package.yml

# Workflow to handle packaging the Unity SDK
name: Package SDKs (SubWorkflow)

on:
  workflow_call:
    inputs:
      runIntegrationTests:
        description: 'run integration tests?'
        default: '1'
        required: true
        type: string
      create_new_branch:
        description: 'Check if we need to create new branch to package guids update. If working_branch set, will ignore this value. '
        default: '0'
        required: false
        type: string
      working_branch:
        description: 'If already a working in progress release branch'
        required: false
        type: string
      release_label:
        description: 'If the package is intended to run for a release, put <version>-RC## for label'
        required: false
        type: string
      build_run_id:
        description: 'run id for build_starter.yml, search for all output'
        required: false
        type: string
      platforms:
        description: 'CSV of Android,iOS,Windows,macOS,Linux,Playmode'
        default: 'Android,iOS,Windows,macOS,Linux,Playmode'
        required: true
        type: string
      apis:
        description: 'CSV of apis to build and test'
        default: 'analytics,app_check,auth,crashlytics,database,firebaseai,firestore,functions,installations,messaging,remote_config,storage'
        required: true
        type: string
    secrets:
      WORKFLOW_TRIGGER_APP_ID:
        required: true
      WORKFLOW_TRIGGER_APP_PRIVATE_KEY:
        required: true

permissions:
  contents: write
  pull-requests: write

env:
  # Use SHA256 for hashing files.
  hashCommand: "sha256sum"
  default_apis: 'analytics,app_check,auth,crashlytics,database,firebaseai,firestore,functions,installations,messaging,remote_config,storage'

jobs:
  package_sdks:
    name: package-${{github.event.inputs.release_label}}
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
    steps:
      - name: Check input
        # This check the apis input. It detect whether the package is only asking for subset of
        # of the products, like auth,firestore only etc. If the input apis are less than the
        # default_apis env attribute, we package only the provided apis, for test purposes only.
        id: check-input
        shell: bash
        run: |
          IFS=',' read -r -a input_apis <<< "${INPUTS_APIS}"
          IFS=',' read -r -a default_apis <<< "${{ env.default_apis }}"
          if [[ ${#input_apis[@]} != ${#default_apis[@]} ]]; then
            echo "package_for_checks=1" >> $GITHUB_OUTPUT
            echo "package_apis=--apis=${INPUTS_APIS}" >> $GITHUB_OUTPUT
          else
            echo "package_for_checks=0" >> $GITHUB_OUTPUT
            echo "package_apis=" >> $GITHUB_OUTPUT
          fi
        env:
          INPUTS_APIS: ${{ inputs.apis }}

      - name: Print inputs
        shell: bash
        run: |
          echo runIntegrationTests: ${INPUTS_RUNINTEGRATIONTESTS}
          echo create_new_branch: ${INPUTS_CREATE_NEW_BRANCH}
          echo release_label: ${INPUTS_RELEASE_LABEL}
          echo working_branch: ${INPUTS_WORKING_BRANCH}
          echo download_android_run: ${INPUTS_DOWNLOAD_ANDROID_RUN}
          echo download_ios_run: ${INPUTS_DOWNLOAD_IOS_RUN}
          echo download_linux_run: ${INPUTS_DOWNLOAD_LINUX_RUN}
          echo download_macos_run: ${INPUTS_DOWNLOAD_MACOS_RUN}
          echo download_windows_run: ${INPUTS_DOWNLOAD_WINDOWS_RUN}
          echo platforms: ${INPUTS_PLATFORMS}"
          echo apis: ${INPUTS_APIS}"
          echo is the package for checks: ${STEPS_CHECK_INPUT_OUTPUTS_PACKAGE_FOR_CHECKS}
          echo package_apis: ${STEPS_CHECK_INPUT_OUTPUTS_PACKAGE_APIS}
        env:
          INPUTS_RUNINTEGRATIONTESTS: ${{ inputs.runIntegrationTests }}
          INPUTS_CREATE_NEW_BRANCH: ${{ inputs.create_new_branch }}
          INPUTS_RELEASE_LABEL: ${{ inputs.release_label }}
          INPUTS_WORKING_BRANCH: ${{ inputs.working_branch }}
          INPUTS_DOWNLOAD_ANDROID_RUN: ${{ inputs.download_android_run }}
          INPUTS_DOWNLOAD_IOS_RUN: ${{ inputs.download_ios_run }}
          INPUTS_DOWNLOAD_LINUX_RUN: ${{ inputs.download_linux_run }}
          INPUTS_DOWNLOAD_MACOS_RUN: ${{ inputs.download_macos_run }}
          INPUTS_DOWNLOAD_WINDOWS_RUN: ${{ inputs.download_windows_run }}
          INPUTS_PLATFORMS: ${{ inputs.platforms }}
          INPUTS_APIS: ${{ inputs.apis }}
          STEPS_CHECK_INPUT_OUTPUTS_PACKAGE_FOR_CHECKS: ${{ steps.check-input.outputs.package_for_checks }}
          STEPS_CHECK_INPUT_OUTPUTS_PACKAGE_APIS: ${{ steps.check-input.outputs.package_apis }}

      - name: Check out base branch
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
        with:
          fetch-depth: 0
          ref: ${{ inputs.working_branch }}
          # Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
          persist-credentials: true # zizmor: ignore[artipacked]

      - name: Setup Python
        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
        with:
          python-version: 3.9

      - name: Install python deps
        shell: bash
        run: |
          pip install -r scripts/gha/requirements.txt

      - name: Generate token for GitHub API
        # This step is necessary because the existing GITHUB_TOKEN cannot be used inside one workflow to trigger another.
        # 
        # Instead, generate a new token here, using our GitHub App's private key and App ID (saved as Secrets).
        # 
        # This method is preferred over the "personal access token" solution, as the GitHub App's scope is limited to just
        # the firebase-cpp-sdk repository.
        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # ratchet:actions/create-github-app-token@v1
        id: generate-token
        with:
          app-id: ${{ secrets.WORKFLOW_TRIGGER_APP_ID }}
          private-key: ${{ secrets.WORKFLOW_TRIGGER_APP_PRIVATE_KEY }}
          permission-pull-requests: write

      - name: Name new branch
        if: inputs.working_branch == '' && inputs.create_new_branch == '1'
        run: |
          date_str=$(date "+%Y%m%d-%H%M%S")
          echo "NEW_BRANCH=new_branch-${date_str}" >> $GITHUB_ENV

      - name: Create new branch
        if: inputs.working_branch == '' && inputs.create_new_branch == '1'
        run: |
          git remote update
          git checkout -b "${NEW_BRANCH}"
          echo "UPDATE_LOGFILE=update_log.txt" >> $GITHUB_ENV

      - name: Checkout working branch
        if: inputs.working_branch != ''
        run: |
          git remote update
          git checkout ${INPUTS_WORKING_BRANCH}
          echo "UPDATE_LOGFILE=update_log.txt" >> $GITHUB_ENV
          echo "NEW_BRANCH=${INPUTS_WORKING_BRANCH}" >> $GITHUB_ENV
        env:
          INPUTS_WORKING_BRANCH: ${{ inputs.working_branch }}

      # If called by build_start.xml, ignore name search, just grab all artifact exists
      - name: Fetch All in build_starter
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
        with:
          path: built_artifact
      
      - name: move zip files
        run: |
          cd built_artifact
          find . -type f \( -name "*.zip" ! -name "documentation_sources*" \) -exec mv {} . \;
          find . -empty -type d -delete
          ls -lR
          for zip_file in *.zip
          do
            unzip -l $zip_file
          done
          ls -lR
          cd ..

      - name: Package unitypackage
        run: |
          CLEAN_APIS=$(echo ${STEPS_CHECK_INPUT_OUTPUTS_PACKAGE_APIS} | tr -d "'" | tr -d "\"")
          python scripts/build_scripts/build_package.py --zip_dir=built_artifact ${CLEAN_APIS}
        env:
          STEPS_CHECK_INPUT_OUTPUTS_PACKAGE_APIS: ${{ steps.check-input.outputs.package_apis }}

      - name: Commit Changes if there is any
        if: inputs.working_branch != '' || inputs.create_new_branch == '1'
        run: |
          if ! git update-index --refresh; then
            git config user.email "firebase-workflow-trigger-bot@google.com"
            git config user.name "firebase-workflow-trigger-bot"
            git config core.commentChar "%"  # so we can use # in git commit messages
            git commit -a -m "Update Guids ID"

            # Show changes in git log
            git diff
            # Push branch
            git push --set-upstream origin "${NEW_BRANCH}"
          fi

      - name: Create PR if there is None
        if: inputs.working_branch != '' || inputs.create_new_branch == '1'
        id: push-branch
        run: |
          if ! git update-index --refresh; then
            date_str=$(date "+%a %b %d %Y")
            commit_title="Update Unity SDK dependencies - ${date_str}"
            commit_body=
            if [[ -n "${GITHUB_EVENT_INPUTS_COMMENT}" ]]; then
              # If a comment was provided, start with that instead of blank.
              commit_body="${GITHUB_EVENT_INPUTS_COMMENT}

            "
            fi

            commit_body="${commit_body}

          > Created by [${GITHUB_WORKFLOW} workflow]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID)."
            git config user.email "firebase-workflow-trigger-bot@google.com"
            git config user.name "firebase-workflow-trigger-bot"
            git config core.commentChar "%"  # so we can use # in git commit messages
            git commit -a -m "${commit_title}

          ${commit_body}"
            echo "branch_pushed=1" >> $GITHUB_OUTPUT
            # Show changes in git log
            git diff
            # Push branch
            git push --set-upstream origin "${NEW_BRANCH}"
            # Create pull request
            pr_number=$(python scripts/gha/create_pull_request.py --token ${STEPS_GENERATE_TOKEN_OUTPUTS_TOKEN} --head "${NEW_BRANCH}" --base "${GITHUB_EVENT_INPUTS_BASEBRANCH}" --title "${commit_title}" --body "${commit_body}")
            echo "created_pr_number=${pr_number}" >> $GITHUB_OUTPUT
          else
            echo "::warning ::No changes detected, won't create pull request."
            echo "branch_pushed=0" >> $GITHUB_OUTPUT
          fi
        env:
          GITHUB_EVENT_INPUTS_COMMENT: ${{ github.event.inputs.comment }}
          STEPS_GENERATE_TOKEN_OUTPUTS_TOKEN: ${{ steps.generate-token.outputs.token }}
          GITHUB_EVENT_INPUTS_BASEBRANCH: ${{ github.event.inputs.baseBranch }}

      - name: Create Zip File
        run: |
          mv output firebase_unity_sdk
          cp docs/readme.md firebase_unity_sdk/.
          cp LICENSE firebase_unity_sdk/.
          ls -Rl firebase_unity_sdk
          zip -r firebase_unity_sdk.zip firebase_unity_sdk

      - name: compute SDK hash
        shell: bash
        run: |
          ${{ env.hashCommand }} --tag firebase_unity_sdk.zip >> firebase_unity_sdk_hash.txt
          echo "::warning ::$(cat firebase_unity_sdk_hash.txt)"

      - name: Upload Build unitypackage
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
        with:
          name: firebase_unity_sdk.zip
          path: firebase_unity_sdk.zip
      
      - name: Package tgz
        run: |
          python scripts/build_scripts/build_package.py --zip_dir=built_artifact --output_upm=True --output=output_tgz

      - name: Listing output tgz
        run: |
          ls -Rl
        working-directory: output_tgz

      - name: compute SDK hash for tgz files
        shell: bash
        run: |
          tgz_files_list=$(find -type f -name '*.tgz')
          for tgz_file in "${tgz_files_list[@]}"; do
            ${{ env.hashCommand }} --tag ${tgz_file} >> ../firebase_unity_sdk_hash.txt
          done
          echo "::warning update sha txt \n ::$(cat ../firebase_unity_sdk_hash.txt)"
        working-directory: output_tgz

      - name: Upload Build tgz
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
        with:
          name: firebase_unity_sdk_tgz
          path: output_tgz

      - name: upload hash
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
        with:
          name: firebase_unity_sdk_hash.txt
          path: firebase_unity_sdk_hash.txt

  trigger_integration_tests:
    # Trigger the integration_tests workflow.
    needs: [package_sdks]
    if: (inputs.runIntegrationTests != '0') && !cancelled() && !failure()
    runs-on: ubuntu-22.04
    steps:
    - name: Checkout repo
      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
      with:
        persist-credentials: true # zizmor: ignore[artipacked]

    - name: Setup python
      uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
      with:
        python-version: 3.9
    - name: Generate token for GitHub API
      # This step is necessary because the existing GITHUB_TOKEN cannot be used inside one workflow to trigger another.
      # 
      # Instead, generate a new token here, using our GitHub App's private key and App ID (saved as Secrets).
      # 
      # This method is preferred over the "personal access token" solution, as the GitHub App's scope is limited to just
      # the firebase-cpp-sdk repository.
      uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # ratchet:actions/create-github-app-token@v1
      id: generate-token
      with:
        app-id: ${{ secrets.WORKFLOW_TRIGGER_APP_ID }}
        private-key: ${{ secrets.WORKFLOW_TRIGGER_APP_PRIVATE_KEY }}
        permission-actions: write
    - name: Get branch name
      id: branch-name
      uses: tj-actions/branch-names@5250492686b253f06fa55861556d1027b067aeb5
    - name: Use GitHub API to start workflow
      shell: bash
      run: |
        pip install -r scripts/gha/requirements.txt
        set -e
        python scripts/gha/trigger_workflow.py -t ${STEPS_GENERATE_TOKEN_OUTPUTS_TOKEN} \
          -b ${STEPS_BRANCH_NAME_OUTPUTS_CURRENT_BRANCH} \
          -w integration_tests.yml \
          -p packaged_sdk_run_id ${{ github.run_id }} \
          -p platforms ${INPUTS_PLATFORMS} \
          -p apis ${INPUTS_APIS} \
          -p test_pull_request ${INPUTS_RUNINTEGRATIONTESTS} \
          -s 10 -A -v
      env:
        STEPS_GENERATE_TOKEN_OUTPUTS_TOKEN: ${{ steps.generate-token.outputs.token }}
        STEPS_BRANCH_NAME_OUTPUTS_CURRENT_BRANCH: ${{ steps.branch-name.outputs.current_branch }}
        INPUTS_PLATFORMS: ${{ inputs.platforms }}
        INPUTS_APIS: ${{ inputs.apis }}
        INPUTS_RUNINTEGRATIONTESTS: ${{ inputs.runIntegrationTests }}