main.yml

name: Build and Deploy Registry Providers

on:
  push:
    branches: 
    - main
    - dev  
  pull_request:
    branches: 
    - main
    - dev
  workflow_dispatch:

jobs:
  build-and-deploy:
    name: build-and-deploy
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    env:
      AWS_DEFAULT_REGION: us-west-1
      REG_MAX_VERSIONS: 3
      REG_MAX_AGE_MONTHS: 6
      REG_WEBSITE_DIR: _website
      REG_PROVIDER_PATH: providers/dist
      REG_ARTIFACT_REPO_BUCKET: stackql-registry-artifacts

    steps:
      - uses: actions/checkout@v7
        name: "[SETUP] checkout repo"
        with:
          fetch-depth: 0

      - name: "[SETUP] setup job"
        run: |
          echo "REG_COMMIT_DATETIME=$(date -d @`git show -s --format=%ct` +'%Y-%m-%d %H:%M:%S')" >> $GITHUB_ENV
          echo "REG_COMMIT_YEAR=$(date -d @`git show -s --format=%ct` +'%y')" >> $GITHUB_ENV
          echo "REG_COMMIT_MONTH=$(date -d @`git show -s --format=%ct` +'%m')" >> $GITHUB_ENV
          cd scripts/setup-js; npm i
          node setup-job.js

      - name: "[SETUP] print env vars"
        run: |
          node scripts/setup-js/print-env-vars.js

      - name: "[SETUP] get version"
        run: |
          node scripts/setup-js/get-version.js

      - name: "[SETUP] find changed files"
        run: |
          cd $GITHUB_WORKSPACE; git diff --name-status --diff-filter=ACMRT $REG_BASE_SHA $REG_COMMIT_SHA > diff.txt

      - name: "[SETUP] get updated providers"
        run: |
          pip install -q -r requirements.txt
          python scripts/setup/get-updated-providers.py

      - name: "[SETUP] prepare dist and test dirs"
        run: |
          mkdir -p "${REG_WEBSITE_DIR}/${REG_PROVIDER_PATH}"
          mkdir -p "provider-tests/src"

      - name: '[PACKAGE] set up golang'
        if: env.NUM_PROVIDERS > 0
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache-dependency-path: signing/go.sum
          check-latest: true
          cache: true
        id: go

      - name: "[PACKAGE] build sign tool"
        if: env.NUM_PROVIDERS > 0
        run: |
          cd signing
          go build -o ../pqsig ./cmd/pqsig

      - name: "[PACKAGE] prepare provider dirs"
        if: env.NUM_PROVIDERS > 0
        run: |
          while IFS= read -r provider_dir
          do
            echo "creating dist dir: ${provider_dir}..."
            mkdir "${REG_WEBSITE_DIR}/${REG_PROVIDER_PATH}/${provider_dir}"
            mkdir "provider-tests/src/${provider_dir}"
          done < provider_dirs.txt

      - name: "[PACKAGE] update versions"
        if: env.NUM_PROVIDERS > 0
        run: |
          python scripts/package/update-versions.py

      - name: "[PACKAGE] sign provider docs"
        if: env.NUM_PROVIDERS > 0
        env:
          STACKQL_SIGNING_KID: stackql-2026-01
          STACKQL_SIGNING_SEED: ${{ github.event_name != 'pull_request' && secrets.MLDSA_SIGNING_SEED || '' }}
        run: |
          # PRs exercise the complete packaging path without a production signing key.
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            export STACKQL_SIGNING_SEED="$(python -c 'import secrets; print(secrets.token_hex(32))')"
          fi
          python scripts/package/sign-provider-docs.py
          if [ "${{ github.event_name }}" != "pull_request" ]; then
            find signed/providers/src -type f -name '*.yaml' -exec ./pqsig verify-doc {} +
          fi

      - name: "[PACKAGE] package provider docs"
        if: env.NUM_PROVIDERS > 0
        run: |
          python scripts/package/package-provider-docs.py

      - name: "[TESTS] simulate REGISTRY PULL"
        if: env.NUM_PROVIDERS > 0
        run: |
          python scripts/tests/simulate-REGISTRY-PULL.py

      - name: "[TESTS] test provider(s)"
        if: env.NUM_PROVIDERS > 0
        run: |
          echo "cloning test repo"
          providersdir="$(pwd)/provider-tests"
          git clone https://github.com/stackql/stackql-provider-tests.git
          cd stackql-provider-tests
          while IFS= read -r provider
          do
            echo "testing ${provider}..."
            sh test-provider.sh "$provider" false "$providersdir"
            if [ "${{ github.event_name }}" != "pull_request" ]; then
              python verify-provider.py "$provider" \
                --registry-root "$providersdir" --stackql-bin "$(pwd)/stackql"
            fi
          done < ../providers.txt

      #
      # run the following steps only on pushes to protected branches (merge commits)
      # AND only when provider artefacts under providers/src/ changed (NUM_PROVIDERS > 0).
      # A push that touches nothing under providers/src/ must never publish to S3,
      # sync R2 or redeploy the worker.
      #

      - name: "[PUBLISH] configure aws credentials" 
        uses: aws-actions/configure-aws-credentials@v6
        if: env.NUM_PROVIDERS > 0 && env.REG_EVENT == 'push'
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_DEFAULT_REGION }}

      - name: "[PUBLISH] publish provider docs to artifact repo"
        if: env.NUM_PROVIDERS > 0 && env.REG_EVENT == 'push'
        run: |
            python scripts/publish/publish-provider-docs-to-artifact-repo.py

      - name: "[DEPLOY] pull additional docs from artifact repo"
        if: env.NUM_PROVIDERS > 0 && env.REG_EVENT == 'push'
        run: |
          python scripts/deploy/pull-additional-docs-from-artifact-repo.py

      #
      # Cloudflare serving layer. S3 (stackql-registry-artifacts) remains the
      # master/archive: the steps above publish changed providers to S3 and
      # reconstruct the full docs tree from it. Here that full tree (changed
      # providers + everything pulled from the artifact repo, plus the freshly
      # generated providers.yaml) lives at ${REG_WEBSITE_DIR}/${REG_PROVIDER_PATH}
      # and is mirrored to R2, which the Worker serves from at the edge.
      #

      - name: "[DEPLOY-CF] install worker deps"
        if: env.NUM_PROVIDERS > 0 && env.REG_EVENT == 'push'
        run: |
          cd origin && npm install

      - name: "[DEPLOY-CF] sync docs to R2 (dev)"
        if: env.NUM_PROVIDERS > 0 && env.REG_TARGET_BRANCH == 'dev' && env.REG_EVENT == 'push'
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          AWS_SESSION_TOKEN: ""
          AWS_DEFAULT_REGION: auto
          AWS_REGION: auto
          R2_BUCKET: stackql-provider-registry-dev
        run: |
          # verify R2's TLS chain against the certifi bundle pinned in requirements.txt: the AWS CLI's
          # embedded bundle still trusts the Sectigo AAA root that cross-signs the eMudhra
          # intermediates compromised in Oct 2026, and the CLI ships no fix for that path
          export AWS_CA_BUNDLE="$(python -c 'import certifi; print(certifi.where())')"
          test -s "${AWS_CA_BUNDLE}" || { echo "certifi CA bundle not found"; exit 1; }
          # version-pinned .tgz are immutable -> --size-only keeps R2 ops low and skips re-uploads
          aws s3 sync "${REG_WEBSITE_DIR}/${REG_PROVIDER_PATH}" "s3://${R2_BUCKET}/${REG_PROVIDER_PATH}" \
            --endpoint-url "https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com" \
            --region auto --size-only --delete --no-progress
          # providers.yaml can change without changing size -> always overwrite it
          aws s3 cp "${REG_WEBSITE_DIR}/${REG_PROVIDER_PATH}/providers.yaml" "s3://${R2_BUCKET}/${REG_PROVIDER_PATH}/providers.yaml" \
            --endpoint-url "https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com" \
            --region auto --no-progress

      - name: "[DEPLOY-CF] sync docs to R2 (prod)"
        if: env.NUM_PROVIDERS > 0 && env.REG_TARGET_BRANCH == 'main' && env.REG_EVENT == 'push'
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          AWS_SESSION_TOKEN: ""
          AWS_DEFAULT_REGION: auto
          AWS_REGION: auto
          R2_BUCKET: stackql-provider-registry
        run: |
          # verify R2's TLS chain against the certifi bundle pinned in requirements.txt: the AWS CLI's
          # embedded bundle still trusts the Sectigo AAA root that cross-signs the eMudhra
          # intermediates compromised in Oct 2026, and the CLI ships no fix for that path
          export AWS_CA_BUNDLE="$(python -c 'import certifi; print(certifi.where())')"
          test -s "${AWS_CA_BUNDLE}" || { echo "certifi CA bundle not found"; exit 1; }
          aws s3 sync "${REG_WEBSITE_DIR}/${REG_PROVIDER_PATH}" "s3://${R2_BUCKET}/${REG_PROVIDER_PATH}" \
            --endpoint-url "https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com" \
            --size-only --delete --no-progress
          aws s3 cp "${REG_WEBSITE_DIR}/${REG_PROVIDER_PATH}/providers.yaml" "s3://${R2_BUCKET}/${REG_PROVIDER_PATH}/providers.yaml" \
            --endpoint-url "https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com" \
            --no-progress

      - name: "[DEPLOY-CF] deploy worker (dev)"
        if: env.NUM_PROVIDERS > 0 && env.REG_TARGET_BRANCH == 'dev' && env.REG_EVENT == 'push'
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          cd origin && npx wrangler deploy --env dev

      - name: "[DEPLOY-CF] deploy worker (prod)"
        if: env.NUM_PROVIDERS > 0 && env.REG_TARGET_BRANCH == 'main' && env.REG_EVENT == 'push'
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          cd origin && npx wrangler deploy --env production