push_json_to_pocketbase.yml

name: Push JSON changes to PocketBase

on:
  issues:
    types:
      - labeled
  push:
    branches:
      - main
    paths:
      - "json/**.json"
  workflow_dispatch:
    inputs:
      script_slug:
        description: "Script slug (e.g. my-app)"
        required: true
        type: string

permissions:
  contents: read

jobs:
  push-json:
    runs-on: self-hosted
    if: >-
      github.event_name == 'workflow_dispatch' ||
      github.event_name == 'push' ||
      (github.event_name == 'issues' && github.event.label.name == 'Ready For Testing')
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Get JSON file for script
        id: changed
        env:
          INPUT_SLUG: ${{ github.event.inputs.script_slug }}
          ISSUE_TITLE: ${{ github.event.issue.title }}
          ISSUE_BODY: ${{ github.event.issue.body }}
        run: |
          : > changed_app_jsons.txt

          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            script_slug="$INPUT_SLUG"
            if [[ "$script_slug" == "*" || "$script_slug" == "all" ]]; then
              count=0
              for f in json/*.json; do
                [[ -f "$f" ]] || continue
                jq -e '.slug' "$f" >/dev/null 2>&1 || continue
                echo "$f" >> changed_app_jsons.txt
                count=$((count + 1))
              done
              echo "count=${count}" >> "$GITHUB_OUTPUT"
              echo "Queued ${count} JSON files for push."
              exit 0
            fi
            file="json/${script_slug}.json"
            if [[ ! -f "$file" ]]; then
              echo "No JSON file at $file."
              echo "count=0" >> "$GITHUB_OUTPUT"
              exit 0
            fi
            if ! jq -e '.slug' "$file" >/dev/null 2>&1; then
              echo "File $file has no .slug."
              echo "count=0" >> "$GITHUB_OUTPUT"
              exit 0
            fi
            echo "$file" > changed_app_jsons.txt
            echo "count=1" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if [[ "${{ github.event_name }}" == "push" ]]; then
            count=0
            BEFORE="${{ github.event.before }}"
            if [[ -z "$BEFORE" || "$BEFORE" =~ ^0+$ ]]; then
              BEFORE="HEAD~1"
            fi
            while IFS= read -r f; do
              [[ -f "$f" ]] || continue
              jq -e '.slug' "$f" >/dev/null 2>&1 || continue
              echo "$f" >> changed_app_jsons.txt
              count=$((count + 1))
            done < <(git diff --name-only --diff-filter=d "$BEFORE" "${{ github.sha }}" -- 'json/*.json')
            echo "count=${count}" >> "$GITHUB_OUTPUT"
            echo "Push: queued ${count} changed JSON file(s)."
            exit 0
          fi

          # Same slug as move-to-main-repo: the "Name of the Script" field, else the title.
          name_raw=$(printf '%s\n' "$ISSUE_BODY" | tr -d '\r' \
            | sed -n '/^###[[:space:]]*Name of the Script/,/^###/p' \
            | sed '1d;/^###/d;/^[[:space:]]*$/d' | head -n1)
          script_slug=$(printf '%s' "${name_raw:-$ISSUE_TITLE}" | tr '[:upper:]' '[:lower:]' | sed 's/[[:space:]]\+/-/g')
          if [[ ! "$script_slug" =~ ^[a-z0-9][a-z0-9._-]*$ ]]; then
            echo "Issue does not give a valid slug."
            echo "count=0" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          file="json/${script_slug}.json"

          if [[ ! -f "$file" ]]; then
            echo "No JSON file at $file for issue '${ISSUE_TITLE}'."
            echo "count=0" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if ! jq -e '.slug' "$file" >/dev/null 2>&1; then
            echo "File $file has no .slug."
            echo "count=0" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "$file" > changed_app_jsons.txt
          echo "count=1" >> "$GITHUB_OUTPUT"

      - name: Push to PocketBase
        if: steps.changed.outputs.count != '0'
        env:
          POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
          POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
          POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
          POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
          ALLOW_CREATE: ${{ github.event_name != 'push' }}
        run: |
          node << 'ENDSCRIPT'
          (async function() {
          const fs = require('fs');
          const https = require('https');
          const http = require('http');
          const url = require('url');
          function request(fullUrl, opts, redirectCount) {
            redirectCount = redirectCount || 0;
            return new Promise(function(resolve, reject) {
              const u = url.parse(fullUrl);
              const isHttps = u.protocol === 'https:';
              const body = opts.body;
              const options = {
                hostname: u.hostname,
                port: u.port || (isHttps ? 443 : 80),
                path: u.path,
                method: opts.method || 'GET',
                headers: opts.headers || {}
              };
              if (body) options.headers['Content-Length'] = Buffer.byteLength(body);
              const lib = isHttps ? https : http;
              const req = lib.request(options, function(res) {
                if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
                  if (redirectCount >= 5) return reject(new Error('Too many redirects from ' + fullUrl));
                  const redirectUrl = url.resolve(fullUrl, res.headers.location);
                  res.resume();
                  resolve(request(redirectUrl, opts, redirectCount + 1));
                  return;
                }
                let data = '';
                res.on('data', function(chunk) { data += chunk; });
                res.on('end', function() {
                  resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, statusCode: res.statusCode, body: data });
                });
              });
              req.on('error', reject);
              if (body) req.write(body);
              req.end();
            });
          }
          const raw = process.env.POCKETBASE_URL.replace(/\/$/, '');
          const apiBase = /\/api$/i.test(raw) ? raw : raw + '/api';
          const coll = process.env.POCKETBASE_COLLECTION;
          // A plain push may only refresh scripts that are already published.
          // Publishing a new one requires the 'Ready For Testing' label or a manual dispatch.
          const allowCreate = process.env.ALLOW_CREATE === 'true';
          const pushedSlugs = [];
          const files = fs.readFileSync('changed_app_jsons.txt', 'utf8').trim().split(/\s+/).filter(Boolean);
          const authUrl = apiBase + '/collections/users/auth-with-password';
          console.log('Auth URL: ' + authUrl);
          const authBody = JSON.stringify({
            identity: process.env.POCKETBASE_ADMIN_EMAIL,
            password: process.env.POCKETBASE_ADMIN_PASSWORD
          });
          const authRes = await request(authUrl, {
            method: 'POST',
            headers: { 'Content-Type': 'application/json' },
            body: authBody
          });
          if (!authRes.ok) {
            throw new Error('Auth failed. Tried: ' + authUrl + ' - Verify POST to that URL with body {"identity":"...","password":"..."} works. Response: ' + authRes.body);
          }
          const token = JSON.parse(authRes.body).token;
          const recordsUrl = apiBase + '/collections/' + encodeURIComponent(coll) + '/records';
          let categoryIdToName = {};
          try {
            const metadata = JSON.parse(fs.readFileSync('json/metadata.json', 'utf8'));
            (metadata.categories || []).forEach(function(cat) { categoryIdToName[cat.id] = cat.name; });
          } catch (e) { console.warn('Could not load metadata.json:', e.message); }
          let typeValueToId = {};
          let categoryNameToPbId = {};
          try {
            const typesRes = await request(apiBase + '/collections/z_ref_script_types/records?perPage=500', { headers: { 'Authorization': token } });
            if (typesRes.ok) {
              const typesData = JSON.parse(typesRes.body);
              (typesData.items || []).forEach(function(item) {
                if (item.type != null) typeValueToId[item.type] = item.id;
                if (item.name != null) typeValueToId[item.name] = item.id;
                if (item.value != null) typeValueToId[item.value] = item.id;
              });
            }
          } catch (e) { console.warn('Could not fetch z_ref_script_types:', e.message); }
          try {
            const catRes = await request(apiBase + '/collections/script_categories/records?perPage=500', { headers: { 'Authorization': token } });
            if (catRes.ok) {
              const catData = JSON.parse(catRes.body);
              (catData.items || []).forEach(function(item) { if (item.name) categoryNameToPbId[item.name] = item.id; });
            }
          } catch (e) { console.warn('Could not fetch script_categories:', e.message); }

          for (const file of files) {
            if (!fs.existsSync(file)) continue;
            const data = JSON.parse(fs.readFileSync(file, 'utf8'));
            if (!data.slug) { console.log('Skipping', file, '(no slug)'); continue; }
            // execute_in: map type to canonical value (addon runs on both lxc and vm)
            var executeInMap = { ct: 'lxc', lxc: 'lxc', turnkey: 'turnkey', pve: 'pve', vm: 'vm', addon: ['lxc', 'vm'] };
            var executeIn = data.type ? (executeInMap[data.type.toLowerCase()] || null) : null;
            // github: extract owner/repo from full GitHub URL
            var githubField = null;
            if (data.github) {
              var ghMatch = data.github.match(/github\.com\/([^/]+\/[^/?#]+)/);
              if (ghMatch) githubField = ghMatch[1].replace(/\.git$/, '');
            }
            // last_update_commit: last commit touching the actual script files (ct/slug.sh, install/slug-install.sh, vm/slug.sh, etc.)
            var lastCommit = null;
            try {
              var cp = require('child_process');
              var scriptFiles = [];
              // primary script from install_methods[].script (e.g. "ct/teleport.sh", "vm/teleport.sh")
              (data.install_methods || []).forEach(function(im) {
                if (im.script) scriptFiles.push(im.script);
              });
              // derive install script from slug (install/slug-install.sh)
              scriptFiles.push('install/' + data.slug + '-install.sh');
              // filter to only files that actually exist in git
              var existingFiles = scriptFiles.filter(function(f) {
                try { cp.execSync('git ls-files --error-unmatch ' + f, { stdio: 'ignore' }); return true; } catch(e) { return false; }
              });
              if (existingFiles.length > 0) {
                lastCommit = cp.execSync('git log -1 --format=%H -- ' + existingFiles.join(' ')).toString().trim() || null;
              }
            } catch(e) { console.warn('Could not get last commit:', e.message); }
            var payload = {
              name: data.name,
              slug: data.slug,
              script_created: data.date_created || data.script_created,
              script_updated: new Date().toISOString().split('T')[0],
              updateable: data.updateable,
              privileged: data.privileged,
              port: data.interface_port != null ? data.interface_port : data.port,
              documentation: data.documentation,
              website: data.website,
              logo: data.logo,
              description: data.description,
              default_user: (data.default_credentials && data.default_credentials.username) || data.default_user || null,
              default_passwd: (data.default_credentials && data.default_credentials.password) || data.default_passwd || null,
              notes: data.notes || [],
              install_methods: data.install_methods || [],
              is_dev: true
            };
            if (executeIn) payload.execute_in = executeIn;
            if (githubField) payload.github = githubField;
            if (lastCommit) payload.last_update_commit = lastCommit;
            var resolvedType = typeValueToId[data.type];
            if (resolvedType == null && data.type === 'ct') resolvedType = typeValueToId['lxc'];
            if (resolvedType) payload.type = resolvedType;
            var resolvedCats = (data.categories || []).map(function(n) { return categoryNameToPbId[categoryIdToName[n]]; }).filter(Boolean);
            if (resolvedCats.length) payload.categories = resolvedCats;
            // architectures replaces has_arm: a boolean could say "also ARM" but
            // not "ARM only" or "amd64 only". A json file written before the
            // field existed is read through the old key so nothing drops.
            if (Array.isArray(data.architectures)) {
              payload.architectures = data.architectures.filter(function (a) { return a === 'amd64' || a === 'arm64'; });
            } else if (data.has_arm !== undefined) {
              payload.architectures = (data.has_arm === true || data.has_arm === 'true') ? ['amd64', 'arm64'] : ['amd64'];
            }
            if (Array.isArray(data.platforms)) {
              payload.platforms = data.platforms.filter(function (p) { return p === 'pve' || p === 'incus'; });
            }
            if (Array.isArray(data.app_vars)) payload.app_vars = data.app_vars;
            if (data.repository !== undefined) payload.repository = data.repository;
            if (data.version !== undefined) payload.version = data.version;
            if (data.changelog !== undefined) payload.changelog = data.changelog;
            if (data.screenshots !== undefined) payload.screenshots = data.screenshots;
            // Maintainer-owned: only written when the JSON carries the key, so an
            // unrelated push never clears a link a maintainer set by hand.
            if (data.oidc_url !== undefined) payload.oidc_url = data.oidc_url;
            const filter = "(slug='" + data.slug + "')";
            const listRes = await request(recordsUrl + '?filter=' + encodeURIComponent(filter) + '&perPage=1', {
              headers: { 'Authorization': token }
            });
            const list = JSON.parse(listRes.body);
            const existing = list.items && list.items[0];
            const existingId = existing && existing.id;
            if (existing && existing.is_dev === false) {
              console.log('Skipping', file, '(slug=' + data.slug + ') - live ProxmoxVE record, left to ProxmoxVE.');
            } else if (existingId) {
              console.log('Updating', file, '(slug=' + data.slug + ')');
              const r = await request(recordsUrl + '/' + existingId, {
                method: 'PATCH',
                headers: { 'Authorization': token, 'Content-Type': 'application/json' },
                body: JSON.stringify(payload)
              });
              if (!r.ok) throw new Error('PATCH failed: ' + r.body);
              pushedSlugs.push(data.slug);
            } else if (allowCreate) {
              console.log('Creating', file, '(slug=' + data.slug + ')');
              const r = await request(recordsUrl, {
                method: 'POST',
                headers: { 'Authorization': token, 'Content-Type': 'application/json' },
                body: JSON.stringify(payload)
              });
              if (!r.ok) throw new Error('POST failed: ' + r.body);
              pushedSlugs.push(data.slug);
            } else {
              console.log('Skipping', file, '(slug=' + data.slug + ') - not published yet; add the "Ready For Testing" label to the issue to publish it.');
            }
          }
          fs.writeFileSync('pushed_slugs.txt', pushedSlugs.join('\n'));
          console.log('Done. Pushed ' + pushedSlugs.length + ' of ' + files.length + ' file(s).');
          })().catch(e => { console.error(e); process.exit(1); });
          ENDSCRIPT
        shell: bash

      - name: Revalidate Frontend Cache
        if: steps.changed.outputs.count != '0'
        env:
          FRONTEND_URL: ${{ vars.FRONTEND_URL }}
          REVALIDATE_SECRET: ${{ secrets.FRONTEND_INGEST_SECRET }}
        run: |
          if [[ -z "$FRONTEND_URL" || -z "$REVALIDATE_SECRET" ]]; then
            echo "FRONTEND_URL or REVALIDATE_SECRET not set, skipping revalidation."
            exit 0
          fi
          if [[ ! -s pushed_slugs.txt ]]; then
            echo "Nothing was pushed to PocketBase, skipping revalidation."
            exit 0
          fi
          SLUGS=$(jq -R -s -c 'split("\n") | map(select(length > 0))' < pushed_slugs.txt)
          echo "Revalidating tags: scripts, categories — slugs: $SLUGS"
          curl -sf -X POST "${FRONTEND_URL}/api/revalidate" \
            -H "Authorization: Bearer ${REVALIDATE_SECRET}" \
            -H "Content-Type: application/json" \
            -d "{\"tags\":[\"scripts\",\"categories\"],\"slugs\":${SLUGS}}" \
            && echo "Cache revalidated." \
            || echo "Warning: revalidation failed (non-critical)."