callable-publish.yaml

# Copyright 2024 Defense Unicorns
# SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial

name: Callable-Publish

on:
  workflow_call:
    inputs:
      runsOn:
        default: ubuntu-latest
        type: string
      flavor:
        required: true
        type: string
      options:
        type: string
        description: Additional options to set when running the test
        default: ""
      reports-path:
        type: string
        description: The path to test outputs to upload
      reports-name:
        type: string
        description: The name prefix for upload test reports
        default: playwright-report
      timeout:
        type: number
        default: 40
      uds-releaser:
        type: boolean
        default: false

# Permissions for the GITHUB_TOKEN used by the workflow.
permissions:
  contents: read # Allows reading the content of the repository.
  packages: read # Allows reading the content of the repository's packages.
  id-token: write

jobs:
  run:
    runs-on: ${{ inputs.runsOn }}
    timeout-minutes: ${{ inputs.timeout }}
    permissions:
      contents: write
      packages: write
      id-token: write

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Install UDS CLI
        uses: defenseunicorns/setup-uds@ab842abcad1f7a3305c2538e3dd1950d0daacfa5 # v1.0.1
        with:
          # renovate: datasource=github-tags depName=defenseunicorns/uds-cli versioning=semver
          version: v0.20.0

      - name: Environment setup
        run: |
            uds run actions:setup-environment \
            --set REGISTRY1_USERNAME="${{ secrets.IRON_BANK_ROBOT_USERNAME }}" \
            --set REGISTRY1_PASSWORD="${{ secrets.IRON_BANK_ROBOT_PASSWORD }}" \
            --set GH_TOKEN="${{ secrets.GITHUB_TOKEN }}" \
            --set CHAINGUARD_IDENTITY="${{ secrets.CHAINGUARD_IDENTITY }}"
        shell: bash

      - name: Publish Packages/Bundles - release-please
        if: ${{ inputs.uds-releaser == false }}
        run: |
          if uds run --list | grep -q 'publish-package'; then
            uds run publish-package --set USE_CHECKPOINT=false --set FLAVOR=${{ inputs.flavor }} --no-progress ${{ inputs.options }}
          else
            uds run publish-release --set USE_CHECKPOINT=false --set FLAVOR=${{ inputs.flavor }} --no-progress ${{ inputs.options }}
          fi

      - name: Publish Packages/Bundles - uds-releaser
        if: ${{ inputs.uds-releaser == true }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if uds-releaser check "${{ inputs.flavor }}"; then
            uds-releaser update-yaml ${{ inputs.flavor }}
            if uds run --list | grep -q 'publish-package'; then
              uds run publish-package \
                --set USE_CHECKPOINT=false \
                --set FLAVOR=${{ inputs.flavor }} \
                --set ENABLE_UDS_RELEASER=true \
                --no-progress ${{ inputs.options }}
            else
              uds run publish-release \
                --set USE_CHECKPOINT=false \
                --set FLAVOR=${{ inputs.flavor }} \
                --set ENABLE_UDS_RELEASER=true \
                --no-progress ${{ inputs.options }}
            fi
          fi

      - name: Debug Output
        if: ${{ always() }}
        run: uds run actions:debug-output
        shell: bash

      - name: Save logs
        if: ${{ always() }}
        run: uds run actions:save-logs
        shell: bash

      - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        if: ${{ always() }}
        with:
          name: debug-log-${{ inputs.flavor }}-${{ github.run_id }}-${{ github.run_attempt }}-${{ runner.arch }}
          path: |
            /tmp/zarf-*.log
            /tmp/uds-*.log
            /tmp/maru-*.log
            /tmp/debug-*.log
            /tmp/uds-containerd-logs
            /tmp/k3d-uds-*.log
            oscal-assessment-results.yaml

      - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        if: ${{ always() && inputs.reports-path != '' }}
        with:
          name: ${{ inputs.reports-name }}-${{ inputs.flavor }}-${{ github.run_id }}-${{ github.run_attempt }}-${{ runner.arch }}
          path: ${{ inputs.reports-path }}
          retention-days: 30