action.yml

name: Authenticate Terminus from existing session, or initiate new session
description: Restores a Pantheon Terminus session by decrypting the cached
  session file and copying it into place. If existing session is missing or
  expired (or 'force-new-session' is true), initiates a new session, then
  encrypts and saves it to Actions cache. Also, installs Terminus on host if
  needed.

inputs:
  pantheon-machine-token:
    description: Pantheon Terminus machine token, also used as the gpg
      "symmetric" encryption passphrase to decrypt the terminus session file.
    required: true
  force-new-session:
    description: Set this to true to skip pulling session from cache and force
      creating a new session. E.g., for a nightly cron job that initiates a new
      Terminus session for the upcoming day.
    required: false
    default: false
  ddev:
    description: Set to TRUE to authenticate Terminus inside the DDEV container
      instead of the host.
    required: false
    default: false

runs:
  using: "composite"
  steps:

    - name: Set Terminus cache directory so we don't have to guess
      if: inputs.ddev != 'true'
      working-directory: ${{ runner.temp }}
      run: |
        # Set Terminus cache directory so we don't have to guess.
        echo TERMINUS_CACHE_DIR=${TERMINUS_CACHE_DIR:-~/.terminus/cache} >> $GITHUB_ENV

        # Also, install Terminus if missing.
        hash terminus 2> /dev/null || \
          curl -O https://raw.githubusercontent.com/pantheon-systems/terminus-installer/master/builds/installer.phar && \
          php installer.phar install &> /dev/null
      shell: bash

    - name: Set some environment variables when using DDEV
      if: inputs.ddev == 'true'
      run: |
        # Set some environment variables when using DDEV

        # Helper variable to optionally execute commands inside DDEV.
        echo exec='ddev exec' >> $GITHUB_ENV

        # Pull DDEV's Terminus cache directory setting into a local variable.
        echo -n TERMINUS_CACHE_DIR= >> $GITHUB_ENV
        ddev exec 'echo ${TERMINUS_CACHE_DIR:-~/.terminus/cache}' >> $GITHUB_ENV
      shell: bash

    - name: Ensure Terminus cache directory exists
      run: |
        # Ensure Terminus cache directory exists.
        $exec mkdir -p $TERMINUS_CACHE_DIR
      shell: bash

    - name: Set a cache path, key, and restore-key
      id: cache
      run: |
        # Set cache path, key, and restore-key.
        echo "path=${{ runner.temp }}/terminus-session.gpg" >> $GITHUB_OUTPUT

        machine_token_hash=`echo ${{ inputs.pantheon-machine-token }} | sha256sum | head -c 40`
        restore_key="terminus-session-$machine_token_hash"
        echo "restore-key=$restore_key-" >> $GITHUB_OUTPUT

        # Use the GitHub Actions "run id" to uniqify the cache key so that we
        # can force initiating a new session when requested via action input
        # (GitHub Actions caches are immutable and can't be updated for a given
        # key).
        # @see https://github.com/actions/cache/blob/main/tips-and-workarounds.md#update-a-cache
        echo "key=$restore_key-${{ github.run_id }}" >> $GITHUB_OUTPUT
      shell: bash

    - name: Restore encrypted terminus session file from GitHub Actions cache
      id: restore-cache
      if: inputs.force-new-session != 'true'
      uses: actions/cache/restore@v4
      with:
        path: ${{ steps.cache.outputs.path }}
        key: ${{ steps.cache.outputs.key }}
        restore-keys: ${{ steps.cache.outputs.restore-key }}
        enableCrossOsArchive: true

    - name: Decrypt cached session file and move into Terminus cache directory
      id: decrypt
      if: steps.restore-cache.outcome == 'success'
      run: |
        # Decrypt cached session file and move into Terminus cache directory

        # Verify that the encrypted session file was restored from cache.
        test -s ${{ steps.cache.outputs.path }}

        # Decrypt the session file using the "file descriptor" passphrase option
        # (--passphrase-fd) instead of regular --passphrase because it's more
        # secure to pipe the secret than to pass it as a command argument (which
        # would expose our machine token in the process list during decryption).
        echo ${{ inputs.pantheon-machine-token }} | \
          gpg2 --passphrase-fd \
               --batch \
               --yes \
               --pinentry loopback \
               --output terminus-session-temp \
               --decrypt ${{ steps.cache.outputs.path }}

        # Move the session file into place, to support DDEV.
        $exec mv terminus-session-temp $TERMINUS_CACHE_DIR/session

        # Check if restored session is still valid (normally lasts 24 hours).
        $exec terminus auth:whoami | grep -v "You are not logged in"
      continue-on-error: true
      shell: bash

    - name: Initiate a new Terminus session if the old one was not valid or
        a new session was requested, and encrypt new session file into GitHub
        Actions cache path
      id: encrypt
      if: steps.decrypt.outcome != 'success'
      run: |
        # Initiate a new Terminus session because the old one was missing or
        # expired, and encrypt new session file into GitHub Actions cache path.
        $exec terminus auth:login --machine-token ${{ inputs.pantheon-machine-token }}

        # Copy the session file to a mounted folder (in case of DDEV).
        $exec cp $TERMINUS_CACHE_DIR/session terminus-session-temp

        # Encrypt the session file using the "file descriptor" passphrase option
        # (--passphrase-fd) instead of regular --passphrase because it's more
        # secure to pipe the secret than pass it as a command argument (which
        # would expose our machine token in the process list during encryption).
        echo ${{ inputs.pantheon-machine-token }} | \
          gpg2 --passphrase-fd \
               --batch \
               --yes \
               --pinentry-mode loopback \
               --output ${{ steps.cache.outputs.path }} \
               --symmetric terminus-session-temp

        # Remove the temporary session file we copied.
        rm terminus-session-temp
      shell: bash

    - name: Save encrypted Terminus session file into GitHub Actions cache
      if: steps.encrypt.outcome == 'success'
      uses: actions/cache/save@v4
      with:
        path:  ${{ steps.cache.outputs.path }}
        key: ${{ steps.cache.outputs.key }}
        enableCrossOsArchive: true