jetbrains-auto-update-template.yml

permissions:
  id-token: write # This is required for requesting the JWT
  contents: read  # This is required for actions/checkout
on:
  workflow_call:
    inputs:
      productId:
        type: string
        required: true
      productCode:
        type: string
        required: true

jobs:
  update-jetbrains:
    runs-on: ubuntu-latest
    container:
      image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:fix-go-1-24-13-cve-2025-68121-gha.181
      options: --user root
    steps:
      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # pin@v2
      - name: Setup Environment
        uses: ./.github/actions/setup-environment
        with:
          identity_provider: ${{ github.ref == 'refs/heads/main' && secrets.CORE_DEV_PROVIDER || secrets.DEV_PREVIEW_PROVIDER }}
          service_account: ${{ github.ref == 'refs/heads/main' && secrets.CORE_DEV_SA || secrets.DEV_PREVIEW_SA }}
          leeway_segment_key: ${{ secrets.LEEWAY_SEGMENT_KEY }}
      - name: Install dependencies
        run: |
          cd ./dev/npm-tools && npm ci
          echo "$PWD/node_modules/.bin" >> $GITHUB_PATH
          cd $GITHUB_WORKSPACE/components/ide/gha-update-image/
          yarn
      - name: Find Nightly Target
        id: find-target
        run: |
          cd ./components/ide/gha-update-image/
          bun run index-jb-nightly.ts --task=1 --productCode=${{ inputs.productCode }}

          if [ -f /tmp/__gh_output.txt ]
          then
            cat /tmp/__gh_output.txt >> $GITHUB_OUTPUT
          fi
      - name: Leeway build
        id: leeway-build
        if: ${{ steps.find-target.outputs.buildNumber }}
        env:
          LEEWAY_MAX_PROVENANCE_BUNDLE_SIZE: "8388608"
          LEEWAY_REMOTE_CACHE_BUCKET: ${{ github.ref == 'refs/heads/main' && 'leeway-cache-main-c514a01' || 'leeway-cache-dev-3ac8ef5' }}
          LEEWAY_CACHE_UPLOAD_IMMEDIATE: true
        run: |
          echo "May upgrade latest ${{ inputs.productId }} image with ${{ steps.find-target.outputs.editorSummary }}"
          imageRepoBase=${{ github.ref == 'refs/heads/main' && 'eu.gcr.io/gitpod-core-dev/build' || 'eu.gcr.io/gitpod-dev-artifact/build' }}
          output=$(leeway build -Dversion=latest -DimageRepoBase=$imageRepoBase -DbuildNumber=${{ steps.find-target.outputs.buildNumber }} components/ide/jetbrains/image:${{ steps.find-target.outputs.image }}-latest -DjbBackendVersion=${{ steps.find-target.outputs.jbBackendVersion }} --dry-run)
          if echo "$output" | grep -q "🔧[[:space:]]*build"; then
            echo "leewayUsingCache=false" >> $GITHUB_OUTPUT
            echo "Needs to build"
            echo "Upgrade latest ${{ inputs.productId }} image with ${{ steps.find-target.outputs.editorSummary }}" >> $GITHUB_STEP_SUMMARY
            leeway build -Dversion=latest -DimageRepoBase=$imageRepoBase -DbuildNumber=${{ steps.find-target.outputs.buildNumber }} components/ide/jetbrains/image:${{ steps.find-target.outputs.image }}-latest -DjbBackendVersion=${{ steps.find-target.outputs.jbBackendVersion }}
          else
            echo "leewayUsingCache=true" >> $GITHUB_OUTPUT
            echo "No need to build"
          fi
      - name: Get previous job's status
        id: lastrun
        uses: filiptronicek/get-last-job-status@1c211ff20d1706ff0bc3fc8022f7bd6518b88bc4 # pin@main
      - name: Slack Notification
        if: ${{ (success() && steps.find-target.outputs.buildNumber && steps.leeway-build.outputs.leewayUsingCache == 'false') || failure() }}
        uses: rtCamp/action-slack-notify@cdf0a2130cbcdfd82ba5fcac8e076370bf381b36 # pin@v2
        env:
          SLACK_WEBHOOK: ${{ secrets.IDE_SLACK_WEBHOOK }}
          SLACK_COLOR: ${{ job.status }}
          SLACK_TITLE: Upgrade latest ${{ inputs.productId }} image with ${{ steps.find-target.outputs.editorSummary }}
          SLACK_FOOTER: "<https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|Workflow logs>"