action.yml

name: Setup Control Plane Environment
description: Sets up Ruby, installs the Control Plane CLI and cpflow gem, and configures a default profile

inputs:
  token:
    description: Control Plane token
    required: true
  org:
    description: Control Plane organization
    required: true
  ruby_version:
    description: >-
      Ruby version used for cpflow. When empty (the default), ruby/setup-ruby auto-detects
      from .ruby-version, .tool-versions, or the Gemfile.
    required: false
    default: ""
  # GitHub parses double-brace expression snippets inside action metadata (including
  # `description:`) while loading the composite action, and the `vars` context is not
  # available in that phase. Keep these descriptions in plain prose - reference repo
  # variables by NAME only, never with literal GitHub Actions expression syntax.
  cpln_cli_version:
    description: >-
      @controlplane/cli version. Empty string falls back to the action's pinned default,
      so callers can wire this input to the CPLN_CLI_VERSION repository variable
      unconditionally.
    required: false
    default: ""
  cpflow_version:
    description: >-
      cpflow gem version. Empty string falls back to the action's pinned default,
      so callers can wire this input to the CPFLOW_VERSION repository variable
      unconditionally.
    required: false
    default: ""

runs:
  using: composite
  # Third-party actions are pinned to floating major tags (`@v4`, `@v1`, `@v7`) rather than
  # immutable SHAs. SHA pinning is GitHub's stronger security recommendation, but for
  # generated templates that ship into many downstream repositories floating tags are
  # easier for users to keep current and Dependabot/Renovate already cover the SHA-pinning
  # workflow for repositories that opt in. Repositories with stricter supply-chain
  # requirements should replace each `uses: actions/...@vN` with the corresponding
  # immutable commit SHA.
  steps:
    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        ruby-version: ${{ inputs.ruby_version }}

    - name: Install Control Plane CLI and cpflow gem
      shell: bash
      env:
        CPLN_CLI_VERSION: ${{ inputs.cpln_cli_version }}
        CPFLOW_VERSION: ${{ inputs.cpflow_version }}
      run: |
        set -euo pipefail

        # Bump these defaults when a new release lands that you want to roll out by default.
        # Override per-repo by setting `CPLN_CLI_VERSION` / `CPFLOW_VERSION` repo variables;
        # an empty input falls back to the action's pinned default below.
        default_cpln_cli_version="3.3.1"
        default_cpflow_version="5.0.0.rc.1"

        CPLN_CLI_VERSION="${CPLN_CLI_VERSION:-${default_cpln_cli_version}}"
        CPFLOW_VERSION="${CPFLOW_VERSION:-${default_cpflow_version}}"

        npm_global_prefix="${HOME}/.npm-global"
        mkdir -p "${npm_global_prefix}"
        echo "${npm_global_prefix}/bin" >> "$GITHUB_PATH"
        export PATH="${npm_global_prefix}/bin:${PATH}"

        npm install --global --prefix "${npm_global_prefix}" "@controlplane/cli@${CPLN_CLI_VERSION}"
        cpln --version

        gem install cpflow -v "${CPFLOW_VERSION}" --no-document
        cpflow --version

    - name: Setup Control Plane profile and registry login
      shell: bash
      env:
        # Pass the token via CPLN_TOKEN so cpln picks it up from the environment
        # rather than `--token`, which would leak it into /proc/<pid>/cmdline and ps output.
        CPLN_TOKEN: ${{ inputs.token }}
        ORG: ${{ inputs.org }}
      run: |
        set -euo pipefail

        if [[ -z "$CPLN_TOKEN" ]]; then
          echo "Error: Control Plane token not provided" >&2
          exit 1
        fi

        if [[ -z "$ORG" ]]; then
          echo "Error: Control Plane organization not provided" >&2
          exit 1
        fi

        # Keep the service-account token available to later cpflow/cpln steps.
        # The profile stores org/default metadata, but cpflow direct API calls
        # read CPLN_TOKEN before falling back to `cpln profile token`.
        echo "::add-mask::${CPLN_TOKEN}"
        printf 'CPLN_TOKEN=%s\n' "${CPLN_TOKEN}" >> "${GITHUB_ENV}"

        # `cpln profile update` lists `create` as an alias (cpln profile --help) and is
        # idempotent: it creates the profile if missing and updates it otherwise. Calling
        # update directly avoids parsing the CLI's "already exists" English error text,
        # which would silently swallow a real failure if the wording ever changed.
        cpln profile update default --org "$ORG"
        cpln image docker-login --org "$ORG"