action.yml

---
name: Build Poetry
description: GitHub Action to build, analyze, and deploy a Python project using Poetry with SonarQube integration
inputs:
  public:
    description: Deprecated. Use `artifactory-reader-role`, `artifactory-deployer-role`, and `artifactory-deploy-repo` instead.
    default: ${{ github.event.repository.visibility == 'public' && 'true' || 'false' }}
  artifactory-reader-role:
    description: Suffix for the Artifactory reader role in Vault. Defaults to `private-reader` for private repositories, and `public-reader`
      for public repositories.
    default: ''
  artifactory-deployer-role:
    description: Suffix for the Artifactory deployer role in Vault. Defaults to `qa-deployer` for private repositories, and
      `public-deployer` for public repositories.
    default: ''
  artifactory-deploy-repo:
    description: Deployment repository. Defaults to `sonarsource-pypi-private-qa` for private repositories, and `sonarsource-pypi-public-qa`
      for public repositories.
    default: ''
  deploy-pull-request:
    description: Whether to deploy pull request artifacts. Set to `false` if not using the promote action.
    default: 'false'
  poetry-virtualenvs-path:
    description: Path to the Poetry virtual environments, relative to GitHub workspace. The folder is cached only if it is a subdirectory of
      `poetry-cache-dir`.
    default: .cache/pypoetry/virtualenvs
  poetry-cache-dir:
    description: Path to the Poetry cache directory, relative to GitHub workspace.
    default: .cache/pypoetry
  repox-url:
    description: URL for Repox
    default: https://repox.jfrog.io
  repox-artifactory-url:
    description: URL for Repox Artifactory API (overrides repox-url/artifactory if provided)
    default: ''
  sonar-platform:
    description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
    default: next
  run-shadow-scans:
    description: If true, run sonar scanner on all 3 platforms using the provided URL and token.
     If false, run on the platform provided by sonar-platform. When enabled, the sonar-platform setting is ignored.
    default: 'false'
  working-directory:
    description: Relative path under github.workspace to execute the build in
    default: .
  provenance:
    description: Whether to generate provenance attestation for built artifacts
    default: 'false'
  provenance-artifact-paths:
    description: >-
      Relative paths of the artifacts for which to generate a provenance attestation (glob pattern).
      Default is collected from 'dist/' directory
    default: ''
  disable-caching:
    description: Whether to disable Poetry caching entirely
    default: 'false'

outputs:
  project-version:
    description: The project version from pyproject.toml with BUILD_NUMBER
    value: ${{ steps.build.outputs.project-version }}
  BUILD_NUMBER:
    description: The build number, incremented or reused if already cached
    value: ${{ steps.get_build_number.outputs.BUILD_NUMBER }}
  deployed:
    description: Whether artifacts were deployed
    value: ${{ steps.build.outputs.deployed }}

runs:
  using: composite
  steps:
    - name: Set local action paths
      id: set-path
      shell: bash
      run: |
        echo "::group::Fix for using local actions"
        echo "GITHUB_ACTION_PATH=$GITHUB_ACTION_PATH"
        echo "github.action_path=${{ github.action_path }}"
        ACTION_PATH_BUILD_POETRY="${{ github.action_path }}"
        echo "ACTION_PATH_BUILD_POETRY=$ACTION_PATH_BUILD_POETRY"
        echo "ACTION_PATH_BUILD_POETRY=$ACTION_PATH_BUILD_POETRY" >> "$GITHUB_ENV"
        host_actions_root="$(dirname "$ACTION_PATH_BUILD_POETRY")"
        echo "host_actions_root=$host_actions_root" >> "$GITHUB_OUTPUT"

        mkdir -p ".actions"
        ln -sf "$host_actions_root/get-build-number" .actions/get-build-number
        ln -sf "$host_actions_root/shared" .actions/shared
        ls -la .actions/*
        echo "::endgroup::"

    - name: Set build parameters
      shell: bash
      env:
        ARTIFACTORY_READER_ROLE: ${{ inputs.artifactory-reader-role != '' && inputs.artifactory-reader-role ||
          (github.event.repository.visibility == 'public' && 'public-reader' || 'private-reader') }}
        ARTIFACTORY_DEPLOYER_ROLE: ${{ inputs.artifactory-deployer-role != '' && inputs.artifactory-deployer-role ||
          (github.event.repository.visibility == 'public' && 'public-deployer' || 'qa-deployer') }}
      run: |
        echo "ARTIFACTORY_READER_ROLE=${ARTIFACTORY_READER_ROLE}" >> "$GITHUB_ENV"
        echo "ARTIFACTORY_DEPLOYER_ROLE=${ARTIFACTORY_DEPLOYER_ROLE}" >> "$GITHUB_ENV"
        cp "$ACTION_PATH_BUILD_POETRY/mise.local.toml" mise.local.toml
    - uses: ./.actions/get-build-number
      id: get_build_number
      with:
        host-actions-root: ${{ steps.set-path.outputs.host_actions_root }}
    - name: Cache local Poetry cache
      uses: SonarSource/gh-action_cache@v1.2.0
      if: inputs.disable-caching == 'false'
      with:
        path: ${{ github.workspace }}/${{ inputs.poetry-cache-dir }}
        key: poetry-${{ runner.os }}-${{ hashFiles('poetry.lock') }}
        restore-keys: poetry-${{ runner.os }}-
    - uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1
      with:
        version: 2026.1.0
    - uses: SonarSource/vault-action-wrapper@545e7cfbb5528e7009a1edcc83e073898d292627 # 3.2.0
      id: secrets
      # yamllint disable rule:line-length
      with:
        secrets: |
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/next url | NEXT_URL;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/next token | NEXT_TOKEN;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarqube-us url | SQC_US_URL;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarqube-us token | SQC_US_TOKEN;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarcloud url | SQC_EU_URL;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarcloud token | SQC_EU_TOKEN;' || '' }}
          development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
          development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_DEPLOYER_ROLE }} access_token | ARTIFACTORY_DEPLOY_ACCESS_TOKEN;
      # yamllint enable rule:line-length
    - name: Build, Analyze and deploy
      id: build
      shell: bash
      env:
        # GitHub context
        PULL_REQUEST: ${{ github.event.pull_request.number || '' }}
        PULL_REQUEST_SHA: ${{ github.event.pull_request.base.sha || '' }}
        DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}

        # Action inputs
        ARTIFACTORY_URL: ${{ inputs.repox-artifactory-url != '' && inputs.repox-artifactory-url ||
          format('{0}/artifactory', inputs.repox-url) }}
        DEPLOY_PULL_REQUEST: ${{ inputs.deploy-pull-request }}
        ARTIFACTORY_PYPI_REPO: ${{ inputs.public == 'true' && 'sonarsource-pypi' || 'sonarsource-pypi' }} # FIXME: sonarsource-pypi-public
        ARTIFACTORY_DEPLOY_REPO: ${{ inputs.artifactory-deploy-repo != '' && inputs.artifactory-deploy-repo ||
          github.event.repository.visibility == 'public' && 'sonarsource-pypi-public-qa' || 'sonarsource-pypi-private-qa' }}
        ARTIFACTORY_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }}
        ARTIFACTORY_DEPLOY_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_DEPLOY_ACCESS_TOKEN }}
        POETRY_VIRTUALENVS_PATH: ${{ github.workspace }}/${{ inputs.poetry-virtualenvs-path }}
        POETRY_CACHE_DIR: ${{ github.workspace }}/${{ inputs.poetry-cache-dir }}

        # Vault secrets
        SQC_EU_URL: ${{ fromJSON(steps.secrets.outputs.vault).SQC_EU_URL }}
        SQC_US_URL: ${{ fromJSON(steps.secrets.outputs.vault).SQC_US_URL }}
        NEXT_URL: ${{ fromJSON(steps.secrets.outputs.vault).NEXT_URL }}
        NEXT_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN }}
        SQC_EU_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SQC_EU_TOKEN }}
        SQC_US_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SQC_US_TOKEN }}
        SONAR_PLATFORM: ${{ inputs.sonar-platform }}
        RUN_SHADOW_SCANS: ${{ inputs.run-shadow-scans }}
      run: |
        cd "${{ inputs.working-directory }}"
        "$ACTION_PATH_BUILD_POETRY/build.sh"

    - name: Generate provenance attestation
      if: >-
        ${{ inputs.provenance == 'true' &&
            github.event_name != 'pull_request' &&
            steps.build.outputs.deployed == 'true' &&
            (inputs.provenance-artifact-paths != '' || steps.build.outputs.artifact-paths != '') }}
      uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
      with:
        subject-path: >-
          ${{ inputs.provenance-artifact-paths != '' && inputs.provenance-artifact-paths || steps.build.outputs.artifact-paths }}
        show-summary: true

    - name: Generate workflow summary
      if: always()
      shell: bash
      env:
        ARTIFACTORY_URL: ${{ inputs.repox-artifactory-url != '' && inputs.repox-artifactory-url ||
          format('{0}/artifactory', inputs.repox-url) }}
      run: |
        build_name="${GITHUB_REPOSITORY#*/}"
        echo "## 📦 Poetry Build Summary" >> $GITHUB_STEP_SUMMARY
        if [[ "${{ steps.build.conclusion }}" == "success" ]]; then
          echo "✅ **Build SUCCESS**" >> $GITHUB_STEP_SUMMARY
        else
          echo "❌ **Build FAILED**" >> $GITHUB_STEP_SUMMARY
        fi
        echo "### 📋 Build Information" >> $GITHUB_STEP_SUMMARY
        echo "- **Project**: \`$build_name\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Version**: \`${PROJECT_VERSION}\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Build Number**: \`${BUILD_NUMBER}\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Branch**: \`${GITHUB_REF}\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Commit**: \`$GITHUB_SHA\`" >> $GITHUB_STEP_SUMMARY

        if [[ "${{ steps.build.outputs.should-deploy }}" == true ]]; then
          echo "### 🚀 Deployment" >> $GITHUB_STEP_SUMMARY
          ARTIFACTORY_BROWSE_URL="${ARTIFACTORY_URL%/*}/ui/builds/$build_name/$BUILD_NUMBER"
          echo "🔗 **[Browse artifacts in Artifactory](${ARTIFACTORY_BROWSE_URL})**" >> $GITHUB_STEP_SUMMARY
        fi