action.yaml

name: "Workflow Config Loader (JSON)"
description: "Loads and parses JSON workflow configuration file"
author: "Solace"

inputs:
  config_file:
    description: "Path to JSON configuration file"
    required: true
  config_type:
    description: "Type of configuration to parse (container_scanning, sca_scanning, etc.)"
    required: true

outputs:
  config_json:
    description: "Raw configuration JSON"
    value: ${{ steps.load.outputs.config_json }}
  vault_url:
    description: "Vault URL (from vars.GCP_VAULT_ADDR)"
    value: ${{ steps.parse.outputs.vault_url }}
  vault_secret_path:
    description: "Vault secret path"
    value: ${{ steps.parse.outputs.vault_secret_path }}
  vault_role:
    description: "Vault JWT authentication role"
    value: ${{ steps.parse.outputs.vault_role }}
  vault_aws_role:
    description: "Vault AWS STS role path for ECR authentication"
    value: ${{ steps.parse.outputs.vault_aws_role }}
  vault_secret_mappings:
    description: "Formatted string of Vault secret mappings for hashicorp/vault-action"
    value: ${{ steps.parse.outputs.vault_secret_mappings }}
  slack_channel:
    description: "Slack notification channel"
    value: ${{ steps.parse.outputs.slack_channel }}
  fossa_licensing_mode:
    description: "FOSSA licensing check mode (BLOCK or REPORT)"
    value: ${{ steps.parse.outputs.fossa_licensing_mode }}
  fossa_licensing_block_on:
    description: "Comma-separated list of licensing issues to block on"
    value: ${{ steps.parse.outputs.fossa_licensing_block_on }}
  fossa_vulnerability_mode:
    description: "FOSSA vulnerability check mode (BLOCK or REPORT)"
    value: ${{ steps.parse.outputs.fossa_vulnerability_mode }}
  fossa_vulnerability_block_on:
    description: "Comma-separated list of vulnerability severities to block on"
    value: ${{ steps.parse.outputs.fossa_vulnerability_block_on }}
  fossa_project_id:
    description: "FOSSA project ID override"
    value: ${{ steps.parse.outputs.fossa_project_id }}
  fossa_team:
    description: "FOSSA team name"
    value: ${{ steps.parse.outputs.fossa_team }}
  fossa_labels:
    description: "Comma-separated FOSSA project labels"
    value: ${{ steps.parse.outputs.fossa_labels }}

runs:
  using: "composite"
  steps:
    - name: Load Configuration File
      id: load
      shell: bash
      run: |
        CONFIG_FILE="${{ inputs.config_file }}"
        echo "📂 Loading configuration from: $CONFIG_FILE"

        if [ ! -f "$CONFIG_FILE" ]; then
          echo "❌ Configuration file not found: $CONFIG_FILE"
          exit 1
        fi

        if ! CONFIG_JSON=$(jq -c '.' "$CONFIG_FILE" 2>&1); then
          echo "❌ Invalid JSON syntax in $CONFIG_FILE"
          echo "Error: $CONFIG_JSON"
          exit 1
        fi

        {
          echo "config_json<<EOF"
          echo "$CONFIG_JSON"
          echo "EOF"
        } >> $GITHUB_OUTPUT

        echo "✅ Configuration loaded successfully"

    - name: Parse Configuration
      id: parse
      shell: bash
      run: |
        CONFIG='${{ steps.load.outputs.config_json }}'
        CONFIG_TYPE="${{ inputs.config_type }}"

        echo "📋 Parsing configuration for type: $CONFIG_TYPE"

        # Parse vault URL from config (required in config file)
        VAULT_URL=$(echo "$CONFIG" | jq -r ".secrets.vault.url // .${CONFIG_TYPE}.secrets.vault.url // \"\"")
        echo "vault_url=${VAULT_URL}" >> $GITHUB_OUTPUT

        # Parse vault secret path
        VAULT_PATH=$(echo "$CONFIG" | jq -r ".secrets.vault.secret_path // .${CONFIG_TYPE}.secrets.vault.secret_path // \"/path/to/secret\"")
        echo "vault_secret_path=${VAULT_PATH}" >> $GITHUB_OUTPUT

        # Parse vault JWT authentication role
        VAULT_ROLE=$(echo "$CONFIG" | jq -r ".secrets.vault.role // .${CONFIG_TYPE}.secrets.vault.role // \"\"")
        echo "vault_role=${VAULT_ROLE}" >> $GITHUB_OUTPUT

        # Parse vault AWS role (for ECR authentication)
        VAULT_AWS_ROLE=$(echo "$CONFIG" | jq -r ".secrets.vault.aws_role // .${CONFIG_TYPE}.secrets.vault.aws_role // \"\"")
        echo "vault_aws_role=${VAULT_AWS_ROLE}" >> $GITHUB_OUTPUT

        # Parse vault secret mappings
        # Extract secret_mappings array
        SECRET_MAPPINGS=$(echo "$CONFIG" | jq -c ".secrets.vault.secret_mappings // .${CONFIG_TYPE}.secrets.vault.secret_mappings // empty")

        if [ -n "$SECRET_MAPPINGS" ] && [ "$SECRET_MAPPINGS" != "null" ]; then
          # Check if it's an array
          if echo "$SECRET_MAPPINGS" | jq -e 'type == "array"' > /dev/null; then
             # Join array elements with space + semicolon + newline (vault-action format)
             MAPPINGS_STRING=$(echo "$SECRET_MAPPINGS" | jq -r 'join(" ;\n")')

             # Use heredoc to preserve newlines in GitHub Actions output
             {
               echo "vault_secret_mappings<<EOF"
               echo "$MAPPINGS_STRING"
               echo "EOF"
             } >> $GITHUB_OUTPUT
          else
             echo "⚠️ secret_mappings found but not an array, ignoring."
             echo "vault_secret_mappings=" >> $GITHUB_OUTPUT
          fi
        else
          echo "vault_secret_mappings=" >> $GITHUB_OUTPUT
        fi

        # Parse slack channel (from root or default)
        SLACK=$(echo "$CONFIG" | jq -r '.slack_channel // "#your-slack-channel"')
        echo "slack_channel=${SLACK}" >> $GITHUB_OUTPUT

        # Parse FOSSA configuration
        FOSSA_LIC_MODE=$(echo "$CONFIG" | jq -r ".${CONFIG_TYPE}.fossa.policy.mode // \"REPORT\"")
        echo "fossa_licensing_mode=${FOSSA_LIC_MODE}" >> $GITHUB_OUTPUT

        FOSSA_LIC_BLOCK=$(echo "$CONFIG" | jq -r ".${CONFIG_TYPE}.fossa.policy.block_on // [\"policy_conflict\"] | join(\",\")")
        echo "fossa_licensing_block_on=${FOSSA_LIC_BLOCK}" >> $GITHUB_OUTPUT

        FOSSA_VULN_MODE=$(echo "$CONFIG" | jq -r ".${CONFIG_TYPE}.fossa.vulnerability.mode // \"REPORT\"")
        echo "fossa_vulnerability_mode=${FOSSA_VULN_MODE}" >> $GITHUB_OUTPUT

        FOSSA_VULN_BLOCK=$(echo "$CONFIG" | jq -r ".${CONFIG_TYPE}.fossa.vulnerability.block_on // [\"critical\",\"high\"] | join(\",\")")
        echo "fossa_vulnerability_block_on=${FOSSA_VULN_BLOCK}" >> $GITHUB_OUTPUT

        # Parse FOSSA project ID
        FOSSA_PROJECT=$(echo "$CONFIG" | jq -r ".${CONFIG_TYPE}.fossa.project_id // \"\"")
        echo "fossa_project_id=${FOSSA_PROJECT}" >> $GITHUB_OUTPUT

        # Parse FOSSA team
        FOSSA_TEAM=$(echo "$CONFIG" | jq -r ".${CONFIG_TYPE}.fossa.team // \"\"")
        echo "fossa_team=${FOSSA_TEAM}" >> $GITHUB_OUTPUT

        # Parse FOSSA labels (convert array to comma-separated string)
        FOSSA_LABELS=$(echo "$CONFIG" | jq -r ".${CONFIG_TYPE}.fossa.labels // [] | join(\",\")")
        echo "fossa_labels=${FOSSA_LABELS}" >> $GITHUB_OUTPUT

        echo "✅ Configuration parsed successfully"
        echo ""
        echo "Parsed values:"
        echo "  - Vault URL: ${VAULT_URL:-<not set>}"
        echo "  - Vault secret path: ${VAULT_PATH}"
        echo "  - Vault role: ${VAULT_ROLE:-<not set>}"
        echo "  - Vault AWS role: ${VAULT_AWS_ROLE:-<not set>}"
        echo "  - Slack channel: ${SLACK}"
        echo "  - FOSSA licensing: ${FOSSA_LIC_MODE} (block on: ${FOSSA_LIC_BLOCK})"
        echo "  - FOSSA vulnerability: ${FOSSA_VULN_MODE} (block on: ${FOSSA_VULN_BLOCK})"
        echo "  - FOSSA project ID: ${FOSSA_PROJECT:-<default>}"
        echo "  - FOSSA team: ${FOSSA_TEAM:-<not set>}"
        echo "  - FOSSA labels: ${FOSSA_LABELS:-<not set>}"