action.yml

name: LTI auto configuration
description: Wrap @oxctl/lti-auto-configuration for reusable GitHub Action workflows
branding:
  icon: settings
  color: blue

inputs:
  mode:
    description: Command to run with lti-auto-configuration.
    required: false
    default: deploy
  working-directory:
    description: Directory containing tool-config/default.json and related files
    required: false
    default: .
  canvas-url:
    description: Canvas host URL for profile setup
    required: true
  tool-support-url:
    description: Tool Support URL for profile setup
    required: true
  canvas-token:
    description: Canvas token for profile setup
    required: true
  tool-support-username:
    description: Tool Support username for profile setup
    required: true
  tool-support-password:
    description: Tool Support password for profile setup
    required: true
  node-config:
    description: Optional NODE_CONFIG JSON override passed to the CLI
    required: false
    default: ""
  node-extra-ca-certs:
    description: Optional path for NODE_EXTRA_CA_CERTS when using self-signed certs
    required: false
    default: ""

outputs:
  client-id:
    description: LTI client ID from JSON summary (deploy/create/update) or export
    value: ${{ steps.run-command.outputs.client-id }}
  external-tool-id:
    description: External tool ID from JSON command summary (create/update/deploy)
    value: ${{ steps.run-command.outputs.external-tool-id }}
  export-json:
    description: JSON summary (deploy/create/update) or full JSON from export
    value: ${{ steps.run-command.outputs.export-json }}

runs:
  using: composite
  steps:
    - name: Setup Node.js
      uses: actions/setup-node@v6
      with:
        node-version: "24"

    - name: Install lti-auto-configuration
      shell: bash
      run: npm install --global "@oxctl/lti-auto-configuration@2.7.0"

    - name: Configure CLI profile
      shell: bash
      env:
        CANVAS_URL: ${{ inputs.canvas-url }}
        TOOL_SUPPORT_URL: ${{ inputs.tool-support-url }}
        CANVAS_TOKEN: ${{ inputs.canvas-token }}
        TOOL_SUPPORT_USERNAME: ${{ inputs.tool-support-username }}
        TOOL_SUPPORT_PASSWORD: ${{ inputs.tool-support-password }}
      run: |
        set -euo pipefail

        for secret in "$CANVAS_TOKEN" "$TOOL_SUPPORT_USERNAME" "$TOOL_SUPPORT_PASSWORD"; do
          if [ -n "$secret" ]; then
            echo "::add-mask::$secret"
          fi
        done

        mkdir -p "$HOME/.tool-config"
        jq -n \
          --arg canvas_url "$CANVAS_URL" \
          --arg tool_support_url "$TOOL_SUPPORT_URL" \
          --arg canvas_token "$CANVAS_TOKEN" \
          --arg tool_support_username "$TOOL_SUPPORT_USERNAME" \
          --arg tool_support_password "$TOOL_SUPPORT_PASSWORD" \
          '{
            setup: {
              canvas_url: $canvas_url,
              tool_support_url: $tool_support_url
            },
            secrets: {
              canvas_token: $canvas_token,
              tool_support_username: $tool_support_username,
              tool_support_password: $tool_support_password
            }
          }' > "$HOME/.tool-config/default.json"

    - name: Run lti-auto-configuration
      id: run-command
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      env:
        MODE: ${{ inputs.mode }}
        NODE_CONFIG: ${{ inputs.node-config }}
        NODE_EXTRA_CA_CERTS: ${{ inputs.node-extra-ca-certs }}
      run: |
        set -euo pipefail

        export NODE_ENV="default"
        cmd=(npx @oxctl/lti-auto-configuration)

        case "$MODE" in
          deploy|create|update)
            summary_payload="$("${cmd[@]}" "$MODE" --json)"
            client_id="$(jq -r '.developerKeys.lti.id // empty' <<<"$summary_payload")"
            external_tool_id="$(jq -r '.externalTools.lti.id // empty' <<<"$summary_payload")"
            printf 'export-json<<EOF\n%s\nEOF\n' "$summary_payload" >> "$GITHUB_OUTPUT"
            echo "client-id=$client_id" >> "$GITHUB_OUTPUT"
            echo "external-tool-id=$external_tool_id" >> "$GITHUB_OUTPUT"
            ;;
          export)
            export_payload="$("${cmd[@]}" "$MODE")"
            printf 'export-json<<EOF\n%s\nEOF\n' "$export_payload" >> "$GITHUB_OUTPUT"
            client_id="$(jq -r '.toolReg.lti.clientId // empty' <<<"$export_payload")"
            echo "client-id=$client_id" >> "$GITHUB_OUTPUT"
            ;;
          validate|delete|list|init)
            "${cmd[@]}" "$MODE"
            ;;
          *)
            echo "Unsupported mode: $MODE" >&2
            exit 1
            ;;
        esac