build-docs.yml

name: Publish docs via GitHub Pages
on:
  push:
    branches:
      - main
    paths:
      - 'docs/**'
      - 'charts/**'
      - 'mkdocs.yml'
      - 'docker-**/README.md'
  pull_request:
    branches:
      - main
    paths:
      - 'docs/**'
      - 'charts/**'
      - 'mkdocs.yml'
      - 'docker-**/README.md'
  release:
    types:
      - published
  workflow_dispatch:
    inputs:
      version:
        description: 'Version tag (e.g."v5.1.6")'
        default: "nightly"
        required: false
concurrency:
  group: run-once
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  build:
    permissions:
      contents: read
      id-token: write  # keyless Cosign signing via Sigstore OIDC
    if: github.repository == 'GluuFederation/flex'
    name: Deploy docs
    runs-on: ubuntu-latest

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          token: ${{ secrets.MOWORKFLOWTOKEN }}

      - name: Set up Python 3.10
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.10"
          cache: pip

      - name: Install dependencies
        run: |
          curl -sSL https://install.python-poetry.org | python3 -
          export PATH="$HOME/.local/bin:$PATH"
          cp docs/pyproject.toml docs/poetry.lock ../
          poetry install --no-root
          cp mkdocs.yml CHANGELOG.md ../

      - name: Checkout flex ${{ github.event.inputs.version }}
        if: >-
          github.event_name == 'workflow_dispatch'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: '${{ github.event.inputs.version }}'
          fetch-depth: 0
          token: ${{ secrets.MOWORKFLOWTOKEN }}

      - name: Copy files from main to ${{ github.event.inputs.version }}
        if: >-
          github.event_name == 'workflow_dispatch'
        run: |
          mv ../mkdocs.yml mkdocs.yml
          cp ../CHANGELOG.md docs/CHANGELOG.md

      - name: Sync CHANGELOG to docs
        if: github.event_name != 'workflow_dispatch'
        run: |
          cp CHANGELOG.md docs/CHANGELOG.md

      - name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
        with:
          gpg_private_key: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY_PASSPHRASE }}
          git_user_signingkey: true
          git_commit_gpgsign: true

      - name: Install Cosign
        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0

      - name: Package and sign Helm charts with Cosign
        run: |
          helm package charts/gluu/
          helm package charts/gluu-all-in-one/
          for chart in gluu-*.tgz; do
            cosign sign-blob --yes --bundle "${chart}.sigstore.json" "$chart"
          done
          cp gluu-*.tgz gluu-*.tgz.sigstore.json ../

      - name: Configure Git
        run: |
          git config --global user.name "mo-auto"
          git config --global user.email "54212639+mo-auto@users.noreply.github.com"
          git config --global user.signingkey "${{ steps.import_gpg.outputs.keyid }}"
          echo "${{ secrets.MOWORKFLOWTOKEN }}" | gh auth login --with-token 

      - name: Generate docs
        continue-on-error: true
        if: >-
          github.event_name == 'release' &&
          github.event.action == 'published' &&
          (!github.event.release.draft) &&
          (startsWith(github.event.release.name, 'v') || github.event.release.name == 'nightly')
        env:
          VERSION: ${{ github.event.release.tag_name }}
        run: |
         mkdir temp && cd temp
         git clone  https://mo-auto:${{ secrets.MOWORKFLOWTOKEN }}@github.com/GluuFederation/flex.git
         cd flex
         git checkout -b cn-flex-update-auto-generated-docs
         git pull origin cn-flex-update-auto-generated-docs || echo "Nothing to pull"
         echo "Custom work on generating docs can go here."
         sudo bash ./automation/docs/generated-cn-docs.sh . || echo "something went wrong with generating the cn docs"
         git push --set-upstream origin cn-flex-update-auto-generated-docs
         MESSAGE="fix(docs): autogenerate docs"
         PR=$(gh pr create --body "Auto generated docs" --title "${MESSAGE}")
         cd ../../

         sudo rm -rf temp

      - name: Use latest template overrides from main
        if: github.event_name == 'workflow_dispatch' || github.event_name == 'release'
        run: |
          git show origin/main:docs/overrides/main.html > docs/overrides/main.html

      - name: Enable Reo and Scarf tracking for versioned docs
        if: github.event_name == 'workflow_dispatch' || (github.event_name == 'release' && github.event.action == 'published')
        run: |
          sed -i 's/enable_scarf_pixel: false/enable_scarf_pixel: true/' mkdocs.yml
          sed -i 's/enable_reo_flag: false/enable_reo_flag: true/' mkdocs.yml
          echo "Tracking flags status:"
          grep -E 'enable_scarf_pixel|enable_reo_flag' mkdocs.yml

      - name: mike deploy ${{ github.event.inputs.version }}
        if: >-
          github.event_name == 'workflow_dispatch'
        run: |
          poetry run mike deploy --push --update-aliases ${{ github.event.inputs.version }}

      - name: mike deploy head
        if: contains(github.ref, 'refs/heads/main') && github.event_name != 'workflow_dispatch'
        run: |
          poetry run mike deploy --push head

      - name: mike deploy new version
        if: >-
          github.event_name == 'release' &&
          github.event.action == 'published' &&
          (!github.event.release.draft) &&
          (startsWith(github.event.release.name, 'v') || github.event.release.name == 'nightly')
        env:
          VERSION: ${{ github.event.release.tag_name }}
        run: |
          poetry run mike deploy --push "$VERSION"

      - name: Update mike version aliases
        id: set_versions
        run: |
          GITHUB_EVENT_RELEASE_TAG_NAME="${{ github.event.release.tag_name }}"
          TAGS=$(gh release list -L 1000 -R ${{ github.repository }} | grep -o '^\v.*'| grep -v Draft | cut -f 1 | sed '/-/!{s/$/_/}' | sort -V | sed 's/_$//')
          LATEST=$(echo "${TAGS}" | tail -1)
          STABLE=$(echo "${TAGS}" | grep -v -- "nightly" | tail -1)
          if [[ "$GITHUB_EVENT_RELEASE_TAG_NAME" == 'nightly' ]]; then
            LATEST='nightly'
          fi
          echo "Latest is $LATEST and Stable is $STABLE"
          poetry run mike alias -u head main
          poetry run mike alias -u "${STABLE}" stable
          poetry run mike set-default --push stable
          echo "LATEST=${LATEST}" >> $GITHUB_OUTPUT
          echo "STABLE=${STABLE}" >> $GITHUB_OUTPUT

      - name: Create version files
        run: |
          LATEST=${{ steps.set_versions.outputs.LATEST }}
          STABLE=${{ steps.set_versions.outputs.STABLE }}
          git checkout -f gh-pages
          git pull origin gh-pages
          mv ../gluu-*.tgz ../gluu-*.tgz.sigstore.json ./charts/
          cd ./charts
          git add gluu-*.tgz gluu-*.tgz.sigstore.json && git update-index --refresh
          helm repo index .
          git add index.yaml && git update-index --refresh
          cd ..
          for folder in v*/; do
            cp -r nightly/search "$folder"
            git add $folder/search && git update-index --refresh
          done
          cd ${LATEST}
          if [[ "${LATEST}" == "nightly" ]]; then
           egrep -lRZ --exclude=CONTRIBUTING.md . | xargs -0 -l sed -i -e "s/replace-flex-version-stable/0.0.0-nightly/g"
           egrep -lRZ --exclude=CONTRIBUTING.md . | xargs -0 -l sed -i -e "s/replace-flex-version/0.0.0-nightly/g"
           egrep -lRZ --exclude=CONTRIBUTING.md . | xargs -0 -l sed -i -e "s/v0.0.0-nightly/nightly/g"
          else
           egrep -lRZ --exclude=CONTRIBUTING.md . | xargs -0 -l sed -i -e "s/replace-janssen-version/${LATEST:1}/g"
          fi
          git add . && git update-index --refresh
          cd ..

          echo "${STABLE}" > stable.txt
          git add stable.txt && git update-index --refresh
          git diff-index --quiet HEAD -- || git commit -S -m "Set stable to ${STABLE}"
          echo "${LATEST}" > latest.txt
          git add latest.txt && git update-index --refresh
          git diff-index --quiet HEAD -- || git commit -S -m "Set latest to ${LATEST}"
          git push origin gh-pages