update-stores.yml

name: Create Cert Store Update Pull Request

on:
  repository_dispatch:
    types: targetRepo-event
  workflow_dispatch:
    inputs:
      targetRepo:
        description: 'Target repository for workflow_dispatch'
        default: 'all'
      targetRef:
        description: 'Target ref for workflow_dispatch'
        default: 'latest'

jobs:
  create_pull_request:
    runs-on: ubuntu-latest
    steps:
      - name: Set TARGET_REPO_BRANCH from workflow_dispatch input
        if: github.event_name == 'workflow_dispatch'
        id: set-local-env-vars
        run: |
          echo "TARGET_REPO_BRANCH=${{ inputs.targetRef }}" | tee -a $GITHUB_ENV
          echo "KFUTIL_ARG=${{ inputs.targetRepo }}" | tee -a $GITHUB_ENV
      - name: Set TARGET_REPO_BRANCH from repository_dispatch input
        if: github.event_name == 'repository_dispatch'
        id: set-env-vars-from-payload
        run: |
          echo "TARGET_REPO_BRANCH=${{ github.event.client_payload.targetRef }}" | tee -a $GITHUB_ENV
          echo "KFUTIL_ARG=${{ github.event.client_payload.targetRepo }}" | tee -a $GITHUB_ENV
      - name: Set Branch Name based on targetRef
        id: set-branch-name
        run: |
          if [ "${{ env.TARGET_REPO_BRANCH }}" == "main" ]; then
            echo "BRANCH_NAME=${{ env.KFUTIL_ARG }}_${{ env.TARGET_REPO_BRANCH }}" | tee -a $GITHUB_ENV
          else
            echo "BRANCH_NAME=${{ env.KFUTIL_ARG }}" | tee -a $GITHUB_ENV
          fi

      - name: Check Open PRs for Existing Branch
        id: check-branch
        uses: actions/github-script@v8
        with:
          script: |
            // Look for open pull requests
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const pulls = await github.rest.pulls.list({
              owner,
              repo,
              state: "open"
            });
            // Filter out ones matching our branch naming convention
            const filteredData = pulls.data.filter(item => item.head.ref === '${{ env.BRANCH_NAME }}');
            const isBranch = (filteredData.length > 0)
            if (isBranch) {
              const {
                head: { ref: incomingBranch }, base: { ref: baseBranch }
              } = pulls.data[0]
              core.setOutput('PR_BRANCH', 'commit'); // Just commit since the branch exists
              console.log(`incomingBranch: ${incomingBranch}`)
              console.log(`baseBranch: ${baseBranch}`)
            } else {
              core.setOutput('PR_BRANCH', 'create') // No branch, create one
            }
            console.log(`Branch exists? ${filteredData.length > 0}`)
            console.log(`Branch name: ${{env.BRANCH_NAME}}`)

      - name: set env.PR_BRANCH value for jobs
        run: |
          echo "PR_BRANCH=${{steps.check-branch.outputs.PR_BRANCH}}" | tee -a $GITHUB_ENV

      # If the branch with an open PR already exists, first check out that branch from kfutil
      - name: Check out existing repo merge branch
        if: env.PR_BRANCH == 'commit'
        uses: actions/checkout@v4
        with:
          repository: 'keyfactor/kfutil'
          sparse-checkout: |
            .github
            cmd
          path: './merge-folder/'
          token: ${{ secrets.V2BUILDTOKEN }}
          ref: '${{env.BRANCH_NAME}}'

      # If the branch does not exist, first check out the main branch from kfutil.
      - name: Check out main
        if: env.PR_BRANCH == 'create'
        uses: actions/checkout@v4
        with:
          repository: 'keyfactor/kfutil'
          sparse-checkout: |
            .github
            cmd
          path: './merge-folder/'
          token: ${{ secrets.V2BUILDTOKEN }}

      # Save a copy of the original json
      - name: Save original store_types.json
        run: |
          echo "Saving original store_types.json as store_types.sav.json"
          cp ./merge-folder/store_types.json  ./merge-folder/store_types.sav.json

      # Checkout and run the python tool
      - name: Check out python merge tool repo
        uses: actions/checkout@v4
        with:
          repository: 'keyfactor/integration-tools'
          path: './tools/'
          token: ${{ secrets.V2BUILDTOKEN }}

      - name: Run Python Script
        working-directory: ./tools/store-type-merge
        run: |
          python main.py --repo-name ${{ env.KFUTIL_ARG }} --ref ${{ env.TARGET_REPO_BRANCH }}
        env:
          GITHUB_TOKEN: ${{ secrets.V2BUILDTOKEN }}

      - name: Save Store Types JSON Artifact
        if: success()
        uses: actions/upload-artifact@v4
        with:
          name: store-types
          path: |
            ./tools/store-type-merge/store_types.json
            ./merge-folder/store_types.sav.json

      - name: Save Invalid Store Types JSON Artifact
        if: success()
        uses: actions/upload-artifact@v4
        with:
          name: invalid-repos
          path: ./tools/store-type-merge/invalid_repos.json

      - name: Save logs directory
        if: success()
        uses: actions/upload-artifact@v4
        with:
          name: logs
          path: ./tools/store-type-merge/log

      # Copy the result to the pr commit folder
      - name: Copy store-type-merge results
        run: |
          echo "Saving original store_types.json as store_types.sav.json"
          cp -f ./tools/store-type-merge/store_types.json  ./merge-folder/store_types.json
          mkdir -p ./merge-folder/cmd || true
          cp -f ./tools/store-type-merge/store_types.json  ./merge-folder/cmd/store_types.json # this necessary?
          ls -la ./merge-folder/
          ls -la ./merge-folder/cmd/

      # Diff the new json against the saved copy and set an UPDATE_FILE variable
      - name: Diff the results
        run: |
          echo "Diff the results"
          echo "Set UPDATE_FILE=1 if differences"
          if cmp -s ./merge-folder/store_types.json ./merge-folder/store_types.sav.json ;
            then echo "UPDATE_FILE=F" | tee -a $GITHUB_ENV;
            else echo "UPDATE_FILE=T" | tee -a $GITHUB_ENV;
          fi
          diff ./merge-folder/store_types.json ./merge-folder/store_types.sav.json || true

      #  There are two different steps with a condition to check the PR_BRANCH env var
      #  Both steps will contain a check for the UPDATE_FILE variable before running
      - name: Add and Commit to newly created branch
        if: ${{ env.UPDATE_FILE == 'T' && env.PR_BRANCH == 'create' }}
        uses: Keyfactor/add-and-commit@v9.1.3
        env:
          GITHUB_TOKEN: ${{ secrets.SDK_SYNC_PAT }}
        with:
          add: |
            store_types.json
            ./cmd/store_types.json --force
          message: Update store_types.json for ${{env.KFUTIL_ARG}}:${{env.TARGET_REPO_BRANCH}}
          author_name: Keyfactor
          author_email: keyfactor@keyfactor.github.io
          cwd: './merge-folder/'
          new_branch: ${{env.BRANCH_NAME}}

      - name: Add and Commit to existing branch
        if: ${{ env.UPDATE_FILE == 'T' && env.PR_BRANCH == 'commit' }}
        uses: Keyfactor/add-and-commit@v9.1.3
        env:
          GITHUB_TOKEN: ${{ secrets.SDK_SYNC_PAT }}
        with:
          add: |
            store_types.json 
            ./cmd/store_types.json --force
          message: Update store_types.json for ${{env.KFUTIL_ARG}}:${{env.TARGET_REPO_BRANCH}}
          author_name: Keyfactor
          author_email: keyfactor@keyfactor.github.io
          cwd: './merge-folder/'

      - name: Create new PR for the newly created branch
        if: env.UPDATE_FILE == 'T' && env.PR_BRANCH == 'create'
        uses: actions/github-script@v8
        with:
          script: |
            console.log(`Created ${{env.BRANCH_NAME}} `)
            console.log("Commit to ${{env.BRANCH_NAME}} for PR")
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const baseBranch = context.payload.ref ?
              context.payload.ref.replace('refs/heads/', '') : 'main';
            console.log(`Base branch for PR: ${baseBranch}`);
            const newBranch = '${{env.BRANCH_NAME}}';
            const response = await github.rest.pulls.create({
              owner,
              repo,
              title: 'New Pull Request - ${{env.KFUTIL_ARG}}:${{env.TARGET_REPO_BRANCH}}',
              head: newBranch,
              base: baseBranch,
              body: 'The cert store update from ${{env.KFUTIL_ARG}}:${{env.TARGET_REPO_BRANCH}} needs to be verified and merged if correct.',
            });
            console.log(`Pull request created: ${{env.KFUTIL_ARG}}:${{env.TARGET_REPO_BRANCH}} : ${response.data.html_url}`);