package-vulnerability-scanner.yml

name: Package Vulnerability Scanner

on:
  workflow_call:

# Setup the environment with the extension name for easy re-use
# Also need the GH_TOKEN for the release-extension action to be able to use gh
env:
  EXTENSION_NAME: package-vulnerability-scanner
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  extension:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./extensions/${{ env.EXTENSION_NAME }}

    steps:
      # Checkout the repository so the rest of the actions can run with no issue
      - uses: actions/checkout@v4

      # We want to fail quickly if the linting fails, do that first
      - uses: ./.github/actions/lint-extension
        with:
          extension-name: ${{ env.EXTENSION_NAME }}

      # Publisher Command Center needs to setup node, install dependencies, and
      # build to make the files needed for the extension
      - uses: actions/setup-node@v4
        with:
          node-version: "lts/*"
          cache: "npm"
          cache-dependency-path: extensions/${{ env.EXTENSION_NAME }}/package-lock.json

      - run: npm ci
      - run: npm run build

      # Now that the extension is built we need to upload an artifact to pass
      # to the package-extension action that contains the files we want to be
      # included in the extension
      # This only includes necessary files for the extension to run leaving out
      # the files that were used to build the /dist/ directory
      - name: Upload built extension
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.EXTENSION_NAME }}
          path: |
            extensions/${{ env.EXTENSION_NAME }}/dist/
            extensions/${{ env.EXTENSION_NAME }}/requirements.txt
            extensions/${{ env.EXTENSION_NAME }}/main.py
            extensions/${{ env.EXTENSION_NAME }}/manifest.json

      # Package up the extension into a TAR using the generalized
      # package-extension action
      - uses: ./.github/actions/package-extension
        with:
          extension-name: ${{ env.EXTENSION_NAME }}
          artifact-name: ${{ env.EXTENSION_NAME }}

  connect-integration-tests:
    needs: extension
    uses: ./.github/workflows/connect-integration-tests.yml
    secrets: inherit
    with:
      extensions: '["package-vulnerability-scanner"]'  # JSON array format to match the workflow input schema

  release:
    runs-on: ubuntu-latest
    needs: [extension, connect-integration-tests]
    # Release the extension using the release-extension action
    # Will only create a GitHub release if merged to `main` and the semver
    # version has been updated
    steps:
      # Checkout the repository so the rest of the actions can run with no issue
      - uses: actions/checkout@v4

      - uses: ./.github/actions/release-extension
        with:
          extension-name: ${{ env.EXTENSION_NAME }}