action.yml

---
name: Config NPM
description: GitHub Action to configure NPM build environment with build number, authentication, and default settings
inputs:
  working-directory:
    description: Relative path under github.workspace to execute the build in
    default: .
  artifactory-reader-role:
    description: Suffix for the Artifactory reader role in Vault. Defaults to `private-reader` for private repositories, and `public-reader`
      for public repositories.
    default: ''
  disable-caching:
    description: Whether to disable NPM caching entirely
    default: 'false'
  cache-npm:
    description: Deprecated. Use `disable-caching` instead. Whether to cache NPM dependencies.
    default: 'true'
  repox-url:
    description: URL for Repox
    default: https://repox.jfrog.io
  repox-artifactory-url:
    description: URL for Repox Artifactory API (overrides repox-url/artifactory if provided)
    default: ''
  host-actions-root:
    description: Path to the actions folder on the host (used when called from another local action)
    default: ''

outputs:
  BUILD_NUMBER:
    description: The current build number. Also set as environment variable BUILD_NUMBER.
    value: ${{ steps.get_build_number.outputs.BUILD_NUMBER }}
  current-version:
    description: The project version set in package.json (before replacement). Also set as environment variable CURRENT_VERSION.
    value: ${{ steps.set_version.outputs.current-version }}
  project-version:
    description: The project version with build number (after replacement). Also set as environment variable PROJECT_VERSION.
    value: ${{ steps.set_version.outputs.project-version }}

runs:
  using: composite
  steps:
    - id: config-npm-completed
      if: env.CONFIG_NPM_COMPLETED != ''
      shell: bash
      run: |
        echo "Action already called by $CONFIG_NPM_COMPLETED, execution skipped."
        echo "skip=true" >> $GITHUB_OUTPUT

    - id: setup
      if: steps.config-npm-completed.outputs.skip != 'true'
      shell: bash
      env:
        ARTIFACTORY_READER_ROLE: ${{ inputs.artifactory-reader-role != '' && inputs.artifactory-reader-role ||
          (github.event.repository.visibility == 'public' && 'public-reader' || 'private-reader') }}
        CACHE_NPM: ${{ inputs.cache-npm }}
      run: |
        echo "::group::Fix for using local actions"
        echo "GITHUB_ACTION_PATH=$GITHUB_ACTION_PATH"
        echo "github.action_path=${{ github.action_path }}"
        ACTION_PATH_CONFIG_NPM="${{ github.action_path }}"
        host_actions_root="${{ inputs.host-actions-root }}"
        if [[ -z "$host_actions_root" ]]; then
          host_actions_root="$(dirname "$ACTION_PATH_CONFIG_NPM")"
        else
          ACTION_PATH_CONFIG_NPM="$host_actions_root/config-npm"
        fi
        echo "ACTION_PATH_CONFIG_NPM=$ACTION_PATH_CONFIG_NPM"
        echo "ACTION_PATH_CONFIG_NPM=$ACTION_PATH_CONFIG_NPM" >> "$GITHUB_ENV"
        echo "host_actions_root=$host_actions_root" >> "$GITHUB_OUTPUT"

        mkdir -p ".actions"
        ln -sf "$host_actions_root/get-build-number" .actions/get-build-number
        ln -sf "$host_actions_root/shared" .actions/shared
        ls -la .actions/*
        echo "::endgroup::"

        echo "::group::Backup mise files to configure NPM without interference"
        mise_backup=$(mktemp -d)
        echo "MISE_BACKUP=$mise_backup" >> "$GITHUB_OUTPUT"
        mv mise.* .mise.* mise/ .mise/ .tool-versions "$mise_backup/" 2>/dev/null || true
        cp "$ACTION_PATH_CONFIG_NPM/mise.local.toml" mise.local.toml
        echo "::endgroup::"

        echo "ARTIFACTORY_READER_ROLE=${ARTIFACTORY_READER_ROLE}" >> "$GITHUB_ENV"
        if [[ "$CACHE_NPM" != "true" ]]; then
          echo "::warning::The \`cache-npm\` input is deprecated and will be removed in future releases." \
            "Use \`disable-caching\` instead." >&2
        fi

    - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
      if: steps.config-npm-completed.outputs.skip != 'true'
      with:
        version: 2026.3.7

    - uses: SonarSource/vault-action-wrapper@c154b4a417b51cb98dd71137f49bf20e77c56820 # 3.4.0
      if: steps.config-npm-completed.outputs.skip != 'true'
      id: secrets
      with:
        secrets: |
          development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
          development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;

    - name: Configure NPM authentication
      if: steps.config-npm-completed.outputs.skip != 'true'
      shell: bash
      env:
        ARTIFACTORY_URL: ${{ inputs.repox-artifactory-url != '' && inputs.repox-artifactory-url ||
          format('{0}/artifactory', inputs.repox-url) }}
        ARTIFACTORY_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }}
      run: |
        $ACTION_PATH_CONFIG_NPM/npm_config.sh

        echo "::group::Restore mise files"
        rm mise.local.toml
        mv "${{ steps.setup.outputs.MISE_BACKUP }}"/* "${{ steps.setup.outputs.MISE_BACKUP }}"/.* ./ 2>/dev/null || true
        rmdir "${{ steps.setup.outputs.MISE_BACKUP }}"
        echo "::endgroup::"

    - name: Sanitize workflow name for cache key
      id: sanitize_workflow
      if: steps.config-npm-completed.outputs.skip != 'true' && inputs.disable-caching != 'true' && inputs.cache-npm == 'true'
      shell: bash
      env:
        WORKFLOW_NAME: ${{ github.workflow }}
      run: echo "workflow_name=${WORKFLOW_NAME// /-}" >> "$GITHUB_OUTPUT"

    - name: Cache NPM dependencies
      uses: SonarSource/gh-action_cache@eaf3a34501712f8a246749c4abf837a2b4d67521 # v1.4.2
      if: steps.config-npm-completed.outputs.skip != 'true' && inputs.disable-caching != 'true' && inputs.cache-npm == 'true'
      with:
        path: ~/.npm
        key: npm-${{ runner.os }}-${{ steps.sanitize_workflow.outputs.workflow_name }}-${{ hashFiles('**/package-lock.json') }}
        restore-keys: npm-${{ runner.os }}-${{ steps.sanitize_workflow.outputs.workflow_name }}-

    - name: Check for package.json
      id: check_package_json
      if: steps.config-npm-completed.outputs.skip != 'true'
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      run: |
        if [[ -f "package.json" ]]; then
          echo "exists=true" >> "$GITHUB_OUTPUT"
        else
          echo "No package.json file. Skipping project version update."
          echo "exists=false" >> "$GITHUB_OUTPUT"
        fi

    - uses: ./.actions/get-build-number
      id: get_build_number
      if: steps.config-npm-completed.outputs.skip != 'true'
      with:
        host-actions-root: ${{ steps.setup.outputs.host_actions_root }}

    - name: Update project version and set current-version and project-version variables
      id: set_version
      if: steps.config-npm-completed.outputs.skip != 'true' && steps.check_package_json.outputs.exists == 'true'
      shell: bash
      env:
        DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
      working-directory: ${{ inputs.working-directory }}
      run: $ACTION_PATH_CONFIG_NPM/npm_set_project_version.sh

    - name: Set Config NPM completed
      if: steps.config-npm-completed.outputs.skip != 'true'
      shell: bash
      run: echo "CONFIG_NPM_COMPLETED=$GITHUB_ACTION" >> "$GITHUB_ENV"