schemas.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: Schemas

on:
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * 0"
  push:
    branches:
      - main
    paths:
      - .github/workflows/schemas.yaml

jobs:
  publish-schemas:
    name: Schemas
    runs-on:
      - arc-home-cluster-runner
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Setup Homebrew
        uses: Homebrew/actions/setup-homebrew@master

      - name: Setup Workflow Tools
        shell: bash
        run: brew install kubernetes-cli

      - name: Setup Python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: 3.x

      - name: Setup Node
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
        with:
          node-version: 18.x

      - name: Retrieve Kubeconfig from 1Password Vault
        id: op-load-kubeconfig-secret
        uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2
        with:
          export-env: false
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          KUBECONFIG_BASE64: op://${{ secrets.OP_VAULT_NAME }}/mcfio-github-actions-read/credential

      - name: Write Kubeconfig
        id: kubeconfig
        uses: timheuer/base64-to-file@adaa40c0c581f276132199d4cf60afa07ce60eac # v1.2
        with:
          encodedString: ${{ steps.op-load-kubeconfig-secret.outputs.KUBECONFIG_BASE64 }}
          fileName: kubeconfig

      - name: Run crd-extractor
        env:
          KUBECONFIG: ${{ steps.kubeconfig.outputs.filePath }}
        shell: bash
        run: |
          curl -fsSL -o $GITHUB_WORKSPACE/crd-extractor.sh \
            https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/Utilities/crd-extractor.sh
          chmod +x $GITHUB_WORKSPACE/crd-extractor.sh
          bash $GITHUB_WORKSPACE/crd-extractor.sh

      - name: Retrieve Cloudflare Token from 1Password Vault
        id: op-load-cloudflare-secret
        uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2
        with:
          export-env: false
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: op://${{ secrets.OP_VAULT_NAME }}/mcfio-cloudflare-pages/account_id
          CLOUDFLARE_API_TOKEN: op://${{ secrets.OP_VAULT_NAME }}/mcfio-cloudflare-pages/api_token

      - name: Deploy Schemas to Cloudflare Pages
        uses: cloudflare/wrangler-action@6d58852c35a27e6034745c5d0bc373d739014f7f # v3
        with:
          accountId: ${{ steps.op-load-cloudflare-secret.outputs.CLOUDFLARE_ACCOUNT_ID }}
          apiToken: ${{ steps.op-load-cloudflare-secret.outputs.CLOUDFLARE_API_TOKEN }}
          workingDirectory: /home/runner/.datree/crdSchemas
          command: pages deploy --project-name=crds --branch main .