name: External Plugin PR Quality Gates

on:
  pull_request:
    branches: [main]
    paths:
      - "plugins/external.json"
    types: [opened, synchronize, reopened, edited, ready_for_review]

concurrency:
  group: external-plugin-pr-quality-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: read

jobs:
  detect-changed-plugins:
    runs-on: ubuntu-latest
    outputs:
      changed-plugins: ${{ steps.detect.outputs.changed-plugins }}
      changed-count: ${{ steps.detect.outputs.changed-count }}
      should-run: ${{ steps.detect.outputs.should-run }}
    steps:
      - name: Detect changed external plugins
        id: detect
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        with:
          script: |
            const filePath = 'plugins/external.json';
            const pull = context.payload.pull_request;
            const baseRef = pull.base.sha;
            const headRef = pull.head.sha;

            function normalizePath(value) {
              if (!value || value === '/') {
                return '';
              }
              return String(value).trim().replace(/^\/+|\/+$/g, '').toLowerCase();
            }

            function toIdentity(plugin) {
              return [
                String(plugin?.name ?? '').trim().toLowerCase(),
                String(plugin?.source?.repo ?? '').trim().toLowerCase(),
                normalizePath(plugin?.source?.path),
              ].join('|');
            }

            async function readExternalJson({ owner, repo, ref }) {
              const response = await github.rest.repos.getContent({
                owner,
                repo,
                path: filePath,
                ref,
              });

              if (Array.isArray(response.data) || response.data.type !== 'file') {
                throw new Error(`${filePath} at ${owner}/${repo}@${ref} is not a file`);
              }

              const encoded = response.data?.content ?? '';
              const decoded = Buffer.from(encoded, 'base64').toString('utf8');
              return JSON.parse(decoded);
            }

            const basePlugins = await readExternalJson({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: baseRef,
            });
            const headPlugins = await readExternalJson({
              owner: pull.head.repo.owner.login,
              repo: pull.head.repo.name,
              ref: headRef,
            });
            const baseByIdentity = new Map(basePlugins.map((plugin) => [toIdentity(plugin), plugin]));

            const changedPlugins = headPlugins.filter((plugin) => {
              const identity = toIdentity(plugin);
              const basePlugin = baseByIdentity.get(identity);
              return !basePlugin || JSON.stringify(basePlugin) !== JSON.stringify(plugin);
            });

            core.setOutput('changed-plugins', JSON.stringify(changedPlugins));
            core.setOutput('changed-count', String(changedPlugins.length));
            core.setOutput('should-run', changedPlugins.length > 0 ? 'true' : 'false');

  run-quality-gates:
    runs-on: ubuntu-latest
    needs: detect-changed-plugins
    if: needs.detect-changed-plugins.outputs.should-run == 'true'
    outputs:
      quality-result: ${{ steps.quality.outputs.quality-result }}
    steps:
      - name: Checkout main branch
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          ref: main
          persist-credentials: false
          submodules: false

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22

      - name: Install GitHub Copilot CLI
        run: npm install -g @github/copilot

      - name: Install node packages
        run: npm ci

      - name: Run external plugin PR quality gates
        id: quality
        env:
          CHANGED_PLUGINS_JSON: ${{ needs.detect-changed-plugins.outputs.changed-plugins }}
        run: |
          result=$(node ./eng/external-plugin-pr-quality-gates.mjs --plugins-json "$CHANGED_PLUGINS_JSON")
          {
            echo 'quality-result<<EOF'
            echo "$result"
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"

  publish-quality-result:
    runs-on: ubuntu-latest
    needs: [detect-changed-plugins, run-quality-gates]
    if: always()
    permissions:
      contents: read
    steps:
      - name: Write quality result artifact
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        env:
          DETECT_JOB_RESULT: ${{ needs.detect-changed-plugins.result }}
          SHOULD_RUN: ${{ needs.detect-changed-plugins.outputs.should-run }}
          CHANGED_COUNT: ${{ needs.detect-changed-plugins.outputs.changed-count }}
          QUALITY_RESULT_JSON: ${{ needs.run-quality-gates.outputs.quality-result }}
          QUALITY_JOB_RESULT: ${{ needs.run-quality-gates.result }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
        with:
          script: |
            const fs = require('fs');
            const path = require('path');
            const outDir = path.join(process.env.RUNNER_TEMP, 'external-plugin-pr-quality-result');
            fs.mkdirSync(outDir, { recursive: true });
            const payload = {
              schema_version: 'external-plugin-pr-quality-result/v1',
              event: 'pull_request',
              pr_number: Number.parseInt(process.env.PR_NUMBER, 10),
              head_sha: process.env.PR_HEAD_SHA,
              base_sha: process.env.PR_BASE_SHA,
              base_ref: process.env.PR_BASE_REF,
              detect_job_result: process.env.DETECT_JOB_RESULT || '',
              should_run: process.env.SHOULD_RUN === 'true',
              changed_count: Number.parseInt(process.env.CHANGED_COUNT || '0', 10) || 0,
              quality_job_result: process.env.QUALITY_JOB_RESULT || '',
              quality_result_json: process.env.QUALITY_RESULT_JSON || '',
              run_id: process.env.GITHUB_RUN_ID,
            };
            fs.writeFileSync(path.join(outDir, 'result.json'), `${JSON.stringify(payload, null, 2)}\n`);

      - name: Upload quality result artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: external-plugin-pr-quality-result
          path: ${{ runner.temp }}/external-plugin-pr-quality-result/result.json
          if-no-files-found: error
          retention-days: 3