notify-radius.yaml

# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
---
name: Notify Radius

# Fires a `repository_dispatch` event to radius-project/radius so it can re-sync
# what it consumes from this repository.
#
# This is the resource-types-contrib side of the "sync default resource types
# without a fake Go module" design (radius PR #12236), Phase A. It adopts the
# hybrid of Option 3 (pinned git-ref) and Option 6 (automated, Dependabot-like
# PR sync), with the per-unit variant:
#
#   * Option 3 (pinned git-ref): the dispatch carries an immutable pin -- the
#     pushed commit SHA on the moving channel, or the release tag on the release
#     channel -- that Radius records in `deploy/manifest/defaults.yaml`. The pin
#     is no longer "informational only" (the old fake-module model fetched via
#     `go get ...@latest`); it is the exact revision Radius vendors.
#   * Option 6 (automated PR sync): Radius's contrib-update-resource-types.yaml
#     turns the dispatch into a reviewable `bot/update-resource-types` PR that
#     runs `make update-resource-types` / `make update-recipe-packs`, surfacing
#     the full YAML diff and the drift check + CI on every bump.
#   * Per-unit variant: the payload lists exactly the units this event affected,
#     so Radius advances only those instead of re-vendoring everything. The two
#     unit kinds match the two pin sections Radius keeps in defaults.yaml
#     (radius PR #12567):
#       - `namespaces`   -> `resourceTypes[]`, the `Radius.<Category>` manifests
#                           that are copied into the Radius repo.
#       - `recipe_packs` -> `recipePacks[]`, the packs under `recipe-packs/`.
#                           Radius pins these but never vendors them; its deploy
#                           workflows fetch the pack Bicep from here at deploy
#                           time, so the pin records which revision they target.
#
# Channels (both delivered as a reviewable PR, nothing fetched at build/runtime):
#   * edge    -> push to `main`. Keeps Radius `latest`/`edge` current with this
#                repo's `main`; affected units come from the changed manifest
#                YAML files and `recipe-packs/` files, pinned to the pushed
#                commit SHA.
#   * release -> a published release. Pins a stable upstream tag at Radius
#                release time; a scope-prefixed tag affects a single namespace
#                (`Radius.Data/vX.Y.Z`) or a single recipe pack
#                (`recipe-pack/azure/vX.Y.Z`), a plain `vX.Y.Z` tag affects all.
#
# End-to-end flow:
#   1. This workflow computes the per-unit payload and fires
#      repository_dispatch (event-type `resource-types-contrib-updated`).
#   2. Radius's contrib-update-resource-types.yaml receives it and opens/refreshes
#      a PR that re-runs the manifest copy and the pin rewrite for the pinned ref.
#   3. A maintainer reviews the YAML diff and merges the PR.
#
# Note: Radius only advances entries it already registers -- resource types
# listed in its deploy/manifest/defaults.yaml `defaultRegistration`, and packs
# listed under `recipePacks`. A namespace or pack added here but not registered
# there produces a dispatch with no effective changes and no PR.
#
# See the design note in the radius repo:
#   eng/design-notes/extensibility/2026-06-resource-types-sync-without-fake-go-module.md

on:
  push:
    branches:
      - main
    paths:
      # Trigger on any YAML change that could be a resource type manifest.
      # Excludes .github/ and docs/ which contain non-manifest YAML files.
      # This avoids hardcoding namespace folder names (Compute/, Data/, etc.)
      # so new top-level namespace folders are automatically covered.
      - "**/*.yaml"
      - "**/*.yml"
      - "!.github/**"
      - "!docs/**"
      # Recipe packs are Bicep, not YAML, and Radius pins them separately.
      - recipe-packs/**
  release:
    # Release channel: pin a stable upstream tag at Radius release time.
    types:
      - published
  # workflow_dispatch: # Enable during development for manual testing

permissions: {}

concurrency:
  # Serialize per event + ref so an edge push and a release don't race, but
  # never cancel an in-flight dispatch.
  group: notify-radius-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  dispatch:
    name: Notify radius-project/radius
    if: github.repository == 'radius-project/resource-types-contrib'
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      # Needed for actions/checkout to read this repository's history so the
      # push diff can resolve which namespaces changed.
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Full history so the per-namespace diff can resolve `event.before`.
          fetch-depth: 0

      - name: Compute sync payload
        # Resolves the channel, the immutable pin (SHA or tag), and the set of
        # affected units -- `Radius.<Category>` namespaces and `recipe-packs/`
        # packs -- then emits the compact JSON client-payload. Emits
        # unit_count=0 when nothing relevant changed (e.g. a prerelease), which
        # short-circuits the dispatch.
        id: payload
        env:
          EVENT_NAME: ${{ github.event_name }}
          BEFORE_SHA: ${{ github.event.before }}
          AFTER_SHA: ${{ github.sha }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          RELEASE_PRERELEASE: ${{ github.event.release.prerelease }}
          CONTRIB_REPO: ${{ github.repository }}
          ACTOR: ${{ github.actor }}
        run: ./.github/scripts/compute-radius-sync-payload.sh

      - name: Generate App Token
        # Uses a GitHub App token instead of a PAT so that the dispatch event
        # is sent with scoped, auditable credentials. The app must be installed
        # on the target repo (radius-project/radius) with contents:write to
        # trigger repository_dispatch.
        if: steps.payload.outputs.unit_count != '0'
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.RESOURCE_TYPES_BOT_CLIENT_ID }}
          private-key: ${{ secrets.RESOURCE_TYPES_BOT_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: |
            radius
          permission-metadata: read
          permission-contents: write

      - name: Send repository_dispatch to radius-project/radius
        # Fires the repository_dispatch event that Radius's
        # contrib-update-resource-types.yaml workflow listens for. The per-unit
        # client-payload (channel, immutable ref, and the affected namespaces
        # and recipe packs) is computed by the previous step.
        if: steps.payload.outputs.unit_count != '0'
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
        with:
          token: ${{ steps.app-token.outputs.token }}
          repository: radius-project/radius
          event-type: resource-types-contrib-updated
          client-payload: ${{ steps.payload.outputs.payload }}

      - name: Summarize
        # Write a summary to the GitHub Actions UI for visibility.
        run: |
          {
            echo "## Notify radius-project/radius"
            echo ""
            echo "* Event: \`${{ github.event_name }}\`"
            echo "* Channel: \`${{ steps.payload.outputs.channel }}\`"
            echo "* Ref: \`${{ steps.payload.outputs.ref }}\`"
            echo "* Affected namespaces (${{ steps.payload.outputs.namespace_count }}): \`${{ steps.payload.outputs.affected }}\`"
            echo "* Affected recipe packs (${{ steps.payload.outputs.recipe_pack_count }}): \`${{ steps.payload.outputs.affected_recipe_packs }}\`"
            if [ "${{ steps.payload.outputs.unit_count }}" = "0" ]; then
              echo ""
              echo "_No dispatch sent (reason: \`${{ steps.payload.outputs.reason }}\`)._"
            else
              echo "* Event type: \`resource-types-contrib-updated\`"
            fi
          } >> "${GITHUB_STEP_SUMMARY}"