oidc-github-e2e.yml

name: GitHub OIDC E2E
run-name: Trusted publishing E2E ${{ inputs.test_id }}

on:
  workflow_dispatch:
    inputs:
      cli_sha:
        description: Exact candidate CLI commit
        required: true
        type: string
      server_url:
        description: Isolated loopback URL allocated by op-build
        required: true
        type: string
      server_version:
        description: Expected candidate server version
        required: true
        type: string
      audience:
        description: Unique audience provisioned by op-build
        required: true
        type: string
      package_name:
        description: Disposable package provisioned by op-build
        required: true
        type: string
      runner_label:
        description: Unique label of the self-hosted build-machine runner
        required: true
        type: string
      test_id:
        description: Build correlation ID
        required: true
        type: string

permissions:
  contents: read
  id-token: write

concurrency:
  group: trusted-publishing-${{ inputs.runner_label }}
  cancel-in-progress: false

jobs:
  publish:
    name: Publish using a real GitHub identity
    runs-on: [self-hosted, linux, '${{ inputs.runner_label }}']
    timeout-minutes: 15
    environment: oidc-e2e
    env:
      ONEPUB_E2E_URL: ${{ inputs.server_url }}
      ONEPUB_E2E_VERSION: ${{ inputs.server_version }}
      ONEPUB_E2E_AUDIENCE: ${{ inputs.audience }}
      ONEPUB_E2E_PACKAGE: ${{ inputs.package_name }}

    steps:
      - name: Configure isolated CLI storage
        shell: bash
        run: |
          fixture_root="$RUNNER_TEMP/onepub-e2e-$GITHUB_RUN_ID"
          {
            echo "ONEPUB_PATH=$fixture_root/settings"
            echo "XDG_CONFIG_HOME=$fixture_root/config"
            echo "_PUB_TEST_CONFIG_DIR=$fixture_root/config/dart"
            echo "PUB_CACHE=$fixture_root/pub-cache"
          } >> "$GITHUB_ENV"

      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.cli_sha }}
          persist-credentials: false

      - name: Verify the candidate checkout
        env:
          EXPECTED_SHA: ${{ inputs.cli_sha }}
        run: test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"

      - uses: dart-lang/setup-dart@v1
        with:
          sdk: stable

      # setup-dart exports its default cache, overriding our isolated path.
      - name: Restore isolated package cache
        shell: bash
        run: echo "PUB_CACHE=$RUNNER_TEMP/onepub-e2e-$GITHUB_RUN_ID/pub-cache" >> "$GITHUB_ENV"

      - name: Install CLI dependencies
        run: dart pub get --enforce-lockfile

      - name: Publish with the GitHub trusted identity
        run: dart run tool/trusted_publishing_e2e.dart

      - name: Remove temporary credentials and cache
        if: always()
        shell: bash
        env:
          CLEANUP_PATH: ${{ runner.temp }}/onepub-e2e-${{ github.run_id }}
        run: rm -rf -- "$CLEANUP_PATH"