-error-count:
        description: Number of metadata validation errors found
        value: '${{ jobs.export.outputs.metadata-validation-error-count }}'
  
jobs:
  export:
    name: Export

    runs-on: ubuntu-latest

    env:
      NODE_OPTIONS: --max-old-space-size=8192

    defaults:
      run:
        working-directory: source-repo/${{ inputs.plugins-root }}

    outputs:
      published-exports: '${{ steps.export-dynamic.outputs.published-exports }}'
      failed-exports: '${{ steps.export-dynamic.outputs.failed-exports }}'
      metadata-validation-passed: '${{ steps.validate-metadata.outputs.validation-passed }}'
      metadata-validation-errors: '${{ steps.validate-metadata.outputs.validation-errors }}'
      metadata-validation-error-count: '${{ steps.validate-metadata.outputs.validation-error-count }}'
    
    steps:
      - name: Validate Inputs
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          INPUT_PLUGINS_ROOT: ${{ inputs.plugins-root }}
          INPUT_OVERLAY_ROOT: ${{ inputs.overlay-root }}
        with:
          script: |
            const pluginsRoot = core.getInput('plugins_root');
            if (pluginsRoot.startsWith('/') || pluginsRoot.includes('..')) {
              core.setFailed(`Invalid plugins root: ${pluginsRoot}`);
            }
            const overlayRoot = core.getInput('overlay_root');
            if (overlayRoot.startsWith('/') || overlayRoot.includes('..')) {
              core.setFailed(`Invalid overlay root: ${overlayRoot}`);
            }

      - name: Setup Node.js ${{ inputs.node-version }}
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: ${{ inputs.node-version }}
          registry-url: https://registry.npmjs.org/ # Needed for auth

      - name: Checkout plugins repository ${{ inputs.plugins-repo }}
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        if: ${{ inputs.plugins-root == '.' }}
        with:
          repository: ${{ inputs.plugins-repo }}
          ref: ${{ inputs.plugins-repo-ref }}
          path: source-repo

      - name: Checkout plugins repository ${{ inputs.plugins-repo }} at ${{ inputs.plugins-root }}
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        if: ${{ inputs.plugins-root != '.' }}
        with:
          repository: ${{ inputs.plugins-repo }}
          ref: ${{ inputs.plugins-repo-ref }}
          sparse-checkout: |
            /*
            !/workspaces/
            ${{ inputs.plugins-root }}
            workspaces/repo-tools/
          sparse-checkout-cone-mode: false
          path: source-repo

      - name: Checkout overlay repository ${{ inputs.overlay-repo }} in the 'overlay-repo' sub-folder
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: ${{ inputs.overlay-repo }}
          ref: ${{ inputs.overlay-repo-ref }}
          path: overlay-repo
          fetch-depth: 50

      - name: Override Sources
        uses: redhat-developer/rhdh-plugin-export-utils/override-sources@main
        with:
          overlay-root: ${{ github.workspace }}/overlay-repo/${{inputs.overlay-root}}
          workspace-root: source-repo/${{ inputs.plugins-root }}

      - name: Dump content
        env:
          INPUT_PLUGINS_ROOT: source-repo/${{ inputs.plugins-root }}
        if: ${{ inputs.plugins-root != '.' }}
        run: echo "$INPUT_PLUGINS_ROOT/../.. :" && ls -al ../../ && echo "$INPUT_PLUGINS_ROOT/.. :" && ls -al .. && echo "$INPUT_PLUGINS_ROOT :" && ls -al

      - name: Check Backstage Version
        env:
          INPUT_REPO_BACKSTAGE_VERSION: ${{ inputs.plugins-repo-backstage-version }}
          INPUT_WORKSPACE_PATH: ${{inputs.overlay-root}}
        if: ${{ inputs.plugins-repo-backstage-version != '' }}
        run: |
          if [[ ! -f "backstage.json" ]]
          then
            echo "::warning title=No Backstage version for ${INPUT_WORKSPACE_PATH}::The sources of workspace ${INPUT_OVERLAY_ROOT} do not contain the 'backstage.json' file. The 'repo-backstage-version' field of the overlay 'source.json' file (${INPUT_REPO_BACKSTAGE_VERSION}) has been set manually and cannot be verified against sources."
            exit 0
          fi

          sourceBackstageVersion=$(jq -r '.version' backstage.json)
          if [[ "${sourceBackstageVersion}" != "${INPUT_REPO_BACKSTAGE_VERSION}" ]]
          then
            echo "::error title=Inconsistent Backstage version for ${INPUT_WORKSPACE_PATH}::In workspace ${INPUT_OVERLAY_ROOT}, the 'repo-backstage-version' field of the overlay 'source.json' file (${INPUT_REPO_BACKSTAGE_VERSION}) should be equal to the version mentioned in the workspace 'backstage.json' file(${sourceBackstageVersion}). You should fix this in order to enable robust version compatibility checks."
            exit 1
          fi

      - name: Install required native libraries
        run: |
          sudo apt-get update
          sudo apt-get install build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev

      - name: Enable Corepack
        run: corepack enable
        
      - name: Run yarn install
        run: |
          yarn --version
          yarn install --immutable

      - name: Debug yarn install
        if: failure()
        run: |
          cp yarn.lock yarn.lock.before

          echo "::group::Running mutable yarn install to debug yarn.lock required changes"
          YARN_ENABLE_IMMUTABLE_INSTALLS=false yarn install
          echo "::endgroup::"

          echo "::group::Required changes in yarn.lock"
          diff -u yarn.lock.before yarn.lock || true
          echo "::endgroup::"

      - name: Run Typescript type checking
        run: yarn tsc

      - name: Log in to container registry
        if: ${{ inputs.publish-container }}
        uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1.7
        env:
          FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
        with:
          username: ${{ inputs.image-registry-user }}
          password: ${{ secrets.image-registry-password }}
          registry: ${{ inputs.image-repository-prefix }}

      - name: Set Plugin Image Repository Prefix
        if: ${{ inputs.publish-container }}
        env:
          IMAGE_REPOSITORY_PREFIX: ${{ inputs.image-repository-prefix }}

        id: set-image-tag-name
        shell: bash
        run: |
          if [[ "${{ inputs.publish-container  }}" ]]
          then
            echo "IMAGE_REPOSITORY_PREFIX=$IMAGE_REPOSITORY_PREFIX" >> $GITHUB_OUTPUT
          else
            echo "IMAGE_REPOSITORY_PREFIX=" >> $GITHUB_OUTPUT
          fi

      - name: Export dynamic plugin packages
        if: ${{ success() }}
        id: export-dynamic
        uses: redhat-developer/rhdh-plugin-export-utils/export-dynamic@main
        with:
          plugins-root: source-repo/${{inputs.plugins-root}}
          plugins-file: ${{ github.workspace }}/overlay-repo/${{inputs.overlay-root}}/plugins-list.yaml
          destination: ${{ github.workspace }}/dynamic-plugin-archives
          janus-cli-version: ${{inputs.janus-cli-version}}
          cli-package: ${{inputs.cli-package}}
          image-repository-prefix: ${{ steps.set-image-tag-name.outputs.IMAGE_REPOSITORY_PREFIX }}
          image-tag-prefix: ${{ inputs.image-tag-prefix }}
          last-publish-commit: ${{ inputs.last-publish-commit }}

      - name: Set artifacts name suffix
        id: set-artifacts-name-suffix
        shell: bash
        env:
          INPUT_OVERLAY_ROOT: ${{ inputs.overlay-root }}

        run: |
          ARTIFACTS_NAME_SUFFIX=""
          if [[ "${INPUT_OVERLAY_ROOT}" != "." ]]
          then
            ARTIFACTS_NAME_SUFFIX=" ($(echo ${INPUT_OVERLAY_ROOT} | sed -e 's:/:-:g'))"
          fi
          echo "ARTIFACTS_NAME_SUFFIX=$ARTIFACTS_NAME_SUFFIX" >> $GITHUB_OUTPUT

      - name: Upload exported archives to workflow artifacts
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        if: ${{ !inputs.publish-release-assets && success() && steps.export-dynamic.outputs.workspace-skipped-unchanged-since == 'false' }}
        with:
          name: dynamic plugin packages${{ steps.set-artifacts-name-suffix.outputs.ARTIFACTS_NAME_SUFFIX }}
          path: ${{ github.workspace }}/dynamic-plugin-archives
          if-no-files-found: warn
          retention-days: ${{ inputs.artifact-retention-days }}
          overwrite: true

      - name: Upload the project to workflow artifacts on failure
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        if: ${{ inputs.upload-project-on-error && (failure() || steps.export-dynamic.outputs.failed-exports) }}
        with:
          name: project root folder${{ steps.set-artifacts-name-suffix.outputs.ARTIFACTS_NAME_SUFFIX }}
          path: |
            ${{ github.workspace }}
            !${{ github.workspace }}/dynamic-plugin-archives
            !${{ github.workspace }}/node_modules
            !.git
          if-no-files-found: warn
          retention-days: ${{ inputs.artifact-retention-days }}
          overwrite: true
          include-hidden-files: true

      - name: Log container image names
        if: ${{ success() && steps.export-dynamic.outputs.published-exports != '' }}
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          INPUT_PUBLISHED_EXPORTS: ${{ steps.export-dynamic.outputs.published-exports }}
          INPUT_OVERLAY_ROOT: ${{ inputs.overlay-root }}
        with:
          script: |
            const publishedExports = core.getMultilineInput('published_exports');
            const overlayRoot = core.getInput('overlay_root');
            core.summary
              .addHeading(`Published container images for workspace '${overlayRoot}' :`, 4)
              .addList(publishedExports)
              .write();

      - name: Log that the workspace has been skipped
        if: ${{ success() && steps.export-dynamic.outputs.workspace-skipped-unchanged-since != 'false' }}
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          INPUT_UNCHANGED_SINCE: ${{ steps.export-dynamic.outputs.workspace-skipped-unchanged-since }}
          INPUT_OVERLAY_REPO: ${{ inputs.overlay-repo }}
          INPUT_OVERLAY_ROOT: ${{ inputs.overlay-root }}
        with:
          script: |
            const unchangedSince = core.getInput('unchanged_since');
            const overlayRepo = core.getInput('overlay_repo');
            const overlayRoot = core.getInput('overlay_root');
            core.notice(
              `Workspace '${overlayRoot}' skipped because it has not been changed since last published commit: ${unchangedSince} (https://github.com/${overlayRepo}/tree/${unchangedSince})`,
              { title: 'Workspace skipped' }
            );
      
      - name: Check export errors
        if: ${{ success() && steps.export-dynamic.outputs.failed-exports != '' }}
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          INPUT_FAILED_EXPORTS: ${{ steps.export-dynamic.outputs.failed-exports }}
          INPUT_PLUGINS_ROOT: ${{ inputs.plugins-root }}
          INPUT_PLUGINS_REPO: ${{ inputs.plugins-repo }}
          INPUT_PLUGINS_REPO_REF: ${{ inputs.plugins-repo-ref }}
          INPUT_OVERLAY_ROOT: ${{ inputs.overlay-root }}
        with:
          script: |
            const overlayRoot = core.getInput('overlay_root');
            const failedExports = core.getMultilineInput('failed_exports');
            const replaceExpr = `- $1 (https://github.com/${ core.getInput('plugins_repo') }/tree/${ core.getInput('plugins_repo_ref') }/${ core.getInput('plugins_root')}/$1)`;
            core.setFailed(`The export for workspace '${overlayRoot}' failed for the following plugins:\n${ failedExports.map(line => line.replace(/^(.*..*)$/gm, replaceExpr)) }`);

      - name: Publish exported plugins as GitHub release assets
        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
        if: ${{ success() && inputs.publish-release-assets }}
        env:
          FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
        with:
          body:
            Dynamic Plugins for Red Hat Developer Hub ${{ github.ref_name }}, exported from ${{ inputs.plugins-repo }}.
          files: ${{ github.workspace }}/dynamic-plugin-archives/*
          repository: ${{ github.repository }}

      - name: Validate Catalog Metadata
        if: ${{ failure() || steps.export-dynamic.outputs.workspace-skipped-unchanged-since == 'false' }}
        id: validate-metadata
        uses: redhat-developer/rhdh-plugin-export-utils/validate-metadata@main
        with:
          overlay-root: ${{ github.workspace }}/overlay-repo/${{inputs.overlay-root}}
          plugins-root: ${{ github.workspace }}/source-repo/${{inputs.plugins-root}}
          target-backstage-version: ${{ inputs.target-backstage-version }}
          image-repository-prefix: ${{ steps.set-image-tag-name.outputs.IMAGE_REPOSITORY_PREFIX }}
          computed-image-tag-prefix: ${{ inputs.computed-image-tag-prefix }}