dev-cleanup.yml

name: Dev Cleanup

on:
  pull_request:
    types: [closed]
    branches:
      - main
      - 'support/**'

# Deny-all default; the cleanup job grants only what it needs.
permissions: {}

env:
  TURBO_TELEMETRY_DISABLED: 1
  DO_NOT_TRACK: 1

jobs:
  cleanup:
    name: Cleanup Dev Packages
    runs-on: uipath-ubuntu-latest
    # Skip fork PRs — cleanup uses publish-scoped tokens; fork PRs must not receive them.
    if: github.event.pull_request.head.repo.fork == false
    permissions:
      contents: read
      pull-requests: write
      packages: write

    steps:
      - name: Checkout code
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
        with:
          ref: ${{ github.event.pull_request.base.ref }}
          persist-credentials: false

      - name: Install Node dependencies
        uses: ./.github/actions/install-node-deps

      - name: Get published packages from PR comment
        id: packages
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          COMMENT=$(gh api "repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" \
            --jq '[.[] | select(.body | contains("<!-- dev-packages-comment -->")) | select(.user.type == "Bot" or .user.login == "github-actions[bot]") | .body][0]' 2>/dev/null) || true

          if [ -z "$COMMENT" ]; then
            echo "No dev packages comment found"
            echo "packages=" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # Extract package@version from table format (supports pr123 and pr123.abc1234 formats)
          # Matches: | `@uipath/package@version-pr123.sha` | status | timestamp |
          # Backticks in the grep pattern are literal regex chars, not command substitution.
          # shellcheck disable=SC2016
          PACKAGES=$(echo "$COMMENT" | grep -oE '\| `@uipath/[a-z0-9-]+@[0-9.]+-pr[0-9]+(\.[a-z0-9]+)?`' | sed 's/^| `//' | sed "s/\`\$//" | sort -u)
          # Use delimiter for GitHub output (newlines not supported)
          {
            DELIM="PKGS_$(openssl rand -hex 8)"
            echo "packages<<${DELIM}"
            echo "$PACKAGES"
            echo "${DELIM}"
          } >> "$GITHUB_OUTPUT"
          echo "Found: $PACKAGES"

      - name: Cleanup dev packages
        if: steps.packages.outputs.packages != ''
        env:
          PACKAGES: ${{ steps.packages.outputs.packages }}
          GH_NPM_REGISTRY_TOKEN: ${{ github.token }}
        run: |
          echo "Cleaning up dev packages..."
          echo ""

          while IFS= read -r pkg_version; do
            [ -z "$pkg_version" ] && continue

            # Validate format for defense in depth (supports pr123 and pr123.abc1234)
            if ! [[ "$pkg_version" =~ ^@uipath/[a-z0-9-]+@[0-9.]+-pr[0-9]+(\.[a-z0-9]+)?$ ]]; then
              echo "::warning::Skipping invalid package version: $pkg_version"
              continue
            fi

            pkg_name="${pkg_version%@*}"
            version="${pkg_version##*@}"

            echo "Cleaning up $pkg_name@$version..."
            if pnpm unpublish:dev "$pkg_name" "$version"; then
              echo "  ✓ Cleaned up"
            else
              echo "  ✗ Could not clean up"
            fi
          done <<< "$PACKAGES"

          echo ""
          echo "Cleanup complete"

      - name: Update PR comment
        if: steps.packages.outputs.packages != ''
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set +e  # Don't exit on error, but capture it
          set -o pipefail  # Capture exit code from gh api, not head
          COMMENT_ID=$(gh api "repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" \
            --jq '([.[] | select(.body | contains("<!-- dev-packages-comment -->")) | .id][0] // empty)' 2>&1)
          EXIT_CODE=$?
          set -e

          if [ $EXIT_CODE -ne 0 ]; then
            echo "⚠️ Could not fetch comment (PR may be inaccessible)"
            echo "$COMMENT_ID"
            exit 0  # Non-fatal, comment update is optional
          fi

          if [ -n "$COMMENT_ID" ]; then
            TIMESTAMP=$(TZ="America/Los_Angeles" date "+%Y-%m-%d %H:%M:%S PT")
            COMMENT_BODY="<!-- dev-packages-comment -->"$'\n\n'
            COMMENT_BODY+="## 📦 Dev Packages"$'\n\n'
            COMMENT_BODY+="🧹 Dev packages cleaned up after PR close."$'\n\n'
            COMMENT_BODY+="**Last updated:** ${TIMESTAMP}"

            if ! gh api "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}" \
              -X PATCH -f body="$COMMENT_BODY" 2>&1; then
              echo "⚠️ Could not update comment (non-fatal)"
            else
              echo "✓ Updated cleanup status in PR comment"
            fi
          else
            echo "No comment found to update"
          fi