refactor: extract inline bash into testable scripts with CI pipeline

[0x46616c6b]

Type of Change

• Refactoring

Description

Extracts all inline bash logic from action.yml into separate, testable script files and adds a comprehensive test suite and CI pipeline. This improves maintainability, testability, and reliability without changing any external behavior.

Script extraction:
All inline bash from action.yml is moved into individual scripts under scripts/, each with a single responsibility. The action.yml shrinks from 464 to ~290 lines and becomes pure orchestration — referencing scripts via ${{ github.action_path }}/scripts/*.sh with inputs passed as environment variables.

GitHub Deployments via actions/github-script:
Replaces the manual curl + jq deployment creation with actions/github-script using Octokit. This provides automatic retry/rate-limiting, type-safe API access, and proper error handling without manual HTTP status parsing.

Deduplication and improvements:

• 4x duplicated while IFS= read loops → single process_file_updates() function
• push || push || push → retry_with_backoff 5 2 with exponential backoff
• array=($line) (shellcheck SC2206) → read -r file field
• Shared utility library: logging, retry, input validation, output helpers

Test suite (64 bats-core tests):
Covers tag generation (all branch/tag combinations), architecture validation, image retagging (with curl mocks), GitOps functions (update, commit, push, annotations), and the full update orchestrator.

CI pipeline:
New workflow with shellcheck linting, bats test execution, and action structure validation (verifies all referenced scripts exist and are executable).

Backward compatibility: All 29 inputs, 3 outputs, and existing step IDs (preparation, docker_build, docker_retag, update_image) remain unchanged. Consumers do not need to modify their workflows.

Checklist

• Write tests
• Make sure all tests pass
• Update documentation
• Review the Contributing Guideline and sign CLA
• Reference relevant issue(s) and close them after merging

---

_{The changes and the PR were generated by Claude.}

[flaxel]

Could you test the whole refactored implementation already in another repository? 🤔

[0x46616c6b]

The PR includes 64 unit tests that cover all extracted bash logic (tag generation, architecture validation, retagging, GitOps updates, deployment annotations). These validate the refactored scripts behave identically to the original inline bash.

I will test it today and report back.

[0x46616c6b]

Working examples:

• https://github.com/Staffbase/flux-deployment-reporter/actions/runs/24823603656/job/72654105572
• https://github.com/Staffbase/flux-deployment-reporter/actions/runs/24824061577/job/72655641932
• https://github.com/Staffbase/backstage-app/actions/runs/24824662882/job/72657449873
• https://github.com/Staffbase/backstage-app/actions/runs/24825080705/job/72658830220
• https://github.com/Staffbase/github-policy-agent/actions/runs/24825196612/job/72659408747