action.yml

# SPDX-License-Identifier: EUPL-1.2
name: 'Deploy to ZAD'
description: 'Deploy a container image to ZAD Operations Manager'
author: 'RijksICTGilde'

branding:
  icon: 'upload-cloud'
  color: 'blue'

inputs:
  api-key:
    description: 'ZAD API key (ZAD_API_KEY secret)'
    required: true
  project-id:
    description: 'ZAD project identifier (e.g., regel-k4c)'
    required: true
  deployment-name:
    description: 'Name of the deployment (e.g., pr-73, production)'
    required: true
  component:
    description: 'Component reference (e.g., editor, api, my.service). Ignored when components is set.'
    required: false
    default: ''
  image:
    description: 'Full container image URI (e.g., ghcr.io/org/app:tag). Ignored when components is set.'
    required: false
    default: ''
  components:
    description: 'JSON array of components to deploy: [{"name": "web", "image": "ghcr.io/org/app:tag"}]. Takes precedence over component/image.'
    required: false
    default: ''
  clone-from:
    description: 'Clone configuration from existing deployment (optional)'
    required: false
    default: ''
  force-clone:
    description: 'Force clone even if deployment exists (optional, default: false)'
    required: false
    default: 'false'
  api-base-url:
    description: 'ZAD Operations Manager API base URL'
    required: false
    default: 'https://operations-manager.rig.prd1.gn2.quattro.rijksapps.nl/api'
  task-timeout:
    description: 'Maximum time in seconds to wait for async task completion'
    required: false
    default: '300'
  task-poll-interval:
    description: 'Seconds between task status polls'
    required: false
    default: '3'
  comment-on-pr:
    description: 'Post/update a comment on the PR with the deployment URL'
    required: false
    default: 'false'
  github-token:
    description: 'GitHub token for PR commenting (defaults to automatic token)'
    required: false
    default: '${{ github.token }}'
  comment-header:
    description: 'Custom header for the PR comment (default: "## 🚀 Preview Deployment")'
    required: false
    default: '## 🚀 Preview Deployment'
  wait-for-ready:
    description: 'Wait for deployment to be reachable before continuing'
    required: false
    default: 'false'
  health-endpoint:
    description: 'Endpoint to check for readiness (e.g., /, /health)'
    required: false
    default: '/'
  wait-timeout:
    description: 'Maximum time to wait for deployment in seconds'
    required: false
    default: '300'
  wait-interval:
    description: 'Seconds between readiness checks'
    required: false
    default: '10'
  qr-code:
    description: 'Include QR code in PR comment for mobile access (generated locally via qrencode)'
    required: false
    default: 'false'
  skip-bot-prs:
    description: 'Skip deployment for PRs created by bots (dependabot, renovate, pre-commit-ci, etc.)'
    required: false
    default: 'true'
  max-retries:
    description: 'Maximum number of retries for transient ZAD API errors (0 to disable)'
    required: false
    default: '3'
  retry-delay:
    description: 'Initial retry delay in seconds (doubles each retry)'
    required: false
    default: '2'
  path-suffix:
    description: 'Path to append to the deployment URL (e.g. /docs/)'
    required: false
    default: ''
  domain-format:
    description: 'URL format template ID for hostname generation (e.g., component-deployment-subdomain, deployment.project)'
    required: false
    default: ''
  subdomain:
    description: 'Subdomain for URL generation. Required when domain-format contains "subdomain". Must be a valid DNS label.'
    required: false
    default: ''
  base-domain:
    description: 'Base domain for URL generation (e.g., rijksapp.nl). Must be a cluster-supported domain.'
    required: false
    default: ''

outputs:
  url:
    description: 'URL of the deployed application (first component when using components input)'
    value: ${{ steps.deploy.outputs.url }}
  urls:
    description: 'JSON object mapping component names to URLs (only set when using components input)'
    value: ${{ steps.deploy.outputs.urls }}
  skipped:
    description: 'Whether deployment was skipped due to bot PR detection'
    value: ${{ steps.bot-check.outputs.skipped == 'true' && 'true' || 'false' }}

runs:
  using: 'composite'
  steps:
    - name: Check for bot PR
      id: bot-check
      if: inputs.skip-bot-prs == 'true' && (github.event_name == 'pull_request' || github.event_name == 'pull_request_target')
      shell: bash
      env:
        PR_AUTHOR: ${{ github.event.pull_request.user.login }}
        PR_AUTHOR_TYPE: ${{ github.event.pull_request.user.type }}
      run: |
        KNOWN_BOTS=("dependabot[bot]" "renovate[bot]" "pre-commit-ci[bot]" "github-actions[bot]")
        if [ "$PR_AUTHOR_TYPE" = "Bot" ]; then
          echo "::notice::Skipping: PR author '$PR_AUTHOR' is a bot (type: $PR_AUTHOR_TYPE)"
          echo "skipped=true" >> "$GITHUB_OUTPUT"
          exit 0
        fi
        for bot in "${KNOWN_BOTS[@]}"; do
          if [ "$PR_AUTHOR" = "$bot" ]; then
            echo "::notice::Skipping: PR author '$PR_AUTHOR' is a known bot"
            echo "skipped=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
        done
        echo "skipped=false" >> "$GITHUB_OUTPUT"

    - name: Setup uv
      if: steps.bot-check.outputs.skipped != 'true'
      uses: astral-sh/setup-uv@v6

    - name: Install zad-cli
      if: steps.bot-check.outputs.skipped != 'true'
      shell: bash
      run: |
        # shellcheck source=../scripts/zad-common.sh
        source "$GITHUB_ACTION_PATH/../scripts/zad-common.sh"
        install_zad_cli

    - name: Deploy to ZAD
      id: deploy
      if: steps.bot-check.outputs.skipped != 'true'
      shell: bash
      env:
        ZAD_API_KEY: ${{ inputs.api-key }}
        ZAD_API_URL: ${{ inputs.api-base-url }}
        ZAD_PROJECT_ID: ${{ inputs.project-id }}
        ZAD_MAX_RETRIES: ${{ inputs.max-retries }}
        ZAD_RETRY_DELAY: ${{ inputs.retry-delay }}
        ZAD_TASK_TIMEOUT: ${{ inputs.task-timeout }}
        ZAD_TASK_POLL_INTERVAL: ${{ inputs.task-poll-interval }}
        DEPLOYMENT_NAME: ${{ inputs.deployment-name }}
        COMPONENT: ${{ inputs.component }}
        IMAGE: ${{ inputs.image }}
        COMPONENTS: ${{ inputs.components }}
        CLONE_FROM: ${{ inputs.clone-from }}
        FORCE_CLONE: ${{ inputs.force-clone }}
        PATH_SUFFIX: ${{ inputs.path-suffix }}
        DOMAIN_FORMAT: ${{ inputs.domain-format }}
        SUBDOMAIN: ${{ inputs.subdomain }}
        BASE_DOMAIN: ${{ inputs.base-domain }}
        NO_COLOR: '1'
      run: |
        # shellcheck source=../scripts/zad-common.sh
        source "$GITHUB_ACTION_PATH/../scripts/zad-common.sh"

        # Validate inputs FIRST (before logging, to prevent injection)
        validate_input "project-id" "$ZAD_PROJECT_ID"
        validate_input "deployment-name" "$DEPLOYMENT_NAME"
        validate_input "clone-from" "$CLONE_FROM" true
        validate_integer "max-retries" "$ZAD_MAX_RETRIES"
        validate_integer "retry-delay" "$ZAD_RETRY_DELAY"
        validate_integer "task-timeout" "$ZAD_TASK_TIMEOUT"
        validate_integer "task-poll-interval" "$ZAD_TASK_POLL_INTERVAL"
        validate_input "domain-format" "$DOMAIN_FORMAT" true
        validate_input "subdomain" "$SUBDOMAIN" true
        validate_input "base-domain" "$BASE_DOMAIN" true

        # Determine mode and validate component inputs
        MULTI_COMPONENT=false
        if [ -n "$COMPONENTS" ]; then
          MULTI_COMPONENT=true

          if ! echo "$COMPONENTS" | jq empty 2>/dev/null; then
            echo "Error: components input is not valid JSON"
            exit 1
          fi

          COMP_COUNT=$(echo "$COMPONENTS" | jq 'length')
          if [ "$COMP_COUNT" -eq 0 ]; then
            echo "Error: components array must contain at least one entry"
            exit 1
          fi

          INVALID=$(echo "$COMPONENTS" | jq -r '.[] | select(.name == null or .name == ""
            or .image == null or .image == "")
            | "missing name or image"' | head -n1)
          if [ -n "$INVALID" ]; then
            echo "Error: each component must have a non-empty 'name' and 'image'"
            exit 1
          fi

          BAD_NAMES=$(echo "$COMPONENTS" | jq -r '.[].name' | grep -vE '^[a-zA-Z0-9._-]+$' || true)
          if [ -n "$BAD_NAMES" ]; then
            echo "Error: component name(s) contain invalid characters: $BAD_NAMES"
            exit 1
          fi
        elif [ -n "$COMPONENT" ] && [ -n "$IMAGE" ]; then
          validate_input "component" "$COMPONENT"
        else
          echo "Error: either 'components' or both 'component' and 'image' must be provided"
          exit 1
        fi

        # Validate domain inputs (not validated by CLI)
        if [ -n "$DOMAIN_FORMAT" ] && echo "$DOMAIN_FORMAT" | grep -q "subdomain" && [ -z "$SUBDOMAIN" ]; then
          echo "Error: subdomain is required when domain-format contains 'subdomain'"
          exit 1
        fi

        # Log inputs
        echo "Deploying to ZAD..."
        echo "Project: $ZAD_PROJECT_ID"
        echo "Deployment: $DEPLOYMENT_NAME"
        if [ "$MULTI_COMPONENT" = "true" ]; then
          echo "Components:"
          echo "$COMPONENTS" | jq -r '.[] | "  - \(.name): \(.image)"'
        else
          echo "Component: $COMPONENT"
          echo "Image: $IMAGE"
        fi
        if [ -n "$CLONE_FROM" ]; then
          echo "Cloning config from: $CLONE_FROM (force: $FORCE_CLONE)"
        fi

        # Build zad CLI command
        ZAD_CMD=(zad --output json deployment create "$DEPLOYMENT_NAME" --yes)

        if [ "$MULTI_COMPONENT" = "true" ]; then
          ZAD_CMD+=(--components "$COMPONENTS")
        else
          ZAD_CMD+=(--component "$COMPONENT" --image "$IMAGE")
        fi

        if [ -n "$CLONE_FROM" ]; then
          ZAD_CMD+=(--clone-from "$CLONE_FROM")
          if [ "$FORCE_CLONE" = "true" ]; then
            ZAD_CMD+=(--force-clone)
          fi
        fi
        if [ -n "$DOMAIN_FORMAT" ]; then
          ZAD_CMD+=(--domain-format "$DOMAIN_FORMAT")
        fi
        if [ -n "$SUBDOMAIN" ]; then
          ZAD_CMD+=(--subdomain "$SUBDOMAIN")
        fi
        if [ -n "$BASE_DOMAIN" ]; then
          ZAD_CMD+=(--base-domain "$BASE_DOMAIN")
        fi

        # Execute CLI (retry, polling, error handling all built in)
        # In --output json mode, errors go to stdout as JSON with status_code
        RESULT=$("${ZAD_CMD[@]}") && ZAD_EXIT=0 || ZAD_EXIT=$?

        if [ "$ZAD_EXIT" -ne 0 ]; then
          report_zad_error "Deployment" "$RESULT" "$ZAD_PROJECT_ID"
          exit 1
        fi

        echo "Deployment successful"

        # Extract URLs from CLI output
        # CLI returns unwrapped task result: .urls.<deployment>.urls.<component>
        if [ "$MULTI_COMPONENT" = "true" ]; then
          ALL_URLS=$(echo "$RESULT" | jq -c ".urls.\"${DEPLOYMENT_NAME}\".urls // {}" 2>/dev/null)
          if [ -z "$ALL_URLS" ] || [ "$ALL_URLS" = "{}" ] || [ "$ALL_URLS" = "null" ]; then
            echo "::error::Could not extract URLs from result"
            echo "$RESULT" | jq . 2>/dev/null || echo "$RESULT"
            exit 1
          fi
          if [ -n "$PATH_SUFFIX" ]; then
            ALL_URLS=$(echo "$ALL_URLS" | jq -c --arg suffix "/${PATH_SUFFIX#/}" \
              'to_entries | map(.value = (.value | rtrimstr("/")) + $suffix) | from_entries')
          fi
          echo "urls=$ALL_URLS" >> "$GITHUB_OUTPUT"
          FIRST_COMP=$(echo "$COMPONENTS" | jq -r '.[0].name')
          URL=$(echo "$ALL_URLS" | jq -r ".\"${FIRST_COMP}\"" 2>/dev/null)
          echo "url=$URL" >> "$GITHUB_OUTPUT"
          echo "Deployed components:"
          echo "$ALL_URLS" | jq -r 'to_entries[] | "  \(.key): \(.value)"'
        else
          URL=$(echo "$RESULT" | jq -r ".urls.\"${DEPLOYMENT_NAME}\".urls.\"${COMPONENT}\"" 2>/dev/null)
          if [ -z "$URL" ] || [ "$URL" = "null" ]; then
            echo "::error::Could not extract URL from result"
            echo "$RESULT" | jq . 2>/dev/null || echo "$RESULT"
            exit 1
          fi
          if [ -n "$PATH_SUFFIX" ]; then
            URL="${URL%/}/${PATH_SUFFIX#/}"
          fi
          echo "url=$URL" >> "$GITHUB_OUTPUT"
          echo "Deployed to: $URL"
        fi

    - name: Wait for deployment to be ready
      if: steps.bot-check.outputs.skipped != 'true' && inputs.wait-for-ready == 'true'
      shell: bash
      env:
        DEPLOYMENT_URL: ${{ steps.deploy.outputs.url }}
        DEPLOYMENT_URLS: ${{ steps.deploy.outputs.urls }}
        COMPONENTS: ${{ inputs.components }}
        HEALTH_ENDPOINT: ${{ inputs.health-endpoint }}
        WAIT_TIMEOUT: ${{ inputs.wait-timeout }}
        WAIT_INTERVAL: ${{ inputs.wait-interval }}
      run: |
        # Build list of URLs to check (tab-separated: name\turl)
        if [ -n "$COMPONENTS" ] && [ -n "$DEPLOYMENT_URLS" ]; then
          PENDING=$(echo "$DEPLOYMENT_URLS" | jq -r 'to_entries[] | "\(.key)\t\(.value)"')
        else
          PENDING=$(printf "deployment\t%s" "$DEPLOYMENT_URL")
        fi

        echo "Waiting for $(echo "$PENDING" | wc -l | tr -d ' ') endpoint(s) to be ready..."
        ELAPSED=0
        while [ -n "$PENDING" ] && [ "$ELAPSED" -lt "$WAIT_TIMEOUT" ]; do
          STILL_PENDING=""
          while IFS=$'\t' read -r name url; do
            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "${url}${HEALTH_ENDPOINT}" || echo "000")
            if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 400 ]; then
              echo "$name is ready (HTTP $HTTP_CODE)"
            else
              STILL_PENDING+="${name}\t${url}\n"
            fi
          done <<< "$PENDING"
          PENDING=$(printf '%b' "$STILL_PENDING" | sed '/^$/d')
          if [ -n "$PENDING" ]; then
            echo "Waiting... (${ELAPSED}s elapsed)"
            sleep "$WAIT_INTERVAL"
            ELAPSED=$((ELAPSED + WAIT_INTERVAL))
          fi
        done

        if [ -n "$PENDING" ]; then
          NAMES=$(echo "$PENDING" | cut -f1 | paste -sd', ')
          echo "::error::Endpoint(s) not ready within ${WAIT_TIMEOUT}s: $NAMES"
          exit 1
        fi

    - name: Generate QR code
      id: qr
      if: >-
        steps.bot-check.outputs.skipped != 'true'
        && inputs.qr-code == 'true'
        && inputs.comment-on-pr == 'true'
        && github.event_name == 'pull_request'
      shell: bash
      env:
        DEPLOYMENT_URL: ${{ steps.deploy.outputs.url }}
      run: |
        sudo apt-get install -y qrencode >/dev/null 2>&1 || true
        if command -v qrencode &> /dev/null; then
          QR_TEXT=$(qrencode -t UTF8 -m 0 -l L -o - "$DEPLOYMENT_URL")
          # Use delimiter for multi-line output
          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
          {
            echo "html<<$EOF"
            printf '<details>\n<summary>📱 Scan to open on mobile</summary>\n\n```\n'
            echo "$QR_TEXT"
            printf '```\n\n</details>'
            echo ""
            echo "$EOF"
          } >> "$GITHUB_OUTPUT"
        else
          echo "Warning: qrencode not available, skipping QR code"
        fi

    - name: Comment on PR
      if: steps.bot-check.outputs.skipped != 'true' && inputs.comment-on-pr == 'true' && github.event_name == 'pull_request'
      shell: bash
      env:
        GH_TOKEN: ${{ inputs.github-token }}
        DEPLOYMENT_URL: ${{ steps.deploy.outputs.url }}
        DEPLOYMENT_URLS: ${{ steps.deploy.outputs.urls }}
        COMMENT_HEADER: ${{ inputs.comment-header }}
        PR_NUMBER: ${{ github.event.pull_request.number }}
        GITHUB_REPOSITORY: ${{ github.repository }}
        QR_HTML: ${{ steps.qr.outputs.html }}
        COMPONENT: ${{ inputs.component }}
        COMPONENTS: ${{ inputs.components }}
      run: |
        if [ -n "$COMPONENTS" ] && [ -n "$DEPLOYMENT_URLS" ]; then
          # Multi-component: single comment with all URLs
          COMMENT_BODY="${COMMENT_HEADER}"$'\n\n'
          COMMENT_BODY+="Your changes have been deployed to a preview environment:"$'\n\n'
          while IFS=$'\t' read -r comp_name comp_url; do
            COMMENT_BODY+="**${comp_name}:** ${comp_url}"$'\n\n'
          done < <(echo "$DEPLOYMENT_URLS" | jq -r 'to_entries[] | "\(.key)\t\(.value)"')
          if [ -n "$QR_HTML" ]; then
            COMMENT_BODY+="${QR_HTML}"$'\n\n'
          fi
          COMMENT_BODY+="This deployment will be automatically cleaned up when the PR is closed."

          # Match on the main header (not component-specific)
          MATCH_HEADER="${COMMENT_HEADER}"
        else
          # Single-component: per-component comment
          # Cleanup action still matches all via startswith(COMMENT_HEADER).
          COMPONENT_HEADER="${COMMENT_HEADER} — ${COMPONENT}"

          COMMENT_BODY="${COMPONENT_HEADER}"$'\n\n'
          COMMENT_BODY+="Your changes have been deployed to a preview environment:"$'\n\n'
          COMMENT_BODY+="**URL:** ${DEPLOYMENT_URL}"$'\n\n'
          if [ -n "$QR_HTML" ]; then
            COMMENT_BODY+="${QR_HTML}"$'\n\n'
          fi
          COMMENT_BODY+="This deployment will be automatically cleaned up when the PR is closed."

          MATCH_HEADER="${COMPONENT_HEADER}"
        fi

        # Check for existing comment
        EXISTING_COMMENT_ID=$(gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
          --jq ".[] | select(.body | startswith(\"${MATCH_HEADER}\")) | .id" \
          2>/dev/null | head -n1 || echo "")

        if [ -n "$EXISTING_COMMENT_ID" ]; then
          echo "Updating existing PR comment (ID: $EXISTING_COMMENT_ID)"
          gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${EXISTING_COMMENT_ID}" \
            -X PATCH \
            -f body="$COMMENT_BODY" \
            --silent
          echo "PR comment updated"
        else
          echo "Creating new PR comment"
          gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
            -X POST \
            -f body="$COMMENT_BODY" \
            --silent
          echo "PR comment created"
        fi