php-app.yml

name: PHP Application

on:
  workflow_call:
    inputs:
      checks:
        description: |
          List of enabled checks separated by comma.
          default: phpunit,phpcs,psalm
          available checks: phpunit,phpcs,psalm
        required: false
        default: "phpunit,phpcs,psalm"
        type: string
      frontend:
        default: true
        description: Set to false for backend-only projects.
        required: false
        type: boolean
      frontend-build-path:
        default: "public/"
        description: Path where the frontend artifacts are written
        required: false
        type: string
      frontend-checks:
        default: lint,unit-tests
        description: |
          List of enabled checks separated by comma.
          default: lint,unit-tests
          available checks: lint,unit-tests
        required: false
        type: string
      images:
        description: 'Dockers images to build. Object where the key is the image name and the value the Dockerfile. e.g. "{"crm-worker": "Dockerfile-worker"}'
        required: true
        type: string
      instance-size:
        description: 'Runner instance size'
        required: false
        type: string
        default: 'large'
      openapi-bootstrap:
        description: 'Path to pass as --bootstrap argument to the openapi generator'
        required: false
        type: string
      openapi-paths:
        description: 'Paths to include when invoking openapi generator'
        required: false
        type: string
      php-extensions:
        description: 'Setup PHP extensions.'
        required: false
        type: string
      php-quality-pr-only:
        default: false
        description: 'If true, runs quality checks only on PRs. Related to `psalm-diff-only` and `phpcs-diff-only`'
        required: false
        type: boolean
      php-version:
        description: 'Setup PHP version.'
        default: '8.1'
        required: false
        type: string
      phpcs-diff-only:
        default: false
        description: 'If true, runs phpcs only on changed files'
        required: false
        type: boolean
      phpunit-extra-args:
        description: 'Provide extra arguments to phpunit check'
        default: ''
        required: false
        type: string
      psalm-diff-only:
        default: false
        description: 'If true, runs psalm only on changed files'
        required: false
        type: boolean
      psalm-extra-args:
        description: 'Provide extra arguments to psalm check'
        default: '--no-cache --no-diff'
        required: false
        type: string
      registry:
        description: The registry where the image will be pushed to
        type: string
        required: true
      role-to-assume:
        description: "The role to assume when publishing to ECR."
        required: true
        type: string
      sdks:
        description: 'List of sdks to build'
        default: '["php", "typescript", "micronaut"]'
        required: false
        type: string
      sentry-project:
        description: 'Sentry project name'
        required: false
        type: string
      sentry-sourcemaps-path:
        description: 'Path where the sourcemaps are located'
        default: ''
        required: false
        type: string
      sentry-sourcemaps-url-prefix:
        description: 'Prefix to add to the sourcemaps'
        default: ''
        required: false
        type: string
      sentry-sourcemaps-inject-debug-id:
        description: 'Injects the debug id in the built files and sourcemaps'
        default: false
        required: false
        type: boolean
      site-config-path:
        description: 'Path of the dev/docker siteconfig to generate. None if empty.'
        default: ''
        required: false
        type: string
      skip-duplicate-do-not-skip:
        default: '["push", "schedule", "workflow_dispatch"]'
        description: 'Array of events that requires all checks to be run'
        required: false
        type: string
      skip-duplicate-backend-paths:
        default: '[]'
        description: 'Array of paths to skip for the backend'
        required: false
        type: string
      skip-duplicate-frontend-paths:
        default: '[]'
        description: 'Array of paths to skip for the frontend'
        required: false
        type: string
      slack-channel:
        description: |
          The Slack channel where the notification will be sent.
          Defaults to $ {{ github.event.repository.custom_properties.ci_slack_channel }}.
        required: false
        type: string
      update-wsdl:
        default: false
        description: 'If true, runs UpdateWSDL tool.'
        required: false
        type: boolean
      use-self-hosted:
        description: "Use self-hosted runners for the workflow."
        required: false
        type: boolean
        default: false
      working-directory:
        description: "Workflow working directory"
        default: '.'
        required: false
        type: string
      yaml-validate:
        default: true
        description: 'If true, runs YamlLint from ./internal/scripts/YamlLint.php.'
        required: false
        type: boolean
    secrets:
      ECR_AWS_REGION:
        description: AWS region for the registry.
        required: true
      GPR_KEY:
        description: Personal access token to fetch private repos and Github Packages
        required: true
      GPR_USER:
        description: A username with write access to Github Package registry.
        required: true
      SENTRY_AUTH_TOKEN:
        description: 'Sentry auth token'
        required: false
      SENTRY_ORG:
        description: 'Sentry organization'
        required: false
      SLACK_BOT_TOKEN:
        description: The bot token used to authenticate with Slack.
        required: true

env:
  php-cache-key: v1

permissions:
  actions: read
  contents: write
  id-token: write
  security-events: write
  pull-requests: write

jobs:
  pre-checks:
    name: Pre-checks
    runs-on: ubuntu-latest
    outputs:
      should-skip-backend: ${{ steps.skip-check-backend.outputs.should_skip }}
      should-skip-frontend: ${{ steps.skip-check-frontend.outputs.should_skip }}
    steps:
      - id: skip-check-backend
        uses: fkirc/skip-duplicate-actions@b974a9395958c231af965b70070979a577efa578 # v5
        with:
          concurrent_skipping: same_content
          do_not_skip: ${{ inputs.skip-duplicate-do-not-skip }}
          paths: ${{ inputs.skip-duplicate-backend-paths }}
          skip_after_successful_duplicate: true
      - id: skip-check-frontend
        uses: fkirc/skip-duplicate-actions@b974a9395958c231af965b70070979a577efa578 # v5
        if: inputs.frontend
        with:
          concurrent_skipping: same_content
          do_not_skip: ${{ inputs.skip-duplicate-do-not-skip }}
          paths: ${{ inputs.skip-duplicate-frontend-paths }}
          skip_after_successful_duplicate: true

  setup:
    name: Setup
    needs: [pre-checks]
    if: ${{ needs.pre-checks.outputs.should-skip-backend != 'true' || (inputs.frontend && needs.pre-checks.outputs.should-skip-frontend != 'true') }}
    runs-on: ubuntu-latest
    outputs:
      is-release: ${{ steps.metadata.outputs.is-release }}
      publishable: ${{ steps.metadata.outputs.publishable }}
      version: ${{ steps.metadata.outputs.version }}
      is-hotfix: ${{ steps.metadata.outputs.is-hotfix }}
      images-matrix: ${{ steps.complex-outputs.outputs.images-matrix }}
      run-php-long-checks: ${{ steps.outputs.outputs.run-php-long-checks }}
      run-phpunit-it: ${{ steps.outputs.outputs.run-phpunit-it }}
      run-stylelint: ${{ steps.outputs.outputs.run-stylelint }}
      with-asdf: ${{ steps.outputs.outputs.with-asdf }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 1000

      - name: Fetch branches (for action-metadata commit check)
        run: |
          default_branch="${{ github.event.repository.default_branch }}"
          git fetch --no-tags --prune --depth=1000 origin +refs/heads/$default_branch:refs/remotes/origin/$default_branch '+refs/heads/release/*:refs/remotes/origin/release/*'

      - name: Generate outputs
        shell: bash
        id: outputs
        run: |
          RUN_PHP_LONG_CHECKS="false"
          RUN_PHPUNIT_IT="false"
          RUN_STYLELINT="false"
          WITH_ASDF="false"

          if [[ "${{ needs.pre-checks.outputs.should-skip-backend }}" != "true" ]]; then
            if [[ "${{ inputs.php-quality-pr-only }}" != "true" ]]; then
              RUN_PHP_LONG_CHECKS="true"
            elif [[ "${{ inputs.php-quality-pr-only }}" == "true" && "${{ github.event_name }}" == "pull_request" ]]; then
              RUN_PHP_LONG_CHECKS="true"
            fi
          fi

          if [[ -f "${{ inputs.working-directory }}/.tool-versions" ]]; then
            WITH_ASDF="true"
          fi

          if grep -Fq "<testsuite name=\"it\">" "${{ inputs.working-directory }}/phpunit.xml"; then
            RUN_PHPUNIT_IT="true"
          fi

          if grep -Fq "\"stylelint:ci\"" "${{ inputs.working-directory }}/package.json"; then
            RUN_STYLELINT="true"
          fi

          echo "run-php-long-checks=${RUN_PHP_LONG_CHECKS}" >> $GITHUB_OUTPUT
          echo "run-phpunit-it=${RUN_PHPUNIT_IT}" >> $GITHUB_OUTPUT
          echo "run-stylelint=${RUN_STYLELINT}" >> $GITHUB_OUTPUT
          echo "with-asdf=${WITH_ASDF}" >> $GITHUB_OUTPUT

      - name: Find application metadata
        id: metadata
        uses: equisoft-actions/application-metadata@v1
        with:
          release-branch: ${{ github.event.repository.default_branch }}
          hotfix-branch-prefix: release/

      - name: Setup asdf-vm
        uses: equisoft-actions/with-asdf-vm@v2
        if: ${{ steps.outputs.outputs.with-asdf == 'true' }}

      - name: NPM Login
        uses: equisoft-actions/yarn-npm-login@v1
        if: inputs.frontend
        with:
          registry: npm.pkg.github.com
          token: ${{ secrets.GPR_KEY }}

      - name: Install NPM dependencies
        if: inputs.frontend
        uses: equisoft-actions/yarn-install@v1

      - name: Generate complex outputs
        id: complex-outputs
        shell: python
        env:
          IMAGES: ${{ inputs.images }}
        run: |
          import json
          import os

          parsed: dict = json.loads(os.environ.get("IMAGES"))
          include = []
          for image_name in parsed:
            include.append({"image": image_name, "dockerfile": parsed[image_name]})

          with open(os.environ.get('GITHUB_OUTPUT'), 'a') as output_file:
            output_file.write('images-matrix=')
            json.dump({"include": include}, output_file)
            output_file.write('\n')

  validate-tool-versions:
    name: Validate .tool-versions
    needs: [setup]
    strategy:
      matrix:
        include:
          - platform: linux/amd64
            runs-on: [self-hosted, amd64-small]
          - platform: linux/arm64
            runs-on: [self-hosted, arm64-small]
    runs-on: ${{ matrix.runs-on }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Get changed .tool-versions file
        id: changed-tool-versions-file
        uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47
        with:
          files: |
            **.tool-versions

      - name: Validate .tool-versions
        if: steps.changed-tool-versions-file.outputs.any_changed == 'true'
        uses: equisoft-actions/validate-tool-versions@v1
        with:
          working-directory: '.'

  phpunit:
    name: PHPUnit
    needs:
      - pre-checks
      - setup
    permissions:
      contents: read
      checks: write
    if: ${{ needs.pre-checks.outputs.should-skip-backend != 'true' && contains(inputs.checks, 'phpunit') }}
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Setup PHP
        uses: equisoft-actions/setup-php@v1
        with:
          php-version: ${{ inputs.php-version }}
          extensions: ${{ inputs.php-extensions }}
          cache-key: ${{ env.php-cache-key }}

      - name: Composer install
        uses: equisoft-actions/composer@v1
        with:
          gpr-key: ${{ secrets.GPR_KEY }}
          working-directory: ${{ inputs.working-directory }}

      - name: PHPUnit
        uses: equisoft-actions/phpunit@v1
        with:
          extra-args: ${{ inputs.phpunit-extra-args }}
          working-directory: ${{ inputs.working-directory }}

  phpunit-it:
    name: PHPUnit IT
    needs:
      - pre-checks
      - setup
    permissions:
      contents: read
      checks: write
    if: ${{ needs.pre-checks.outputs.should-skip-backend != 'true' && contains(inputs.checks, 'phpunit') && needs.setup.outputs.run-phpunit-it == 'true' }}
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Setup PHP
        uses: equisoft-actions/setup-php@v1
        with:
          php-version: ${{ inputs.php-version }}
          extensions: ${{ inputs.php-extensions }}
          cache-key: ${{ env.php-cache-key }}

      - name: Composer install
        uses: equisoft-actions/composer@v1
        with:
          gpr-key: ${{ secrets.GPR_KEY }}
          working-directory: ${{ inputs.working-directory }}

      - name: PHPUnit
        uses: equisoft-actions/phpunit@v1
        with:
          report-name: phpunit-it.junit.xml
          coverage-report-name: phpunit-it.clover.xml
          extra-args: --testsuite it ${{ inputs.phpunit-extra-args }}
          working-directory: ${{ inputs.working-directory }}

  psalm:
    name: Psalm
    needs: [setup]
    if: ${{ needs.setup.outputs.run-php-long-checks == 'true' && contains(inputs.checks, 'psalm') }}
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 1000

      - name: Fetch origin branch (for psalm git diff)
        run: |
          BASE_REF=${{ github.event.pull_request.base.ref }}
          if [[ "$BASE_REF" = "" ]]; then
            BASE_REF=${{ github.event.repository.default_branch }}
          fi
          git fetch --no-tags --prune --depth=1000 origin +refs/heads/$BASE_REF:refs/remotes/origin/$BASE_REF

      - name: Setup PHP
        uses: equisoft-actions/setup-php@v1
        with:
          php-version: ${{ inputs.php-version }}
          extensions: ${{ inputs.php-extensions }}
          cache-key: ${{ env.php-cache-key }}

      - name: Composer install
        uses: equisoft-actions/composer@v1
        with:
          gpr-key: ${{ secrets.GPR_KEY }}
          working-directory: ${{ inputs.working-directory }}

      - name: Psalm
        uses: equisoft-actions/psalm@v2
        with:
          default-branch: ${{ github.event.repository.default_branch }}
          extra-args: ${{ inputs.psalm-extra-args }}
          only-changed-files: ${{ inputs.psalm-diff-only }}
          working-directory: ${{ inputs.working-directory }}

  phpcs:
    name: PHP_Codesniffer
    needs: [setup]
    permissions:
      contents: read
      checks: write
    if: ${{ needs.setup.outputs.run-php-long-checks == 'true' && contains(inputs.checks, 'phpcs') }}
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 1000

      - name: Fetch origin branch (for phpcs git diff)
        run: |
          BASE_REF=${{ github.event.pull_request.base.ref }}
          if [[ "$BASE_REF" = "" ]]; then
            BASE_REF=${{ github.event.repository.default_branch }}
          fi
          git fetch --no-tags --prune --depth=1000 origin +refs/heads/$BASE_REF:refs/remotes/origin/$BASE_REF

      - name: Setup PHP
        uses: equisoft-actions/setup-php@v1
        with:
          php-version: ${{ inputs.php-version }}
          extensions: ${{ inputs.php-extensions }}
          cache-key: ${{ env.php-cache-key }}

      - name: Composer install
        uses: equisoft-actions/composer@v1
        with:
          gpr-key: ${{ secrets.GPR_KEY }}
          working-directory: ${{ inputs.working-directory }}

      - name: PHP_Codesniffer
        uses: equisoft-actions/phpcs@v2
        with:
          only-changed-files: ${{ inputs.phpcs-diff-only }}
          default-branch: ${{ github.event.repository.default_branch }}
          working-directory: ${{ inputs.working-directory }}

  eslint:
    name: ESLint
    needs:
      - pre-checks
      - setup
    if: ${{ inputs.frontend && needs.pre-checks.outputs.should-skip-frontend != 'true' && contains(inputs.frontend-checks, 'lint') }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Setup asdf-vm
        uses: equisoft-actions/with-asdf-vm@v2
        if: ${{ needs.setup.outputs.with-asdf == 'true' }}

      - name: NPM Login
        uses: equisoft-actions/yarn-npm-login@v1
        with:
          registry: npm.pkg.github.com
          token: ${{ secrets.GPR_KEY }}

      - name: Install NPM dependencies
        uses: equisoft-actions/yarn-install@v1

      - name: Run ESLint
        uses: equisoft-actions/yarn-eslint@v2

  stylelint:
    name: stylelint
    needs:
      - pre-checks
      - setup
    if: ${{ inputs.frontend && needs.pre-checks.outputs.should-skip-frontend != 'true' && contains(inputs.frontend-checks, 'lint') && needs.setup.outputs.run-stylelint == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Setup asdf-vm
        uses: equisoft-actions/with-asdf-vm@v2
        if: ${{ needs.setup.outputs.with-asdf == 'true' }}

      - name: NPM Login
        uses: equisoft-actions/yarn-npm-login@v1
        with:
          registry: npm.pkg.github.com
          token: ${{ secrets.GPR_KEY }}

      - name: Install NPM dependencies
        uses: equisoft-actions/yarn-install@v1

      - name: Run stylelint
        uses: equisoft-actions/yarn-stylelint@v1

  js-tests:
    name: JS unit tests
    needs:
      - pre-checks
      - setup
    permissions:
      contents: read
      checks: write
    if: ${{ inputs.frontend && needs.pre-checks.outputs.should-skip-frontend != 'true' && contains(inputs.frontend-checks, 'unit-tests') }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Setup asdf-vm
        uses: equisoft-actions/with-asdf-vm@v2
        if: ${{ needs.setup.outputs.with-asdf == 'true' }}

      - name: Detect test runner
        id: test-runner
        shell: bash
        run:
          echo "use-jest=$(jq -e '.devDependencies | has("jest")' package.json)" >> $GITHUB_OUTPUT

      - name: NPM Login
        uses: equisoft-actions/yarn-npm-login@v1
        with:
          registry: npm.pkg.github.com
          token: ${{ secrets.GPR_KEY }}

      - name: Install NPM dependencies
        uses: equisoft-actions/yarn-install@v1

      - name: Run Mocha
        if: ${{ steps.test-runner.outputs.use-jest == 'false' }}
        uses: equisoft-actions/yarn-mocha@v1

      - name: Run Jest
        if: ${{ steps.test-runner.outputs.use-jest == 'true' }}
        uses: equisoft-actions/yarn-jest@v2

  yaml_validate:
    name: Yaml validation
    needs:
      - pre-checks
      - setup
    if: ${{ needs.pre-checks.outputs.should-skip-backend != 'true' && inputs.yaml-validate }}
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Setup PHP
        uses: equisoft-actions/setup-php@v1
        with:
          php-version: ${{ inputs.php-version }}
          extensions: ${{ inputs.php-extensions }}
          cache-key: ${{ env.php-cache-key }}

      - name: Composer install
        uses: equisoft-actions/composer@v1
        with:
          gpr-key: ${{ secrets.GPR_KEY }}
          working-directory: ${{ inputs.working-directory }}

      - name: Yaml validation
        working-directory: ${{ inputs.working-directory }}
        run: php ./internals/scripts/YamlLint.php

  build_backend:
    name: Build backend
    needs:
      - pre-checks
      - setup
    if: ${{ needs.pre-checks.outputs.should-skip-backend != 'true' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Setup asdf-vm
        uses: equisoft-actions/with-asdf-vm@v2
        if: ${{ needs.setup.outputs.with-asdf == 'true' }}

      - name: Setup PHP
        uses: equisoft-actions/setup-php@v1
        with:
          php-version: ${{ inputs.php-version }}
          extensions: ${{ inputs.php-extensions }}
          cache-key: ${{ env.php-cache-key }}

      - name: Update package version
        env:
          VERSION: ${{ needs.setup.outputs.version }}
        working-directory: ${{ inputs.working-directory }}
        run: |
          # Composer versions must match ^v?\d+(\.\d+){0,3}|^dev-
          if [[ $VERSION =~ ^v?[0-9]+(\.[0-9]+){0,3}$ ]]; then
            APP_VERSION="$VERSION";
          else
            APP_VERSION="dev-$VERSION";
          fi
          contents="$(jq ".version = \"${APP_VERSION}\"" ./composer.json)" && echo "${contents}" > ./composer.json

      - name: Composer install
        uses: equisoft-actions/composer@v1
        with:
          production: "true"
          gpr-key: ${{ secrets.GPR_KEY }}
          working-directory: ${{ inputs.working-directory }}

      - name: Site Config
        if: inputs.site-config-path != ''
        shell: bash
        working-directory: ${{ inputs.working-directory }}
        run: |
          sudo mkdir -p $(dirname ${{ inputs.site-config-path }})
          sudo cat <<EOF > /tmp/configs.yml
          ---
          environment: dev
          site: docker
          EOF
          sudo mv /tmp/configs.yml "${{ inputs.site-config-path }}"

      - name: Generate WSDL Files
        if: inputs.update-wsdl
        shell: bash
        working-directory: ${{ inputs.working-directory }}
        run: |
          ./script/tool API UpdateWsdl -v

      - name: Tar build output
        working-directory: ${{ inputs.working-directory }}
        run: tar -cvf backend-build-output.tar $(ls -d composer.json vendor/ apps/**/wsdl/*.xml 2>/dev/null)

      - name: Store build artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: backend-build-output
          path: ${{ inputs.working-directory }}/backend-build-output.tar
          retention-days: 1
          if-no-files-found: error

  build_frontend:
    name: Build frontend
    needs:
      - pre-checks
      - setup
    if: ${{ inputs.frontend && needs.pre-checks.outputs.should-skip-frontend != 'true' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Setup asdf-vm
        uses: equisoft-actions/with-asdf-vm@v2
        if: ${{ needs.setup.outputs.with-asdf == 'true' }}

      - name: Update package version
        env:
          VERSION: ${{ needs.setup.outputs.version }}
        working-directory: ${{ inputs.working-directory }}
        run: |
          contents="$(jq ".version = \"${VERSION}\"" ./package.json)" && echo "${contents}" > ./package.json

      - name: NPM Login
        uses: equisoft-actions/yarn-npm-login@v1
        with:
          registry: npm.pkg.github.com
          token: ${{ secrets.GPR_KEY }}

      - name: Install NPM dependencies
        uses: equisoft-actions/yarn-install@v1
        with:
          working-directory: ${{ inputs.working-directory }}

      - name: Webpack
        working-directory: ${{ inputs.working-directory }}
        run: |
          SKIP_COMPRESSION=true
          if [[ "${{ needs.setup.outputs.publishable }}" == "true" ]]; then
            SKIP_COMPRESSION=false
          fi
          NO_COMPRESS=${SKIP_COMPRESSION} yarn build:production

      - name: Tar build output
        working-directory: ${{ inputs.working-directory }}
        run: tar -cvf frontend-build-output.tar $(ls -d package.json ${{ inputs.frontend-build-path }} 2>/dev/null)

      - name: Store build artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: frontend-build-output
          path: ${{ inputs.working-directory }}/frontend-build-output.tar
          retention-days: 1
          if-no-files-found: error

  prepare_docker_runners:
    name: Prepare Docker Runners
    runs-on: ubuntu-latest
    # Because psalm is skipped we have to define all success explicitly
    if: |
      always() &&
      !contains(needs.*.result, 'failure') &&
      !contains(needs.*.result, 'cancelled') &&
      needs.setup.outputs.publishable == 'true' &&
      !failure() &&
      !cancelled()
    needs:
      - setup
    outputs:
      matrix-include: ${{ steps.combine.outputs.matrix }}
      runner-config: ${{ steps.runners.outputs.runner-config }}
    steps:
      - name: Determine platforms to build
        id: platforms
        shell: bash
        run: |
          if [[ "${{ needs.setup.outputs.is-release }}" == "true" ]]; then
            PLATFORMS="linux/amd64"
          else
            PLATFORMS="linux/amd64,linux/arm64"
          fi
          echo "platforms=${PLATFORMS}" >> $GITHUB_OUTPUT

      - name: Prepare image data
        id: runners
        uses: equisoft-actions/docker-runners@v1
        with:
          instance-size: ${{ inputs.instance-size }}
          platforms: ${{ steps.platforms.outputs.platforms }}
          use-self-hosted: ${{ inputs.use-self-hosted }}

      - name: Combine matrix
        id: combine
        shell: python
        env:
          IMAGES: ${{ needs.setup.outputs.images-matrix }}
          PLATFORMS: ${{ steps.runners.outputs.matrix-include }}
        run: |
          import json
          import os

          images: dict = json.loads(os.environ.get("IMAGES"))
          platforms: list = json.loads(os.environ.get("PLATFORMS"))
          matrix: list = []
          for image_name in images.get('include'):
            for platform in platforms:
              entry = {
                "image": image_name.get("image"),
                "dockerfile": image_name.get("dockerfile"),
                "platform": platform.get("platform"),
                "arch" : platform.get("arch")
              }
              matrix.append(entry)

          with open(os.environ.get('GITHUB_OUTPUT'), 'a') as output_file:
            output_file.write('matrix=')
            json.dump(matrix, output_file)
            output_file.write('\n')

  image:
    strategy:
      matrix:
        include: ${{ fromJSON(needs.prepare_docker_runners.outputs.matrix-include) }}
    name: Build ${{ matrix.image }}/${{ matrix.platform }} image
    runs-on: ${{ fromJSON(format(needs.prepare_docker_runners.outputs.runner-config, matrix.arch)) }}
    needs:
      - setup
      - prepare_docker_runners
      - phpunit
      - phpunit-it
      - eslint
      - stylelint
      - js-tests
      - yaml_validate
      - build_backend
      - build_frontend
    # Because psalm is skipped we have to define all success explicitly
    if: |
      always() &&
      !contains(needs.*.result, 'failure') &&
      !contains(needs.*.result, 'cancelled') &&
      needs.setup.outputs.publishable == 'true' &&
      !failure() &&
      !cancelled()
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Download backend build output
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: backend-build-output
          path: ${{ inputs.working-directory }}

      - name: Un-tar backend build output
        working-directory: ${{ inputs.working-directory }}
        run: tar -xvf backend-build-output.tar

      - name: Download frontend build output
        if: inputs.frontend
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: frontend-build-output
          path: ${{ inputs.working-directory }}

      - name: Un-tar frontend build output
        if: inputs.frontend
        working-directory: ${{ inputs.working-directory }}
        run: tar -xvf frontend-build-output.tar

      - name: Prepare image data
        id: metadata
        uses: equisoft-actions/docker-metadata@v1
        with:
          title: ${{ matrix.image }}
          image-name: ${{ inputs.registry }}/${{ matrix.image }}
          release: ${{ needs.setup.outputs.is-release }}
          version: ${{ needs.setup.outputs.version }}

      - name: Build and push
        id: build-and-push
        uses: equisoft-actions/docker-build-and-push@v3
        with:
          annotations: ${{ steps.metadata.outputs.annotations }}
          aws-region: ${{ secrets.ECR_AWS_REGION }}
          build-args: |
            APPLICATION_VERSION=${{ needs.setup.outputs.version }}
            GPR_USER=${{ secrets.GPR_USER }}
            GPR_KEY=${{ secrets.GPR_KEY }}
          dockerfile: ${{ matrix.dockerfile }}
          labels: ${{ steps.metadata.outputs.labels }}
          name: ${{ matrix.image }}
          platforms: ${{ matrix.platform }}
          push: true
          push-manifest: "false"
          registry: ${{ inputs.registry }}
          role-to-assume: ${{ inputs.role-to-assume }}
          tags: ${{ steps.metadata.outputs.tags }}
          working-directory: ${{ inputs.working-directory }}

  create-manifest:
    name: Create manifest for ${{ matrix.image }}
    runs-on: ubuntu-latest
    strategy:
      matrix: ${{ fromJSON(needs.setup.outputs.images-matrix) }}
    needs:
      - setup
      - prepare_docker_runners
      - image
    if: |
      needs.image.result == 'success' &&
      always() &&
      !contains(needs.*.result, 'failure') &&
      !contains(needs.*.result, 'cancelled') &&
      needs.setup.outputs.publishable == 'true' &&
      !failure() &&
      !cancelled()
    outputs:
      image-id: ${{ steps.create.outputs.image-id }}
      image-version: ${{ steps.create.outputs.image-version }}
    steps:
      - name: Prepare image data
        id: metadata
        uses: equisoft-actions/docker-metadata@v1
        with:
          title: ${{ matrix.image }}
          image-name: ${{ inputs.registry }}/${{ matrix.image }}
          release: ${{ needs.setup.outputs.is-release }}
          version: ${{ needs.setup.outputs.version }}

      - name: Create manifest
        id: create
        uses: equisoft-actions/create-manifest@v1
        with:
          registry: ${{ inputs.registry }}
          name: ${{ matrix.image }}
          tags: ${{ steps.metadata.outputs.tags }}
          aws-region: ${{ secrets.ECR_AWS_REGION }}
          role-to-assume: ${{ inputs.role-to-assume }}
          role-session-name: ${{ github.run_id }}

  docker-security:
    if: |
      needs.create-manifest.result == 'success' &&
      !failure() &&
      !cancelled()
    strategy:
      matrix: ${{ fromJSON(needs.setup.outputs.images-matrix) }}
    uses: equisoft-actions/docker-workflows/.github/workflows/security.yml@v2
    needs:
      - setup
      - image
      - create-manifest
    with:
      image-tag: ${{ matrix.image }}:${{ needs.create-manifest.outputs.image-version }}
      working-directory: ${{ inputs.working-directory }}
      role-to-assume: ${{ inputs.role-to-assume }}
      role-session-name: "php-docker-security-${{ github.run_id }}"
    secrets:
      REGISTRY: ${{ inputs.registry }}
      ECR_AWS_REGION: ${{ secrets.ECR_AWS_REGION }}

  openapi_yaml:
    name: Generate openapi.yaml
    needs:
      - pre-checks
      - setup
    if: ${{ needs.pre-checks.outputs.should-skip-backend != 'true' && inputs.openapi-paths != '' }}
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Setup PHP
        uses: equisoft-actions/setup-php@v1
        with:
          php-version: ${{ inputs.php-version }}
          extensions: ${{ inputs.php-extensions }}
          cache-key: ${{ env.php-cache-key }}

      - name: Composer install
        uses: equisoft-actions/composer@v1
        with:
          gpr-key: ${{ secrets.GPR_KEY }}
          working-directory: ${{ inputs.working-directory }}

      - name: Generate openapi.yaml
        id: generate
        run: |
          mkdir -p openapi/build
          arguments='${{ join(fromJSON(inputs.openapi-paths), ' ') }}'

          if [[ -n "${{ inputs.openapi-bootstrap }}" ]];
          then
            arguments="--bootstrap "${{ inputs.openapi-bootstrap }}" $arguments"
          fi

          ./vendor/bin/openapi \
            -o openapi/build/openapi.yaml \
            --format yaml \
            $arguments

      - name: Store openapi.yaml
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: openapi_yaml
          path: openapi/build/openapi.yaml
          retention-days: 1
          if-no-files-found: error

      - name: Normalize openapi filename
        id: normalize-openapi-filename
        shell: bash
        run: |
          OPENAPI_FILE=openapi/build/openapi.yaml
          NORMALIZED_OPENAPI_FILE=openapi-${{ github.event.repository.name }}-${{ needs.setup.outputs.version }}.yaml
          cp "$OPENAPI_FILE" "$NORMALIZED_OPENAPI_FILE"
          echo "normalized-openapi-file=${NORMALIZED_OPENAPI_FILE}" >> $GITHUB_OUTPUT

      - name: Upload openapi.yaml to release assets
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
        if: github.ref_type == 'tag' && needs.setup.outputs.is-release == 'true'
        with:
          files: |
            ${{ steps.normalize-openapi-filename.outputs.normalized-openapi-file }}

  generate_sdk:
    strategy:
      matrix:
        generator: ${{ fromJSON(inputs.sdks) }}
    name: Generate ${{ matrix.generator }} SDK
    needs:
      - setup
      - phpunit
      - openapi_yaml
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Download
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: openapi_yaml
          path: openapi/build

      - name: Setup asdf-vm
        uses: equisoft-actions/with-asdf-vm@v2
        if: ${{ needs.setup.outputs.with-asdf == 'true' }}

      - name: Setup PHP
        uses: equisoft-actions/setup-php@v1
        if: matrix.generator == 'php'
        with:
          php-version: ${{ inputs.php-version }}
          extensions: ${{ inputs.php-extensions }}
          cache-key: ${{ env.php-cache-key }}

      - name: Generate SDK
        uses: equisoft-actions/generate-openapi-sdk@v2
        with:
          working-directory: openapi
          generator-name: ${{ matrix.generator }}
          openapi-spec-file: build/openapi.yaml
          is-release: ${{ needs.setup.outputs.is-release }}
          publish: ${{ needs.setup.outputs.publishable == 'true' && needs.setup.outputs.is-hotfix != 'true' }}
          publish-pat: ${{ secrets.GPR_KEY }}
          gradle-properties: |
            application.version=${{ needs.setup.outputs.version }}
            gpr.user=${{ secrets.GPR_USER }}
            gpr.key=${{ secrets.GPR_KEY }}
            gpr.write.key=${{ secrets.GPR_KEY }}

  createSentryRelease:
    name: Create sentry release
    needs:
      - setup
      - image

    if: |
      always() &&
      inputs.sentry-project != '' &&
      needs.setup.outputs.is-release == 'true' &&
      needs.image.result == 'success' &&
      !contains(needs.*.result, 'failure') &&
      !contains(needs.*.result, 'cancelled') &&
      !failure() &&
      !cancelled()
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Download frontend build output
        if: inputs.frontend
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
        with:
          name: frontend-build-output
          path: ${{ inputs.working-directory }}

      - name: Un-tar frontend build output
        if: inputs.frontend
        working-directory: ${{ inputs.working-directory }}
        run: tar -xvf frontend-build-output.tar

      - name: Resolve URL prefix
        id: resolve-prefix
        run: |
          VERSION="${{ needs.setup.outputs.version }}"
          RESOLVED_PREFIX="${{ inputs.sentry-sourcemaps-url-prefix }}"
          RESOLVED_PREFIX="${RESOLVED_PREFIX//%VERSION%/$VERSION}"
          echo "url-prefix=${RESOLVED_PREFIX}" >> $GITHUB_OUTPUT

      - name: Create Sentry release
        uses: getsentry/action-release@e6703d0b00208e0b3687ba660d18ab5af7892821 # v3
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ inputs.sentry-project }}
        with:
          release: ${{ inputs.sentry-project }}@${{ needs.setup.outputs.version }}
          release_prefix: ''
          set_commits: auto
          inject: ${{ inputs.sentry-sourcemaps-inject-debug-id }}
          url_prefix: ${{ steps.resolve-prefix.outputs.url-prefix }}
          sourcemaps: ${{ inputs.sentry-sourcemaps-path }}

  workflow-status:
    name: Workflow status
    runs-on: ubuntu-latest
    needs:
      - pre-checks
      - setup
      - phpunit
      - phpunit-it
      - psalm
      - phpcs
      - eslint
      - stylelint
      - js-tests
      - yaml_validate
      - build_backend
      - build_frontend
      - image
      - docker-security
      - openapi_yaml
      - generate_sdk
      - createSentryRelease
    if: always()
    steps:
      - name: Post workflow status
        uses: equisoft-actions/notify-workflow-status@v2
        with:
          needs: ${{ toJSON(needs) }}
          slack-enabled: ${{ github.event_name == 'push' }}
          downgrade-to-warning: docker-security,generate_sdk
          slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
          slack-channel: ${{ inputs.slack-channel || github.event.repository.custom_properties.ci_slack_channel }}