build-plugin.yaml

name: Build Plugin
run-name: Build Plugin ${{ inputs.plugin_directory }}

on:
  workflow_call:
    inputs:
      plugin_directory:
        description: "Directory of the plugin"
        required: true
        type: string
      ref:
        description: "Git ref to checkout (branch or SHA)"
        required: false
        type: string
        default: ""
    secrets:
      COMMIT_KEY:
        required: false
      FOSSA_API_KEY:
        required: true
      SONARQUBE_TOKEN:
        required: true
      SONARQUBE_HOST_URL:
        required: true
  workflow_dispatch:
    inputs:
      plugin_directory:
        description: "Directory of the plugin"
        required: true
        type: choice
        options:
          - sam-bedrock-agent
          - sam-event-mesh-gateway
          - sam-event-mesh-tool
          - sam-mongodb
          - sam-nuclia-tool
          - sam-rag
          - sam-rest-gateway
          - sam-ruleset-lookup-tool
          - sam-mcp-server-gateway-adapter
          - sam-slack-gateway-adapter
          - sam-sql-database-tool
          - sam-webhook-gateway
          - sam-event-mesh-identity-provider
          - sam-powerbi
      ref:
        description: "Git ref to checkout (branch or SHA)"
        required: false
        type: string
        default: ""

permissions:
  contents: write
  pull-requests: write
  actions: write
  statuses: write
  checks: write
  repository-projects: read
  packages: read

env:
  PYTHON_VERSION: "3.13"
jobs:
  build-plugin:
    runs-on: ubuntu-latest
    outputs:
      sonarqube_status: ${{ steps.record-sonar-result.outputs.status }}
      plugin_directory: ${{ inputs.plugin_directory }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.ref || github.ref }}
          fetch-depth: 0

      - name: get Sha
        id: get-sha
        run: |
          SHA="$(git rev-parse HEAD)"
          echo "sha=$SHA" >> $GITHUB_OUTPUT
          echo "Checked out SHA: $SHA"
          echo "Base SHA: ${{ github.event.pull_request.base.sha }}"
          echo "Head SHA: ${{ github.event.pull_request.head.sha }}"

      - name: Setup latest Python 3
        id: setup-python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Resolve test runtime variables
        id: test-runtime
        shell: bash
        run: |
          echo "python_version=${{ env.PYTHON_VERSION }}" >> "$GITHUB_OUTPUT"
          echo "hatch_test_env=hatch-test.py${{ env.PYTHON_VERSION }}" >> "$GITHUB_OUTPUT"

      - name: Install uv
        id: setup-uv
        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
      - name: Install Hatch
        run: uv tool install hatch
      - name: Create Hatch Environment
        working-directory: ${{ inputs.plugin_directory }}
        run: hatch -v env create "${{ steps.test-runtime.outputs.hatch_test_env }}"

      - name: Install ODBC Driver 18 for SQL Server
        if: inputs.plugin_directory == 'sam-sql-database-tool'
        run: |
          curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | sudo tee /usr/share/keyrings/microsoft-prod.gpg > /dev/null
          curl https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/prod.list | sudo tee /etc/apt/sources.list.d/mssql-release.list
          sudo apt-get update
          sudo ACCEPT_EULA=Y apt-get install -y msodbcsql18 unixodbc-dev

      - name: Install FreeTDS ODBC Driver
        if: inputs.plugin_directory == 'sam-sql-database-tool'
        run: |
          sudo apt-get install -y freetds-dev tdsodbc unixodbc-dev
          sudo odbcinst -i -d -f /usr/share/tdsodbc/odbcinst.ini

      - name: Ensure test dependencies
        working-directory: ${{ inputs.plugin_directory }}
        shell: bash
        env:
          HATCH_TEST_ENV: ${{ steps.test-runtime.outputs.hatch_test_env }}
        run: |
          if [ ! -d "tests" ]; then
            echo "No tests directory found, skipping test dependency setup"
            exit 0
          fi
          . "${GITHUB_WORKSPACE}/.github/scripts/ensure_test_dependencies.sh"

      - name: Test Plugin ${{ inputs.plugin_directory }} with Python ${{ steps.test-runtime.outputs.python_version }}
        id: test
        continue-on-error: true
        working-directory: ${{ inputs.plugin_directory }}
        shell: bash
        env:
          HATCH_TEST_ENV: ${{ steps.test-runtime.outputs.hatch_test_env }}
        run: |
          # Check if tests directory exists
          if [ ! -d "tests" ]; then
            echo "No tests directory found, skipping tests"
            echo "tests_present=false" >> $GITHUB_OUTPUT
            echo "junit_exists=false" >> $GITHUB_OUTPUT
            echo "coverage_exists=false" >> $GITHUB_OUTPUT
            echo "ctrf_exists=false" >> $GITHUB_OUTPUT
            exit 0
          fi

          echo "tests_present=true" >> $GITHUB_OUTPUT

          # Keep file paths relative so Sonar running in a container can parse coverage.xml.
          printf "[run]\nrelative_files = True\n" > .coveragerc

          echo "Running tests with coverage and CTRF output..."
          TEST_RC=0
          hatch -v run "${HATCH_TEST_ENV}:pytest" tests/ --cov --cov-config=.coveragerc --cov-report=xml:coverage.xml --cov-report=term --junitxml=junit.xml --ctrf report.json || TEST_RC=$?

          # Check if result files exist
          if [ -f coverage.xml ]; then
            echo "coverage_exists=true" >> $GITHUB_OUTPUT
          else
            echo "coverage_exists=false" >> $GITHUB_OUTPUT
          fi
          if [ -f junit.xml ]; then
            echo "junit_exists=true" >> $GITHUB_OUTPUT
          else
            echo "junit_exists=false" >> $GITHUB_OUTPUT
          fi
          if [ -f report.json ]; then
            echo "ctrf_exists=true" >> $GITHUB_OUTPUT
          else
            echo "ctrf_exists=false" >> $GITHUB_OUTPUT
          fi

          exit "$TEST_RC"

      - name: Verify SonarQube plugin config
        run: |
          if [[ ! -f "${{ inputs.plugin_directory }}/sonar-project.properties" ]]; then
            echo "Missing sonar-project.properties in ${{ inputs.plugin_directory }}"
            exit 1
          fi

      - name: SonarQube Scan
        id: sonarqube-scan
        continue-on-error: true
        uses: sonarsource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 # v7.0.0
        env:
          SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONARQUBE_HOST_URL }}
        with:
          projectBaseDir: ${{ inputs.plugin_directory }}
          args: >
            -Dsonar.pullrequest.github.summary_comment=false
            -Dsonar.scm.disabled=true
            -Dsonar.qualitygate.wait=true

      - name: Record SonarQube Result
        id: record-sonar-result
        if: always()
        run: |
          echo "Plugin: ${{ inputs.plugin_directory }}"
          echo "SonarQube scan outcome: ${{ steps.sonarqube-scan.outcome }}"
          echo "status=${{ steps.sonarqube-scan.outcome }}" >> $GITHUB_OUTPUT

      - name: Build package distributions
        id: build-package
        working-directory: ${{ inputs.plugin_directory }}
        shell: bash
        run: |
          BUILD_LOG="$(mktemp "${RUNNER_TEMP:-/tmp}/hatch-build-XXXX.log")"
          echo "build_log=$BUILD_LOG" >> "$GITHUB_OUTPUT"

          set +e
          hatch build 2>&1 | tee "$BUILD_LOG"
          BUILD_RC=${PIPESTATUS[0]}
          set -e

          if [[ "$BUILD_RC" -ne 0 ]]; then
            exit "$BUILD_RC"
          fi

      - name: Fail on build warnings
        if: ${{ hashFiles('.github/scripts/fail_on_warnings.py') != '' && steps.build-package.outputs.build_log != '' }}
        run: >
          python3 .github/scripts/fail_on_warnings.py
          "${{ steps.build-package.outputs.build_log }}"
          --command "hatch build"

      - name: Verify built distributions
        working-directory: ${{ inputs.plugin_directory }}
        shell: bash
        run: |
          uv tool run twine check dist/*.tar.gz
          uv tool run twine check dist/*.whl

      - name: Upload Build Artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ inputs.plugin_directory }}-dist
          path: ${{ inputs.plugin_directory }}/dist/
          retention-days: 7

      - name: Resolve FOSSA scan target
        id: fossa_target
        env:
          REF_HINT: ${{ inputs.ref || github.ref_name }}
          EVENT_NAME: ${{ github.event_name }}
          HEAD_REF: ${{ github.head_ref }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          CURRENT_REF_NAME: ${{ github.ref_name }}
          BEFORE_SHA: ${{ github.event.before }}
          CURRENT_SHA: ${{ steps.get-sha.outputs.sha }}
          PLUGIN_DIRECTORY: ${{ inputs.plugin_directory }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: python3 .github/scripts/resolve_fossa_target.py

      # FOSSA Scan - uploads plugin data to FOSSA as unique project
      - name: FOSSA Scan
        uses: SolaceDev/solace-public-workflows/.github/actions/sca/sca-scan@main
        with:
          scanners: "fossa"
          additional_scan_params: |
            fossa.path=${{ inputs.plugin_directory }}/
            fossa.project=${{ github.repository_owner }}_${{ inputs.plugin_directory }}
            fossa.branch=${{ steps.fossa_target.outputs.branch }}
            fossa.revision=${{ steps.fossa_target.outputs.revision }}
          fossa_api_key: ${{ secrets.FOSSA_API_KEY }}

      - name: FOSSA Guard - Licensing
        id: fossa_guard_licensing
        continue-on-error: true
        uses: SolaceDev/solace-public-workflows/.github/actions/fossa-guard@main
        with:
          fossa_api_key: ${{ secrets.FOSSA_API_KEY }}
          fossa_project_id: "${{ github.repository_owner }}_${{ inputs.plugin_directory }}"
          fossa_category: licensing
          fossa_mode: REPORT
          block_on: policy_conflict
          fossa_branch: ${{ steps.fossa_target.outputs.branch }}
          fossa_revision: ${{ steps.fossa_target.outputs.revision }}
          enable_diff_mode: ${{ steps.fossa_target.outputs.enable_diff_mode }}
          diff_base_revision_sha: ${{ steps.fossa_target.outputs.diff_base_revision_sha }}
          enable_pr_comment: "false"
          enable_status_check: "false"

      - name: Persist FOSSA licensing report
        if: always()
        shell: bash
        env:
          PLUGIN: ${{ inputs.plugin_directory }}
        run: |
          SOURCE="${GITHUB_WORKSPACE}/fossa_guard_report.json"
          DEST="fossa-guard-licensing-${PLUGIN}.json"
          if [[ -f "$SOURCE" ]]; then
            cp "$SOURCE" "$DEST"
          else
            echo '{"metadata":{"category":"licensing"},"summary":{"total_issues":0,"blocking_issues":0},"issues":[]}' > "$DEST"
          fi

      - name: FOSSA Guard - Vulnerability
        id: fossa_guard_vulnerability
        continue-on-error: true
        uses: SolaceDev/solace-public-workflows/.github/actions/fossa-guard@main
        with:
          fossa_api_key: ${{ secrets.FOSSA_API_KEY }}
          fossa_project_id: "${{ github.repository_owner }}_${{ inputs.plugin_directory }}"
          fossa_category: vulnerability
          fossa_mode: REPORT
          block_on: critical,high
          fossa_branch: ${{ steps.fossa_target.outputs.branch }}
          fossa_revision: ${{ steps.fossa_target.outputs.revision }}
          enable_diff_mode: ${{ steps.fossa_target.outputs.enable_diff_mode }}
          diff_base_revision_sha: ${{ steps.fossa_target.outputs.diff_base_revision_sha }}
          enable_pr_comment: "false"
          enable_status_check: "false"

      - name: Persist FOSSA vulnerability report
        if: always()
        shell: bash
        env:
          PLUGIN: ${{ inputs.plugin_directory }}
        run: |
          SOURCE="${GITHUB_WORKSPACE}/fossa_guard_report.json"
          DEST="fossa-guard-vulnerability-${PLUGIN}.json"
          if [[ -f "$SOURCE" ]]; then
            cp "$SOURCE" "$DEST"
          else
            echo '{"metadata":{"category":"vulnerability"},"summary":{"total_issues":0,"blocking_issues":0},"issues":[]}' > "$DEST"
          fi

      - name: Resolve unit-test status
        id: unit_test_status
        if: always()
        shell: bash
        run: |
          if [[ "${{ steps.test.outputs.tests_present }}" != "true" ]]; then
            STATUS="skipped"
          elif [[ "${{ steps.test.outcome }}" == "success" ]]; then
            STATUS="passed"
          else
            STATUS="failed"
          fi
          echo "status=$STATUS" >> "$GITHUB_OUTPUT"

      - name: Build unified CI plugin report payload
        if: always()
        uses: SolaceDev/solace-public-workflows/monorepo-project-ci-report@main
        with:
          project_name: ${{ inputs.plugin_directory }}
          project_path: ${{ inputs.plugin_directory }}
          repo_owner: ${{ github.repository_owner }}
          branch: ${{ steps.fossa_target.outputs.branch }}
          revision: ${{ steps.fossa_target.outputs.revision }}
          sha: ${{ steps.get-sha.outputs.sha }}
          github_event: ${{ github.event_name }}
          sonarqube_result: ${{ steps.sonarqube-scan.outcome }}
          unit_test_result: ${{ steps.unit_test_status.outputs.status }}
          unit_test_outcome: ${{ steps.test.outcome }}
          unit_test_report_path: ${{ inputs.plugin_directory }}/report.json
          unit_test_junit_report_path: ${{ inputs.plugin_directory }}/junit.xml
          tests_present: ${{ steps.test.outputs.tests_present }}
          junit_exists: ${{ steps.test.outputs.junit_exists }}
          coverage_exists: ${{ steps.test.outputs.coverage_exists }}
          fossa_diff_mode: ${{ steps.fossa_target.outputs.enable_diff_mode }}
          fossa_licensing_result: ${{ steps.fossa_guard_licensing.outcome }}
          fossa_licensing_report_path: fossa-guard-licensing-${{ inputs.plugin_directory }}.json
          fossa_vulnerability_result: ${{ steps.fossa_guard_vulnerability.outcome }}
          fossa_vulnerability_report_path: fossa-guard-vulnerability-${{ inputs.plugin_directory }}.json
          output_file: ci-plugin-result-${{ inputs.plugin_directory }}.json

      - name: Upload CI plugin result
        if: always()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ci-plugin-result-${{ inputs.plugin_directory }}
          path: ci-plugin-result-${{ inputs.plugin_directory }}.json
          retention-days: 7