authentik/.github/actions/setup/action.yml

name: "Setup authentik testing environment"
description: "Setup authentik testing environment"

inputs:
  dependencies:
    description: "List of dependencies to setup"
    default: "system,python,rust,node,go,runtime"
  postgresql_version:
    description: "Optional postgresql image tag"
    default: "16"
  working-directory:
    description: |
      Optional working directory if this repo isn't in the root of the actions workspace.
      When set, needs to contain a trailing slash
    default: ""

runs:
  using: "composite"
  steps:
    - name: Cleanup apt
      if: ${{ contains(inputs.dependencies, 'system') || contains(inputs.dependencies, 'python') }}
      shell: bash
      run: sudo apt-get remove --purge man-db
    - name: Install apt deps
      if: ${{ contains(inputs.dependencies, 'system') || contains(inputs.dependencies, 'python') }}
      uses: gerlero/apt-install@c0fa73fe5c4a22deecf6d629565be92a15dd2026
      with:
        packages: libpq-dev openssl libxmlsec1-dev pkg-config gettext libclang-dev libkadm5clnt-mit12 libkadm5clnt7t64-heimdal libkrb5-dev krb5-kdc krb5-user krb5-admin-server
        update: true
        upgrade: false
        install-recommends: false
    - name: Make space on disk
      if: ${{ contains(inputs.dependencies, 'system') || contains(inputs.dependencies, 'python') }}
      shell: bash
      run: |
        sudo mkdir -p /tmp/empty/
        sudo rsync -a --delete /tmp/empty/ /usr/local/lib/android/
    - name: Install uv
      if: ${{ contains(inputs.dependencies, 'python') }}
      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v5
      with:
        enable-cache: true
    - name: Setup python
      if: ${{ contains(inputs.dependencies, 'python') }}
      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5
      with:
        python-version-file: "${{ inputs.working-directory }}pyproject.toml"
    - name: Install Python deps
      if: ${{ contains(inputs.dependencies, 'python') }}
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      run: uv sync --all-extras --dev --locked
    - name: Setup rust (stable)
      if: ${{ contains(inputs.dependencies, 'rust') && !contains(inputs.dependencies, 'rust-nightly') }}
      uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
      with:
        rustflags: ""
    - name: Setup rust (nightly)
      if: ${{ contains(inputs.dependencies, 'rust-nightly') }}
      uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
      with:
        toolchain: nightly
        components: rustfmt
        rustflags: ""
    - name: Setup rust dependencies
      if: ${{ contains(inputs.dependencies, 'rust') }}
      uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2
      with:
        tool: cargo-deny cargo-machete cargo-llvm-cov nextest
    - name: Setup pnpm
      if: ${{ contains(inputs.dependencies, 'node') }}
      uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      with:
        package_json_file: ${{ inputs.working-directory }}package.json
    - name: Pin pnpm store directory
      if: ${{ contains(inputs.dependencies, 'node') }}
      shell: bash
      run: |
        echo "PNPM_HOME=${RUNNER_TEMP}/pnpm-home" >> "$GITHUB_ENV"
        echo "npm_config_store_dir=${RUNNER_TEMP}/pnpm-home/store" >> "$GITHUB_ENV"
    - name: Setup node (root, web)
      if: ${{ contains(inputs.dependencies, 'node') }}
      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4
      with:
        node-version-file: ${{ inputs.working-directory }}package.json
        cache: pnpm
        cache-dependency-path: |
          ${{ inputs.working-directory }}pnpm-lock.yaml
          ${{ inputs.working-directory }}web/pnpm-lock.yaml
    - name: Install node dependencies (root, web)
      if: ${{ contains(inputs.dependencies, 'node') }}
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      run: |
        pnpm install --frozen-lockfile
        pnpm --dir web install --frozen-lockfile
    - name: Setup go
      if: ${{ contains(inputs.dependencies, 'go') }}
      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v5
      with:
        go-version-file: "${{ inputs.working-directory }}go.mod"
        cache-dependency-path: "${{ inputs.working-directory }}go.mod"
    - name: Setup docker cache
      if: ${{ contains(inputs.dependencies, 'runtime') }}
      uses: AndreKurait/docker-cache@7a3887908bdb97935395833df69b060cfcca0f7f
      with:
        key: docker-images-${{ runner.os }}-${{ hashFiles('.github/actions/setup/compose.yml', 'Makefile') }}-${{ inputs.postgresql_version }}
    - name: Setup dependencies
      if: ${{ contains(inputs.dependencies, 'runtime') }}
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      run: |
        export PSQL_TAG=${{ inputs.postgresql_version }}
        docker compose -f .github/actions/setup/compose.yml up -d --wait
    - name: Install web dependencies
      # Only when node is also requested: pnpm is provided by the node setup
      # above, and the web workspace needs a pnpm lockfile to install from. This
      # keeps runtime-only jobs (e.g. rust, pending-migrations) and the legacy
      # stable checkout — which predates the pnpm migration — from invoking pnpm.
      if: ${{ contains(inputs.dependencies, 'runtime') && contains(inputs.dependencies, 'node') }}
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      run: pnpm --dir web install --frozen-lockfile
    - name: Generate config
      if: ${{ contains(inputs.dependencies, 'python') }}
      shell: uv run python {0}
      working-directory: ${{ inputs.working-directory }}
      run: |
        from authentik.lib.generators import generate_id
        from yaml import safe_dump

        with open("local.env.yml", "w") as _config:
            safe_dump(
                {
                    "log_level": "debug",
                    "secret_key": generate_id(),
                },
                _config,
                default_flow_style=False,
            )