apiVersion: scaffolder.backstage.io/v1beta3
kind: Template
metadata:
  name: secure-repository-github-template
  title: Secure GitHub Repository Template
  description: Create a secure GitHub repository with best practices for security. Requires organization admin permissions.
  tags:
    - github
    - security
    - recommended
    - repository
  annotations:
    backstage.io/custom-icon: github
    backstage.io/custom-color: '#24292e'
    backstage.io/custom-card-background: 'linear-gradient(45deg, #24292e 0%, #2cbe4e 100%)'
    backstage.io/custom-logo: 'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIiBzdHJva2U9ImN1cnJlbnRDb2xvciIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiIGNsYXNzPSJmZWF0aGVyIGZlYXRoZXItZ2l0aHViIj48cGF0aCBkPSJNOSAxOWMtNSAxLjUtNS0yLjUtNy0zLW0xNCAxdjIuNWMwIDEuNS0xLjUgMywtMy41IDAsLTIgLTEsLTIgLTEsLTMuNSAxdjIuNSI+PC9wYXRoPjxwYXRoIGQ9Ik05IDE5YzAgMSAxIDIgMi41IDJzMi41IC0xIDIuNSAtMnYgLTYuNWE0IDQgMCAwIDAgLTQgLTQgNCw0IDAgMCAwIC00IDR2IDYuNXoiPjwvcGF0aD48L3N2Zz4='
spec:
  owner: armyknife
  type: service

  parameters:
    - title: Basic Information
      required:
        - name
        - description
        - owner
        - githubOwner
        - useDebugMode
      properties:
        name:
          title: Name
          type: string
          description: Unique name of the component
          ui:autofocus: true
          pattern: '^[a-z0-9-]+$'
          patternErrorMessage: Only lowercase letters, numbers, and dashes are allowed
        description:
          title: Description
          type: string
          description: Description of the component
        owner:
          title: Owner
          type: string
          description: Owner of the component
          ui:field: EntityPicker
          ui:options:
            catalogFilter:
              kind: ['Group']
        githubOwner:
          title: GitHub Organization
          type: string
          description: GitHub organization or username
          default: my-org
        useDebugMode:
          title: Use Debug Mode
          type: boolean
          description: Enable debug mode for testing without GitHub API calls
          default: false

    - title: Security Features
      required:
        - enableBranchProtection
        - enableSecurityScanning
      properties:
        enableBranchProtection:
          title: Enable Branch Protection
          type: boolean
          description: Enable branch protection rules
          default: true
        enableSecurityScanning:
          title: Enable Security Scanning
          type: boolean
          description: Enable security scanning (CodeQL, SAST, dependency scanning)
          default: true
        enableDependabot:
          title: Enable Dependabot
          type: boolean
          description: Enable Dependabot for dependency updates
          default: true

  steps:
    - id: createRepository
      name: Creating GitHub Repository
      action: armyknife:github:create-repo
      input:
        name: ${{ parameters.name }}
        owner: ${{ parameters.githubOwner }}
        description: ${{ parameters.description }}
        visibility: private
        enableSecurityFeatures: ${{ parameters.enableBranchProtection }}
        defaultBranch: main
      if: ${{ not parameters.useDebugMode }}

    - id: debugLog
      name: Debug Log
      action: debug:log
      input:
        message: 'Would create GitHub repository with name: ${{ parameters.name }}, owner: ${{ parameters.githubOwner }}'
      if: ${{ parameters.useDebugMode }}

    - id: registerCatalog
      name: Register in Catalog
      action: catalog:register
      input:
        repoContentsUrl: ${{ steps.createRepository.output.repoContentsUrl }}
        catalogInfoPath: /catalog-info.yaml
      if: ${{ not parameters.useDebugMode }}