Refactor OpEx dashboard deploy workflow to standardize config pattern; update documentation to reflect expected config file structure

Author: gunzip

.github/workflows/opex-dashboard-deploy.yaml

@@ -2,17 +2,6 @@ name: OpEx Dashboard Deploy
 
 on:
   workflow_call:
-    inputs:
-      config_pattern:
-        description: |
-          Glob pattern(s) to find dashboard config files. Supports multiple patterns (one per line).
-          Examples:
-            Single: 'infra/dashboards/**/config.yaml'
-            Multiple: |
-              infra/dashboards/**/config.yaml
-              .opex/**/config.yaml
-        type: string
-        required: true
 
 env:
   ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
@@ -114,7 +103,7 @@ jobs:
         id: generate-action
         uses: pagopa/dx/actions/opex-dashboard-generate@chores/opex-workflow
         with:
-          config_pattern: ${{ inputs.config_pattern }}
+          config_pattern: ".opex/**/config.yaml"
           opex_dashboard_version: ${{ env.OPEX_DASHBOARD_VERSION }}
           base_ref: ${{ steps.set-base-ref.outputs.base_ref }}
           package_manager: ${{ steps.node-setup.outputs.package-manager }}

apps/website/docs/pipelines/opex-dashboard.md

@@ -21,8 +21,8 @@ strategy.
   apply) with separate CI/CD environments
 - 🔒 **Secure by Default**: Uses Azure OIDC, GitHub environments, and encrypted
   plan artifacts
-- 🌍 **Flexible Structure**: Supports dashboard configs anywhere in your
-  repository
+- 🌍 **Standard Structure**: Expects dashboard configs in `.opex/**/config.yaml`
+  paths repository
 
 ## Architecture
 
@@ -62,8 +62,6 @@ jobs:
   deploy:
     uses: pagopa/dx/.github/workflows/opex-dashboard-deploy.yaml@main
     secrets: inherit
-    with:
-      config_pattern: "infra/dashboards/**/config.yaml"
 ```
 
 ### Example: Plan on Pull Requests
@@ -81,8 +79,6 @@ jobs:
   plan:
     uses: pagopa/dx/.github/workflows/opex-dashboard-deploy.yaml@main
     secrets: inherit
-    with:
-      config_pattern: "infra/dashboards/**/config.yaml"
 ```
 
 ### Advanced Example: Multiple Environments with Private Agent
@@ -99,26 +95,13 @@ jobs:
     if: github.ref == 'refs/heads/develop'
     uses: pagopa/dx/.github/workflows/opex-dashboard-deploy.yaml@main
     secrets: inherit
-    with:
-      config_pattern: "infra/dashboards/dev/**/config.yaml"
-      use_private_agent: true
 
   deploy-prod:
     if: github.ref == 'refs/heads/main'
     uses: pagopa/dx/.github/workflows/opex-dashboard-deploy.yaml@main
     secrets: inherit
-    with:
-      config_pattern: "infra/dashboards/prod/**/config.yaml"
-      use_private_agent: true
 ```
 
-## Workflow Inputs
-
-| Input               | Description                                                                           | Required | Default |
-| ------------------- | ------------------------------------------------------------------------------------- | -------- | ------- |
-| `config_pattern`    | Glob pattern to find dashboard config files (e.g., `infra/dashboards/**/config.yaml`) | Yes      | -       |
-| `use_private_agent` | Use a private agent to run Terraform operations                                       | No       | `false` |
-
 ## Workflow Outputs
 
 The workflow doesn't expose outputs directly. Deployment status can be monitored
@@ -148,7 +131,7 @@ through:
 ### 2. Detection Phase (in Action)
 
 - Compares current HEAD against `base_ref` using `git diff`
-- Finds all config files matching `config_pattern` glob
+- Finds all config files matching `.opex/**/config.yaml` glob
 - For each config, checks if:
   - The config file itself changed
   - Referenced OpenAPI spec (via `oa3_spec` field) changed
@@ -218,7 +201,6 @@ Both absolute and relative paths are supported for `oa3_spec`.
   - `opex-{environment}-ci` for plan operations (read-only)
   - `opex-{environment}-cd` for apply operations (write access)
 - **Input Validation**:
-  - `config_pattern` validated to prevent glob injection
   - Git references validated before use in commands
   - Event names validated to prevent injection
 - **Minimal Permissions**:
@@ -230,12 +212,11 @@ Both absolute and relative paths are supported for `oa3_spec`.
 
 ## Directory Structure
 
-The workflow supports **any directory structure** - dashboard configs can be
-located anywhere in your repository. The only requirement is that each config
-directory should contain (or will receive):
+The workflow expects dashboard configs to be located in `.opex/**/config.yaml`
+paths. Each config directory should contain (or will receive):
 
 ```
-path/to/dashboard/
+.opex/path/to/dashboard/
 ├── config.yaml          # Dashboard configuration
 ├── backend.tf           # Terraform backend (auto-generated by opex-dashboard or manually created)
 ├── opex.tf              # Generated dashboard Terraform (auto-generated)
@@ -347,17 +328,13 @@ to the new reusable workflow.
      push:
        branches: [main]
        paths:
-         - "**/config.yaml" # Adjust pattern to match your structure
+         - ".opex/**/config.yaml"
          - "**/openapi.yaml"
 
    jobs:
      deploy:
        uses: pagopa/dx/.github/workflows/opex-dashboard-deploy.yaml@main
        secrets: inherit
-       with:
-         config_pattern: "infra/dashboards/**/config.yaml" # Adjust to your structure
-         # Optional:
-         # use_private_agent: true
    ```
 
 5. **Add Plan Workflow for PRs (Optional)**
@@ -370,15 +347,13 @@ to the new reusable workflow.
    on:
      pull_request:
        paths:
-         - "**/config.yaml"
+         - ".opex/**/config.yaml"
          - "**/openapi.yaml"
 
    jobs:
      plan:
        uses: pagopa/dx/.github/workflows/opex-dashboard-deploy.yaml@main
        secrets: inherit
-       with:
-         config_pattern: "infra/dashboards/**/config.yaml"
    ```
 
 6. **Test the Migration**
@@ -404,7 +379,7 @@ to the new reusable workflow.
 
 **No dashboards detected:**
 
-- Verify `config_pattern` matches your file structure
+- Verify config files are located in `.opex/**/config.yaml` paths
 - Check that OpenAPI specs or configs actually changed in the commit
 - Review automatic base reference detection in workflow logs (look for "Using
   base reference" message)