RijksICTGilde
diff --git a/‎CHANGELOG.md‎
Lines changed: 19 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 19 additions & 0 deletions
diff --git a/‎cleanup/action.yml‎
Lines changed: 33 additions & 69 deletions b/‎cleanup/action.yml‎
Lines changed: 33 additions & 69 deletions
@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Changed
+- **all actions**: Replace curl+bash API layer with [zad-cli](https://github.com/RijksICTGilde/zad-cli) (pinned to v0.1.1)
+  - **deploy**: ~200 lines of curl/jq/polling replaced by single `zad deployment create` call
+  - **cleanup**: ~80 lines of curl/polling replaced by single `zad deployment delete` call
+  - **scheduled-cleanup**: same inline curl/polling replaced by shared `zad_delete_deployment` helper
+  - Retry logic, task polling, and error handling now delegated to the CLI
+  - Net reduction: ~310 lines of duplicated bash
+- **scripts/zad-common.sh**: Rewritten — `curl_with_retry`, `poll_task`, and `build_poll_url` replaced by `install_zad_cli`, `validate_input`, `validate_integer`, `report_zad_error`, and `zad_delete_deployment`
+- **all actions**: ZAD configuration now uses `ZAD_*` env vars (`ZAD_API_URL`, `ZAD_PROJECT_ID`, `ZAD_MAX_RETRIES`, `ZAD_RETRY_DELAY`, `ZAD_TASK_TIMEOUT`, `ZAD_TASK_POLL_INTERVAL`) consumed directly by the CLI
+
+### Added
+- **all actions**: `astral-sh/setup-uv` step to ensure `uv` is available on GitHub runners
+- **all actions**: `$HOME/.local/bin` added to `GITHUB_PATH` after install so `zad` is available across steps
+
+### Fixed
+- **all actions**: `validate_input` and `validate_integer` now `exit 1` instead of `return 1` (validation failures were silently ignored without `set -e`)
+- **scheduled-cleanup**: Add missing `validate_input "project-id"` check (was present in deploy and cleanup but missing here)
+- **all actions**: Improve error message when CLI fails with no HTTP status code
+
 ## [3.2.0] - 2026-03-20
 
 ### Added
 
@@ -135,90 +135,54 @@ runs:
         done
         echo "skipped=false" >> "$GITHUB_OUTPUT"
 
+    - name: Setup uv
+      if: steps.bot-check.outputs.skipped != 'true'
+      uses: astral-sh/setup-uv@v6
+
+    - name: Install zad-cli
+      if: steps.bot-check.outputs.skipped != 'true'
+      shell: bash
+      run: |
+        # shellcheck source=../scripts/zad-common.sh
+        source "$GITHUB_ACTION_PATH/../scripts/zad-common.sh"
+        install_zad_cli
+
     - name: Delete ZAD Deployment
       id: delete-zad
       if: steps.bot-check.outputs.skipped != 'true'
       shell: bash
       env:
         ZAD_API_KEY: ${{ inputs.api-key }}
-        PROJECT_ID: ${{ inputs.project-id }}
+        ZAD_API_URL: ${{ inputs.api-base-url }}
+        ZAD_PROJECT_ID: ${{ inputs.project-id }}
+        ZAD_MAX_RETRIES: ${{ inputs.max-retries }}
+        ZAD_RETRY_DELAY: ${{ inputs.retry-delay }}
+        ZAD_TASK_TIMEOUT: ${{ inputs.task-timeout }}
+        ZAD_TASK_POLL_INTERVAL: ${{ inputs.task-poll-interval }}
         DEPLOYMENT_NAME: ${{ inputs.deployment-name }}
-        API_BASE_URL: ${{ inputs.api-base-url }}
-        MAX_RETRIES: ${{ inputs.max-retries }}
-        RETRY_DELAY: ${{ inputs.retry-delay }}
-        TASK_TIMEOUT: ${{ inputs.task-timeout }}
-        TASK_POLL_INTERVAL: ${{ inputs.task-poll-interval }}
+        NO_COLOR: '1'
       run: |
-        # Validate inputs FIRST (before logging)
-        # Allow alphanumeric, hyphens, underscores, and dots
-        if ! echo "$PROJECT_ID" | grep -qE '^[a-zA-Z0-9._-]+$'; then
-          echo "Error: project-id contains invalid characters (allowed: a-z, A-Z, 0-9, ., _, -)"
-          exit 1
-        fi
-        if ! echo "$DEPLOYMENT_NAME" | grep -qE '^[a-zA-Z0-9._-]+$'; then
-          echo "Error: deployment-name contains invalid characters (allowed: a-z, A-Z, 0-9, ., _, -)"
-          exit 1
-        fi
-        if ! echo "$MAX_RETRIES" | grep -qE '^[0-9]+$'; then
-          echo "Error: max-retries must be a non-negative integer"
-          exit 1
-        fi
-        if ! echo "$RETRY_DELAY" | grep -qE '^[0-9]+$'; then
-          echo "Error: retry-delay must be a non-negative integer"
-          exit 1
-        fi
-        if ! echo "$TASK_TIMEOUT" | grep -qE '^[0-9]+$'; then
-          echo "Error: task-timeout must be a non-negative integer"
-          exit 1
-        fi
-        if ! echo "$TASK_POLL_INTERVAL" | grep -qE '^[0-9]+$'; then
-          echo "Error: task-poll-interval must be a non-negative integer"
-          exit 1
-        fi
-
-        # Now safe to log
-        echo "Deleting ZAD deployment: $DEPLOYMENT_NAME from project: $PROJECT_ID"
-
-        # Load shared helpers (curl_with_retry, poll_task, build_poll_url)
         # shellcheck source=../scripts/zad-common.sh
         source "$GITHUB_ACTION_PATH/../scripts/zad-common.sh"
 
-        if curl_with_retry "$API_BASE_URL/v2/projects/$PROJECT_ID/$DEPLOYMENT_NAME" \
-            -X DELETE \
-            -H "X-API-Key: $ZAD_API_KEY"; then
+        # Validate inputs FIRST (before logging, to prevent injection)
+        validate_input "project-id" "$ZAD_PROJECT_ID"
+        validate_input "deployment-name" "$DEPLOYMENT_NAME"
+        validate_integer "max-retries" "$ZAD_MAX_RETRIES"
+        validate_integer "retry-delay" "$ZAD_RETRY_DELAY"
+        validate_integer "task-timeout" "$ZAD_TASK_TIMEOUT"
+        validate_integer "task-poll-interval" "$ZAD_TASK_POLL_INTERVAL"
 
-          TASK_ID=$(echo "$FINAL_BODY" | jq -r '.task_id' 2>/dev/null)
-          POLL_URL=$(echo "$FINAL_BODY" | jq -r '.poll_url' 2>/dev/null)
-          echo "Delete task accepted (ID: $TASK_ID), polling for completion..."
+        echo "Deleting ZAD deployment: $DEPLOYMENT_NAME from project: $ZAD_PROJECT_ID"
 
-          FULL_POLL_URL=$(build_poll_url "$POLL_URL")
+        zad_delete_deployment "$DEPLOYMENT_NAME"
 
-          if poll_task "$FULL_POLL_URL"; then
-            echo "ZAD deployment deleted successfully"
-            echo "deleted=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::error::ZAD deployment delete task did not complete successfully"
-            echo "deleted=false" >> "$GITHUB_OUTPUT"
-          fi
-        else
-          if [ "$FINAL_HTTP_CODE" -eq 404 ]; then
-            echo "ZAD deployment not found (already deleted?)"
-            echo "deleted=false" >> "$GITHUB_OUTPUT"
-          elif [ "$FINAL_HTTP_CODE" -eq 000 ]; then
-            echo "::warning::Unable to connect to ZAD API - network issue or API unavailable"
-            echo "deleted=false" >> "$GITHUB_OUTPUT"
-          elif [ "$FINAL_HTTP_CODE" -eq 401 ]; then
-            echo "::warning::Authentication failed (HTTP 401) - verify ZAD_API_KEY is correct"
-            echo "deleted=false" >> "$GITHUB_OUTPUT"
-          elif [ "$FINAL_HTTP_CODE" -eq 403 ]; then
-            echo "::warning::Access denied (HTTP 403) - API key may lack permission for project '$PROJECT_ID'"
-            echo "deleted=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::Failed to delete ZAD deployment (HTTP $FINAL_HTTP_CODE)"
-            echo "$FINAL_BODY"
-            echo "deleted=false" >> "$GITHUB_OUTPUT"
-          fi
+        if [ "$DELETE_RESULT" = "true" ]; then
+          echo "ZAD deployment deleted successfully"
+        elif [ "$DELETE_REASON" = "not_found" ]; then
+          echo "ZAD deployment not found (already deleted?)"
         fi
+        echo "deleted=$DELETE_RESULT" >> "$GITHUB_OUTPUT"
 
     - name: Delete GitHub Deployments
       id: delete-github-deployments