End-to-End Power Platform ALM with GitHub Actions: Dev, QA, and Production

name: Export Dev Solution

on:
  workflow_dispatch:
    inputs:
      version_type:
        description: "Choose how to update the solution version"
        required: true
        type: choice
        default: revision
        options:
          - revision
          - build
          - minor
          - major
          - custom

      custom_version:
        description: "Custom version (example: 2.3.0.0). Used only for custom."
        required: false
        type: string
        default: ""

permissions:
  contents: write
  pull-requests: write

env:
  SOLUTION_NAME: ${{ vars.PP_SOLUTION_NAME }}

jobs:
  export-dev-solution:
    name: Export Dev Solution
    runs-on: ubuntu-24.04

    steps:
      # 1. Checkout repository
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      # 2. Install Power Platform tools
      - name: Install Power Platform tools
        uses: microsoft/powerplatform-actions/actions-install@v1

      # 3. Set up .NET for PAC CLI
      - name: Set up .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: "10.0.x"

      # 4. Install PAC CLI
      - name: Install PAC CLI
        shell: bash
        run: |
          set -euo pipefail

          dotnet tool update --global Microsoft.PowerApps.CLI.Tool \
            || dotnet tool install --global Microsoft.PowerApps.CLI.Tool

          echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH"

          "$HOME/.dotnet/tools/pac" help

      # 5. Verify Dev connection
      - name: Verify Dev connection
        uses: microsoft/powerplatform-actions/who-am-i@v1
        with:
          environment-url: ${{ secrets.DEV_ENVIRONMENT_URL }}
          app-id: ${{ secrets.PP_APP_ID }}
          client-secret: ${{ secrets.PP_CLIENT_SECRET }}
          tenant-id: ${{ secrets.PP_TENANT_ID }}

      # 6. Authenticate PAC CLI to Dev
      - name: Authenticate PAC CLI to Dev
        shell: bash
        env:
          DEV_URL: ${{ secrets.DEV_ENVIRONMENT_URL }}
          APP_ID: ${{ secrets.PP_APP_ID }}
          CLIENT_SECRET: ${{ secrets.PP_CLIENT_SECRET }}
          TENANT_ID: ${{ secrets.PP_TENANT_ID }}
        run: |
          set -euo pipefail

          pac auth create \
            --name "Dev-SP" \
            --url "$DEV_URL" \
            --applicationId "$APP_ID" \
            --clientSecret "$CLIENT_SECRET" \
            --tenant "$TENANT_ID"

          pac auth select --name "Dev-SP"

      # 7. Calculate next solution version
      - name: Calculate solution version
        id: version
        shell: bash
        env:
          DEV_URL: ${{ secrets.DEV_ENVIRONMENT_URL }}
          VERSION_TYPE: ${{ inputs.version_type }}
          CUSTOM_VERSION: ${{ inputs.custom_version }}
        run: |
          set -euo pipefail

          if [ -z "$SOLUTION_NAME" ]; then
            echo "::error::PP_SOLUTION_NAME is not configured."
            exit 1
          fi

          OUTPUT=$(pac solution online-version \
            --solution-name "$SOLUTION_NAME" \
            --environment "$DEV_URL")

          echo "$OUTPUT"

          CURRENT_VERSION=$(printf '%s\n' "$OUTPUT" |
            grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' |
            head -n 1 || true)

          if [[ ! "$CURRENT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::Could not determine current solution version."
            exit 1
          fi

          IFS='.' read -r MAJOR MINOR BUILD REVISION <<< "$CURRENT_VERSION"

          case "$VERSION_TYPE" in
            revision)
              REVISION=$((REVISION + 1))
              NEW_VERSION="$MAJOR.$MINOR.$BUILD.$REVISION"
              ;;
            build)
              BUILD=$((BUILD + 1))
              NEW_VERSION="$MAJOR.$MINOR.$BUILD.0"
              ;;
            minor)
              MINOR=$((MINOR + 1))
              NEW_VERSION="$MAJOR.$MINOR.0.0"
              ;;
            major)
              MAJOR=$((MAJOR + 1))
              NEW_VERSION="$MAJOR.0.0.0"
              ;;
            custom)
              if [[ ! "$CUSTOM_VERSION" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
                echo "::error::Enter a valid four-part version, e.g. 2.3.0.0."
                exit 1
              fi
              NEW_VERSION="$CUSTOM_VERSION"
              ;;
            *)
              echo "::error::Unsupported version type: $VERSION_TYPE"
              exit 1
              ;;
          esac

          IFS='.' read -r V1 V2 V3 V4 <<< "$NEW_VERSION"

          for PART in "$V1" "$V2" "$V3" "$V4"; do
            if (( PART > 65535 )); then
              echo "::error::Version components must not exceed 65535."
              exit 1
            fi
          done

          if [[ "$NEW_VERSION" == "$CURRENT_VERSION" ]]; then
            echo "::error::New version must differ from current version."
            exit 1
          fi

          echo "Current version: $CURRENT_VERSION"
          echo "New version: $NEW_VERSION"

          echo "current_version=$CURRENT_VERSION" >> "$GITHUB_OUTPUT"
          echo "new_version=$NEW_VERSION" >> "$GITHUB_OUTPUT"

      # 8. Update solution version in Dev
      - name: Update solution version in Dev
        shell: bash
        env:
          DEV_URL: ${{ secrets.DEV_ENVIRONMENT_URL }}
          NEW_VERSION: ${{ steps.version.outputs.new_version }}
        run: |
          set -euo pipefail

          pac solution online-version \
            --solution-name "$SOLUTION_NAME" \
            --solution-version "$NEW_VERSION" \
            --environment "$DEV_URL"

          echo "Updated $SOLUTION_NAME to version $NEW_VERSION."

      # 9. Create export directory
      - name: Create export directory
        shell: bash
        run: mkdir -p out

      # 10. Export unmanaged solution
      - name: Export unmanaged solution
        uses: microsoft/powerplatform-actions/export-solution@v1
        with:
          environment-url: ${{ secrets.DEV_ENVIRONMENT_URL }}
          app-id: ${{ secrets.PP_APP_ID }}
          client-secret: ${{ secrets.PP_CLIENT_SECRET }}
          tenant-id: ${{ secrets.PP_TENANT_ID }}
          solution-name: ${{ env.SOLUTION_NAME }}
          solution-output-file: out/${{ env.SOLUTION_NAME }}.zip
          managed: false
          overwrite: true
          run-asynchronously: true
          max-async-wait-time: 60

      # 11. Export managed solution into the SAME directory.
      # PAC CLI Both unpacking uses the matching managed ZIP.
      - name: Export managed solution
        uses: microsoft/powerplatform-actions/export-solution@v1
        with:
          environment-url: ${{ secrets.DEV_ENVIRONMENT_URL }}
          app-id: ${{ secrets.PP_APP_ID }}
          client-secret: ${{ secrets.PP_CLIENT_SECRET }}
          tenant-id: ${{ secrets.PP_TENANT_ID }}
          solution-name: ${{ env.SOLUTION_NAME }}
          solution-output-file: out/${{ env.SOLUTION_NAME }}_managed.zip
          managed: true
          overwrite: true
          run-asynchronously: true
          max-async-wait-time: 60

      # 12. Verify both exports and their matching names
      - name: Verify exported packages
        shell: bash
        run: |
          set -euo pipefail

          UNMANAGED_ZIP="out/${SOLUTION_NAME}.zip"
          MANAGED_ZIP="out/${SOLUTION_NAME}_managed.zip"

          if [ ! -s "$UNMANAGED_ZIP" ]; then
            echo "::error::Unmanaged ZIP missing: $UNMANAGED_ZIP"
            exit 1
          fi

          if [ ! -s "$MANAGED_ZIP" ]; then
            echo "::error::Managed ZIP missing: $MANAGED_ZIP"
            exit 1
          fi

          unzip -t "$UNMANAGED_ZIP"
          unzip -t "$MANAGED_ZIP"

          echo "Both solution exports are present and valid."
          ls -lh "$UNMANAGED_ZIP" "$MANAGED_ZIP"

      # 13. Unpack BOTH formats into the Git source folder.
      # The matching *_managed.zip must remain beside the unmanaged ZIP.
      - name: Unpack combined solution source
        shell: bash
        run: |
          set -euo pipefail

          UNMANAGED_ZIP="out/${SOLUTION_NAME}.zip"
          SOURCE_FOLDER="solutions/${SOLUTION_NAME}"

          mkdir -p solutions

          # Remove old source so files from an earlier export
          # cannot accidentally remain in the new source.
          rm -rf "$SOURCE_FOLDER"

          pac solution unpack \
            --zipfile "$UNMANAGED_ZIP" \
            --folder "$SOURCE_FOLDER" \
            --packagetype Both \
            --clobber

          if [ ! -s "$SOURCE_FOLDER/Other/Solution.xml" ]; then
            echo "::error::Unpacked Solution.xml was not found."
            exit 1
          fi

          echo "Combined solution source created successfully."
          echo "Source folder: $SOURCE_FOLDER"
          find "$SOURCE_FOLDER" -type f | wc -l

      # 14. Stage the source changes
      - name: Stage solution source
        shell: bash
        run: |
          set -euo pipefail

          git add "solutions/$SOLUTION_NAME"

          if git diff --cached --quiet; then
            echo "No solution source changes detected."
            echo "Dev version may already have been updated."
            exit 0
          fi

      # 15. Push export branch and create PR
      - name: Push export branch and create pull request
        shell: bash
        env:
          ALM_GITHUB_TOKEN: ${{ secrets.ALM_GITHUB_TOKEN }}
          GH_TOKEN: ${{ secrets.ALM_GITHUB_TOKEN }}
          NEW_VERSION: ${{ steps.version.outputs.new_version }}
          CURRENT_VERSION: ${{ steps.version.outputs.current_version }}
          VERSION_TYPE: ${{ inputs.version_type }}
        run: |
          set -euo pipefail

          if [ -z "$ALM_GITHUB_TOKEN" ]; then
            echo "::error::ALM_GITHUB_TOKEN is not configured."
            exit 1
          fi

          # Skip creating an empty PR.
          if git diff --cached --quiet; then
            echo "No staged changes. Skipping PR creation."
            exit 0
          fi

          git config user.name "github-actions[bot]"
          git config user.email \
            "41898282+github-actions[bot]@users.noreply.github.com"

          BRANCH_NAME="automation/export-dev-${GITHUB_RUN_ID}"

          git checkout -b "$BRANCH_NAME"

          git commit \
            -m "Export $SOLUTION_NAME from Dev ($NEW_VERSION)"

          git remote set-url origin \
            "https://x-access-token:${ALM_GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"

          git push --set-upstream origin "$BRANCH_NAME"

          PR_URL=$(gh pr create \
            --repo "$GITHUB_REPOSITORY" \
            --base main \
            --head "$BRANCH_NAME" \
            --title "Export $SOLUTION_NAME from Dev - v$NEW_VERSION" \
            --body "## Summary
          - Solution: $SOLUTION_NAME
          - Previous version: $CURRENT_VERSION
          - New version: $NEW_VERSION
          - Version update type: $VERSION_TYPE
          - Exported managed and unmanaged packages from Dev.
          - Unpacked both formats into the source folder for Git.

          ## Validation
          Review the source changes and ensure required checks pass before merging.
          The managed build workflow runs after the source is merged to main.")

          echo "Pull request created: $PR_URL"

      # 16. Upload exported ZIPs for troubleshooting
      - name: Upload exported packages
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: ${{ env.SOLUTION_NAME }}-dev-exports-${{ github.run_id }}
          path: out/*.zip
          if-no-files-found: ignore
          retention-days: 7