@backstage/plugin-scaffolder-backend 1.4.0-next.3 → 1.5.0-next.1

package/dist/index.cjs.js

@@ -147,7 +147,9 @@ function createCatalogRegisterAction(options) {
         const { repoContentsUrl, catalogInfoPath = "/catalog-info.yaml" } = input;
         const integration = integrations.byUrl(repoContentsUrl);
         if (!integration) {
-          throw new errors.InputError(`No integration found for host ${repoContentsUrl}`);
+          throw new errors.InputError(
+            `No integration found for host ${repoContentsUrl}`
+          );
         }
         catalogInfoUrl = integration.resolveUrl({
           base: repoContentsUrl,
@@ -155,22 +157,32 @@ function createCatalogRegisterAction(options) {
         });
       }
       ctx.logger.info(`Registering ${catalogInfoUrl} in the catalog`);
-      await catalogClient.addLocation({
-        type: "url",
-        target: catalogInfoUrl
-      }, ((_a = ctx.secrets) == null ? void 0 : _a.backstageToken) ? { token: ctx.secrets.backstageToken } : {});
-      try {
-        const result = await catalogClient.addLocation({
-          dryRun: true,
+      await catalogClient.addLocation(
+        {
           type: "url",
           target: catalogInfoUrl
-        }, ((_b = ctx.secrets) == null ? void 0 : _b.backstageToken) ? { token: ctx.secrets.backstageToken } : {});
+        },
+        ((_a = ctx.secrets) == null ? void 0 : _a.backstageToken) ? { token: ctx.secrets.backstageToken } : {}
+      );
+      try {
+        const result = await catalogClient.addLocation(
+          {
+            dryRun: true,
+            type: "url",
+            target: catalogInfoUrl
+          },
+          ((_b = ctx.secrets) == null ? void 0 : _b.backstageToken) ? { token: ctx.secrets.backstageToken } : {}
+        );
         if (result.entities.length > 0) {
           const { entities } = result;
           let entity;
-          entity = entities.find((e) => !e.metadata.name.startsWith("generated-") && e.kind === "Component");
+          entity = entities.find(
+            (e) => !e.metadata.name.startsWith("generated-") && e.kind === "Component"
+          );
           if (!entity) {
-            entity = entities.find((e) => !e.metadata.name.startsWith("generated-"));
+            entity = entities.find(
+              (e) => !e.metadata.name.startsWith("generated-")
+            );
           }
           if (!entity) {
             entity = entities[0];
@@ -213,7 +225,10 @@ function createCatalogWriteAction() {
       ctx.logStream.write(`Writing catalog-info.yaml`);
       const { filePath, entity } = ctx.input;
       const path = filePath != null ? filePath : "catalog-info.yaml";
-      await fs__default["default"].writeFile(backendCommon.resolveSafeChildPath(ctx.workspacePath, path), yaml__namespace.stringify(entity));
+      await fs__default["default"].writeFile(
+        backendCommon.resolveSafeChildPath(ctx.workspacePath, path),
+        yaml__namespace.stringify(entity)
+      );
     }
   });
 }
@@ -249,18 +264,22 @@ function createDebugLogAction() {
       }
       if ((_b = ctx.input) == null ? void 0 : _b.listWorkspace) {
         const files = await recursiveReadDir(ctx.workspacePath);
-        ctx.logStream.write(`Workspace:
-${files.map((f) => `  - ${path.relative(ctx.workspacePath, f)}`).join("\n")}`);
+        ctx.logStream.write(
+          `Workspace:
+${files.map((f) => `  - ${path.relative(ctx.workspacePath, f)}`).join("\n")}`
+        );
       }
     }
   });
 }
 async function recursiveReadDir(dir) {
   const subdirs = await fs.readdir(dir);
-  const files = await Promise.all(subdirs.map(async (subdir) => {
-    const res = path.join(dir, subdir);
-    return (await fs.stat(res)).isDirectory() ? recursiveReadDir(res) : [res];
-  }));
+  const files = await Promise.all(
+    subdirs.map(async (subdir) => {
+      const res = path.join(dir, subdir);
+      return (await fs.stat(res)).isDirectory() ? recursiveReadDir(res) : [res];
+    })
+  );
   return files.reduce((a, f) => a.concat(f), []);
 }
 
@@ -295,7 +314,9 @@ async function fetchContents({
         base: baseUrl
       });
     } else {
-      throw new errors.InputError(`Failed to fetch, template location could not be determined and the fetch URL is relative, ${fetchUrl}`);
+      throw new errors.InputError(
+        `Failed to fetch, template location could not be determined and the fetch URL is relative, ${fetchUrl}`
+      );
     }
     const res = await reader.readTree(readUrl);
     await fs__default["default"].ensureDir(outputPath);
@@ -424,13 +445,21 @@ class SecureTemplater {
       sandbox.parseRepoUrl = (url) => JSON.stringify(parseRepoUrl(url));
     }
     if (additionalTemplateFilters) {
-      sandbox.additionalTemplateFilters = Object.fromEntries(Object.entries(additionalTemplateFilters).filter(([_, filterFunction]) => !!filterFunction).map(([filterName, filterFunction]) => [
-        filterName,
-        (...args) => JSON.stringify(filterFunction(...args))
-      ]));
+      sandbox.additionalTemplateFilters = Object.fromEntries(
+        Object.entries(additionalTemplateFilters).filter(([_, filterFunction]) => !!filterFunction).map(([filterName, filterFunction]) => [
+          filterName,
+          (...args) => JSON.stringify(filterFunction(...args))
+        ])
+      );
     }
     const vm = new vm2.VM({ sandbox });
-    const nunjucksSource = await fs__default["default"].readFile(backendCommon.resolvePackagePath("@backstage/plugin-scaffolder-backend", "assets/nunjucks.js.txt"), "utf-8");
+    const nunjucksSource = await fs__default["default"].readFile(
+      backendCommon.resolvePackagePath(
+        "@backstage/plugin-scaffolder-backend",
+        "assets/nunjucks.js.txt"
+      ),
+      "utf-8"
+    );
     vm.run(mkScript(nunjucksSource));
     const render = (template, values) => {
       if (!vm) {
@@ -473,13 +502,21 @@ function createFetchTemplateAction(options) {
             type: "object"
           },
           copyWithoutRender: {
-            title: "Copy Without Render",
+            title: "[Deprecated] Copy Without Render",
             description: "An array of glob patterns. Any files or directories which match are copied without being processed as templates.",
             type: "array",
             items: {
               type: "string"
             }
           },
+          copyWithoutTemplating: {
+            title: "Copy Without Templating",
+            description: "An array of glob patterns. Contents of matched files or directories are copied without being processed, but paths are subject to rendering.",
+            type: "array",
+            items: {
+              type: "string"
+            }
+          },
           cookiecutterCompat: {
             title: "Cookiecutter compatibility mode",
             description: "Enable features to maximise compatibility with templates built for fetch:cookiecutter",
@@ -501,11 +538,32 @@ function createFetchTemplateAction(options) {
       const templateDir = backendCommon.resolveSafeChildPath(workDir, "template");
       const targetPath = (_a = ctx.input.targetPath) != null ? _a : "./";
       const outputDir = backendCommon.resolveSafeChildPath(ctx.workspacePath, targetPath);
-      if (ctx.input.copyWithoutRender && !Array.isArray(ctx.input.copyWithoutRender)) {
-        throw new errors.InputError("Fetch action input copyWithoutRender must be an Array");
+      if (ctx.input.copyWithoutRender && ctx.input.copyWithoutTemplating) {
+        throw new errors.InputError(
+          "Fetch action input copyWithoutRender and copyWithoutTemplating can not be used at the same time"
+        );
       }
-      if (ctx.input.templateFileExtension && (ctx.input.copyWithoutRender || ctx.input.cookiecutterCompat)) {
-        throw new errors.InputError("Fetch action input extension incompatible with copyWithoutRender and cookiecutterCompat");
+      let copyOnlyPatterns;
+      let renderFilename;
+      if (ctx.input.copyWithoutRender) {
+        ctx.logger.warn(
+          "[Deprecated] Please use copyWithoutTemplating instead."
+        );
+        copyOnlyPatterns = ctx.input.copyWithoutRender;
+        renderFilename = false;
+      } else {
+        copyOnlyPatterns = ctx.input.copyWithoutTemplating;
+        renderFilename = true;
+      }
+      if (copyOnlyPatterns && !Array.isArray(copyOnlyPatterns)) {
+        throw new errors.InputError(
+          "Fetch action input copyWithoutRender/copyWithoutTemplating must be an Array"
+        );
+      }
+      if (ctx.input.templateFileExtension && (copyOnlyPatterns || ctx.input.cookiecutterCompat)) {
+        throw new errors.InputError(
+          "Fetch action input extension incompatible with copyWithoutRender/copyWithoutTemplating and cookiecutterCompat"
+        );
       }
       let extension = false;
       if (ctx.input.templateFileExtension) {
@@ -529,59 +587,84 @@ function createFetchTemplateAction(options) {
         markDirectories: true,
         followSymbolicLinks: false
       });
-      const nonTemplatedEntries = new Set((await Promise.all((ctx.input.copyWithoutRender || []).map((pattern) => globby__default["default"](pattern, {
-        cwd: templateDir,
-        dot: true,
-        onlyFiles: false,
-        markDirectories: true,
-        followSymbolicLinks: false
-      })))).flat());
+      const nonTemplatedEntries = new Set(
+        (await Promise.all(
+          (copyOnlyPatterns || []).map(
+            (pattern) => globby__default["default"](pattern, {
+              cwd: templateDir,
+              dot: true,
+              onlyFiles: false,
+              markDirectories: true,
+              followSymbolicLinks: false
+            })
+          )
+        )).flat()
+      );
       const { cookiecutterCompat, values } = ctx.input;
       const context = {
         [cookiecutterCompat ? "cookiecutter" : "values"]: values
       };
-      ctx.logger.info(`Processing ${allEntriesInTemplate.length} template files/directories with input values`, ctx.input.values);
+      ctx.logger.info(
+        `Processing ${allEntriesInTemplate.length} template files/directories with input values`,
+        ctx.input.values
+      );
       const renderTemplate = await SecureTemplater.loadRenderer({
         cookiecutterCompat: ctx.input.cookiecutterCompat,
         additionalTemplateFilters
       });
       for (const location of allEntriesInTemplate) {
-        let renderFilename;
         let renderContents;
         let localOutputPath = location;
         if (extension) {
-          renderFilename = true;
           renderContents = path.extname(localOutputPath) === extension;
           if (renderContents) {
             localOutputPath = localOutputPath.slice(0, -extension.length);
           }
+          localOutputPath = renderTemplate(localOutputPath, context);
         } else {
-          renderFilename = renderContents = !nonTemplatedEntries.has(location);
+          renderContents = !nonTemplatedEntries.has(location);
+          if (renderFilename) {
+            localOutputPath = renderTemplate(localOutputPath, context);
+          } else {
+            localOutputPath = renderContents ? renderTemplate(localOutputPath, context) : localOutputPath;
+          }
         }
-        if (renderFilename) {
-          localOutputPath = renderTemplate(localOutputPath, context);
+        if (containsSkippedContent(localOutputPath)) {
+          continue;
         }
         const outputPath = backendCommon.resolveSafeChildPath(outputDir, localOutputPath);
-        if (outputDir === outputPath) {
+        if (fs__default["default"].existsSync(outputPath)) {
           continue;
         }
         if (!renderContents && !extension) {
-          ctx.logger.info(`Copying file/directory ${location} without processing.`);
+          ctx.logger.info(
+            `Copying file/directory ${location} without processing.`
+          );
         }
         if (location.endsWith("/")) {
-          ctx.logger.info(`Writing directory ${location} to template output path.`);
+          ctx.logger.info(
+            `Writing directory ${location} to template output path.`
+          );
           await fs__default["default"].ensureDir(outputPath);
         } else {
           const inputFilePath = backendCommon.resolveSafeChildPath(templateDir, location);
           const stats = await fs__default["default"].promises.lstat(inputFilePath);
           if (stats.isSymbolicLink() || await isbinaryfile.isBinaryFile(inputFilePath)) {
-            ctx.logger.info(`Copying file binary or symbolic link at ${location}, to template output path.`);
+            ctx.logger.info(
+              `Copying file binary or symbolic link at ${location}, to template output path.`
+            );
             await fs__default["default"].copy(inputFilePath, outputPath);
           } else {
             const statsObj = await fs__default["default"].stat(inputFilePath);
-            ctx.logger.info(`Writing file ${location} to template output path with mode ${statsObj.mode}.`);
+            ctx.logger.info(
+              `Writing file ${location} to template output path with mode ${statsObj.mode}.`
+            );
             const inputFileContents = await fs__default["default"].readFile(inputFilePath, "utf-8");
-            await fs__default["default"].outputFile(outputPath, renderContents ? renderTemplate(inputFileContents, context) : inputFileContents, { mode: statsObj.mode });
+            await fs__default["default"].outputFile(
+              outputPath,
+              renderContents ? renderTemplate(inputFileContents, context) : inputFileContents,
+              { mode: statsObj.mode }
+            );
           }
         }
       }
@@ -589,6 +672,9 @@ function createFetchTemplateAction(options) {
     }
   });
 }
+function containsSkippedContent(localOutputPath) {
+  return localOutputPath === "" || path__default["default"].isAbsolute(localOutputPath) || localOutputPath.includes(`${path__default["default"].sep}${path__default["default"].sep}`);
+}
 
 const createFilesystemDeleteAction = () => {
   return createTemplateAction({
@@ -675,15 +761,23 @@ const createFilesystemRenameAction = () => {
         if (!file.from || !file.to) {
           throw new errors.InputError("each file must have a from and to property");
         }
-        const sourceFilepath = backendCommon.resolveSafeChildPath(ctx.workspacePath, file.from);
+        const sourceFilepath = backendCommon.resolveSafeChildPath(
+          ctx.workspacePath,
+          file.from
+        );
         const destFilepath = backendCommon.resolveSafeChildPath(ctx.workspacePath, file.to);
         try {
           await fs__default["default"].move(sourceFilepath, destFilepath, {
             overwrite: (_b = file.overwrite) != null ? _b : false
           });
-          ctx.logger.info(`File ${sourceFilepath} renamed to ${destFilepath} successfully`);
+          ctx.logger.info(
+            `File ${sourceFilepath} renamed to ${destFilepath} successfully`
+          );
         } catch (err) {
-          ctx.logger.error(`Failed to rename file ${sourceFilepath} to ${destFilepath}:`, err);
+          ctx.logger.error(
+            `Failed to rename file ${sourceFilepath} to ${destFilepath}:`,
+            err
+          );
           throw err;
         }
       }
@@ -693,7 +787,10 @@ const createFilesystemRenameAction = () => {
 
 const getRepoSourceDirectory = (workspacePath, sourcePath) => {
   if (sourcePath) {
-    const safeSuffix = path.normalize(sourcePath).replace(/^(\.\.(\/|\\|$))+/, "");
+    const safeSuffix = path.normalize(sourcePath).replace(
+      /^(\.\.(\/|\\|$))+/,
+      ""
+    );
     const path$1 = path.join(workspacePath, safeSuffix);
     if (!backendCommon.isChildPath(workspacePath, path$1)) {
       throw new Error("Invalid source path");
@@ -708,7 +805,9 @@ const parseRepoUrl = (repoUrl, integrations) => {
   try {
     parsed = new URL(`https://${repoUrl}`);
   } catch (error) {
-    throw new errors.InputError(`Invalid repo URL passed to publisher, got ${repoUrl}, ${error}`);
+    throw new errors.InputError(
+      `Invalid repo URL passed to publisher, got ${repoUrl}, ${error}`
+    );
   }
   const host = parsed.host;
   const owner = (_a = parsed.searchParams.get("owner")) != null ? _a : void 0;
@@ -717,25 +816,35 @@ const parseRepoUrl = (repoUrl, integrations) => {
   const project = (_d = parsed.searchParams.get("project")) != null ? _d : void 0;
   const type = (_e = integrations.byHost(host)) == null ? void 0 : _e.type;
   if (!type) {
-    throw new errors.InputError(`No matching integration configuration for host ${host}, please check your integrations config`);
+    throw new errors.InputError(
+      `No matching integration configuration for host ${host}, please check your integrations config`
+    );
   }
   if (type === "bitbucket") {
     if (host === "bitbucket.org") {
       if (!workspace) {
-        throw new errors.InputError(`Invalid repo URL passed to publisher: ${repoUrl}, missing workspace`);
+        throw new errors.InputError(
+          `Invalid repo URL passed to publisher: ${repoUrl}, missing workspace`
+        );
       }
     }
     if (!project) {
-      throw new errors.InputError(`Invalid repo URL passed to publisher: ${repoUrl}, missing project`);
+      throw new errors.InputError(
+        `Invalid repo URL passed to publisher: ${repoUrl}, missing project`
+      );
     }
   } else {
-    if (!owner) {
-      throw new errors.InputError(`Invalid repo URL passed to publisher: ${repoUrl}, missing owner`);
+    if (!owner && type !== "gerrit") {
+      throw new errors.InputError(
+        `Invalid repo URL passed to publisher: ${repoUrl}, missing owner`
+      );
     }
   }
   const repo = parsed.searchParams.get("repo");
   if (!repo) {
-    throw new errors.InputError(`Invalid repo URL passed to publisher: ${repoUrl}, missing repo`);
+    throw new errors.InputError(
+      `Invalid repo URL passed to publisher: ${repoUrl}, missing repo`
+    );
   }
   return { host, owner, repo, organization, workspace, project };
 };
@@ -760,7 +869,9 @@ const executeShellCommand = async (options) => {
     });
     process.on("close", (code) => {
       if (code !== 0) {
-        return reject(new Error(`Command ${command} failed, exit code: ${code}`));
+        return reject(
+          new Error(`Command ${command} failed, exit code: ${code}`)
+        );
       }
       return resolve();
     });
@@ -777,8 +888,7 @@ async function initRepoAndPush({
 }) {
   var _a, _b;
   const git = backendCommon.Git.fromAuth({
-    username: auth.username,
-    password: auth.password,
+    ...auth,
     logger
   });
   await git.init({
@@ -806,6 +916,39 @@ async function initRepoAndPush({
     remote: "origin"
   });
 }
+async function commitAndPushRepo({
+  dir,
+  auth,
+  logger,
+  commitMessage,
+  gitAuthorInfo,
+  branch = "master",
+  remoteRef
+}) {
+  var _a, _b;
+  const git = backendCommon.Git.fromAuth({
+    ...auth,
+    logger
+  });
+  await git.fetch({ dir });
+  await git.checkout({ dir, ref: branch });
+  await git.add({ dir, filepath: "." });
+  const authorInfo = {
+    name: (_a = gitAuthorInfo == null ? void 0 : gitAuthorInfo.name) != null ? _a : "Scaffolder",
+    email: (_b = gitAuthorInfo == null ? void 0 : gitAuthorInfo.email) != null ? _b : "scaffolder@backstage.io"
+  };
+  await git.commit({
+    dir,
+    message: commitMessage,
+    author: authorInfo,
+    committer: authorInfo
+  });
+  await git.push({
+    dir,
+    remote: "origin",
+    remoteRef: remoteRef != null ? remoteRef : `refs/heads/${branch}`
+  });
+}
 const enableBranchProtectionOnDefaultRepoBranch = async ({
   repoName,
   client,
@@ -813,7 +956,8 @@ const enableBranchProtectionOnDefaultRepoBranch = async ({
   logger,
   requireCodeOwnerReviews,
   requiredStatusCheckContexts = [],
-  defaultBranch = "master"
+  defaultBranch = "master",
+  enforceAdmins = true
 }) => {
   const tryOnce = async () => {
     try {
@@ -829,7 +973,7 @@ const enableBranchProtectionOnDefaultRepoBranch = async ({
           contexts: requiredStatusCheckContexts
         },
         restrictions: null,
-        enforce_admins: true,
+        enforce_admins: enforceAdmins,
         required_pull_request_reviews: {
           required_approving_review_count: 1,
           require_code_owner_reviews: requireCodeOwnerReviews
@@ -837,8 +981,12 @@ const enableBranchProtectionOnDefaultRepoBranch = async ({
       });
     } catch (e) {
       errors.assertError(e);
-      if (e.message.includes("Upgrade to GitHub Pro or make this repository public to enable this feature")) {
-        logger.warn("Branch protection was not enabled as it requires GitHub Pro for private repositories");
+      if (e.message.includes(
+        "Upgrade to GitHub Pro or make this repository public to enable this feature"
+      )) {
+        logger.warn(
+          "Branch protection was not enabled as it requires GitHub Pro for private repositories"
+        );
       } else {
         throw e;
       }
@@ -880,10 +1028,14 @@ async function getOctokitOptions(options) {
   }
   const githubCredentialsProvider = credentialsProvider != null ? credentialsProvider : integration.DefaultGithubCredentialsProvider.fromIntegrations(integrations);
   const { token: credentialProviderToken } = await githubCredentialsProvider.getCredentials({
-    url: `https://${host}/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`
+    url: `https://${host}/${encodeURIComponent(owner)}/${encodeURIComponent(
+      repo
+    )}`
   });
   if (!credentialProviderToken) {
-    throw new errors.InputError(`No token available for host: ${host}, with owner ${owner}, and repo ${repo}`);
+    throw new errors.InputError(
+      `No token available for host: ${host}, with owner ${owner}, and repo ${repo}`
+    );
   }
   return {
     auth: credentialProviderToken,
@@ -920,9 +1072,13 @@ async function createGithubRepoWithCollaboratorsAndTopics(client, repo, owner, r
   } catch (e) {
     errors.assertError(e);
     if (e.message === "Resource not accessible by integration") {
-      logger.warn(`The GitHub app or token provided may not have the required permissions to create the ${user.data.type} repository ${owner}/${repo}.`);
+      logger.warn(
+        `The GitHub app or token provided may not have the required permissions to create the ${user.data.type} repository ${owner}/${repo}.`
+      );
     }
-    throw new Error(`Failed to create the ${user.data.type} repository ${owner}/${repo}, ${e.message}`);
+    throw new Error(
+      `Failed to create the ${user.data.type} repository ${owner}/${repo}, ${e.message}`
+    );
   }
   if (access == null ? void 0 : access.startsWith(`${owner}/`)) {
     const [, team] = access.split("/");
@@ -963,7 +1119,9 @@ async function createGithubRepoWithCollaboratorsAndTopics(client, repo, owner, r
       } catch (e) {
         errors.assertError(e);
         const name = extractCollaboratorName(collaborator);
-        logger.warn(`Skipping ${collaborator.access} access for ${name}, ${e.message}`);
+        logger.warn(
+          `Skipping ${collaborator.access} access for ${name}, ${e.message}`
+        );
       }
     }
   }
@@ -981,7 +1139,7 @@ async function createGithubRepoWithCollaboratorsAndTopics(client, repo, owner, r
   }
   return newRepo;
 }
-async function initRepoPushAndProtect(remoteUrl, password, workspacePath, sourcePath, defaultBranch, protectDefaultBranch, owner, client, repo, requireCodeOwnerReviews, requiredStatusCheckContexts, config, logger, gitCommitMessage, gitAuthorName, gitAuthorEmail) {
+async function initRepoPushAndProtect(remoteUrl, password, workspacePath, sourcePath, defaultBranch, protectDefaultBranch, protectEnforceAdmins, owner, client, repo, requireCodeOwnerReviews, requiredStatusCheckContexts, config, logger, gitCommitMessage, gitAuthorName, gitAuthorEmail) {
   const gitAuthorInfo = {
     name: gitAuthorName ? gitAuthorName : config.getOptionalString("scaffolder.defaultAuthor.name"),
     email: gitAuthorEmail ? gitAuthorEmail : config.getOptionalString("scaffolder.defaultAuthor.email")
@@ -1008,11 +1166,14 @@ async function initRepoPushAndProtect(remoteUrl, password, workspacePath, source
         logger,
         defaultBranch,
         requireCodeOwnerReviews,
-        requiredStatusCheckContexts
+        requiredStatusCheckContexts,
+        enforceAdmins: protectEnforceAdmins
       });
     } catch (e) {
       errors.assertError(e);
-      logger.warn(`Skipping: default branch protection on '${repo}', ${e.message}`);
+      logger.warn(
+        `Skipping: default branch protection on '${repo}', ${e.message}`
+      );
     }
   }
 }
@@ -1070,17 +1231,21 @@ function createGithubActionsDispatchAction(options) {
         workflowInputs,
         token: providedToken
       } = ctx.input;
-      ctx.logger.info(`Dispatching workflow ${workflowId} for repo ${repoUrl} on ${branchOrTagName}`);
+      ctx.logger.info(
+        `Dispatching workflow ${workflowId} for repo ${repoUrl} on ${branchOrTagName}`
+      );
       const { owner, repo } = parseRepoUrl(repoUrl, integrations);
       if (!owner) {
         throw new errors.InputError("Invalid repository owner provided in repoUrl");
       }
-      const client = new octokit.Octokit(await getOctokitOptions({
-        integrations,
-        repoUrl,
-        credentialsProvider: githubCredentialsProvider,
-        token: providedToken
-      }));
+      const client = new octokit.Octokit(
+        await getOctokitOptions({
+          integrations,
+          repoUrl,
+          credentialsProvider: githubCredentialsProvider,
+          token: providedToken
+        })
+      );
       await client.rest.actions.createWorkflowDispatch({
         owner,
         repo,
@@ -1136,12 +1301,14 @@ function createGithubIssuesLabelAction(options) {
       if (!owner) {
         throw new errors.InputError("Invalid repository owner provided in repoUrl");
       }
-      const client = new octokit.Octokit(await getOctokitOptions({
-        integrations,
-        credentialsProvider: githubCredentialsProvider,
-        repoUrl,
-        token: providedToken
-      }));
+      const client = new octokit.Octokit(
+        await getOctokitOptions({
+          integrations,
+          credentialsProvider: githubCredentialsProvider,
+          repoUrl,
+          token: providedToken
+        })
+      );
       try {
         await client.rest.issues.addLabels({
           owner,
@@ -1151,7 +1318,9 @@ function createGithubIssuesLabelAction(options) {
         });
       } catch (e) {
         errors.assertError(e);
-        ctx.logger.warn(`Failed: adding labels to issue: '${number}' on repo: '${repo}', ${e.message}`);
+        ctx.logger.warn(
+          `Failed: adding labels to issue: '${number}' on repo: '${repo}', ${e.message}`
+        );
       }
     }
   });
@@ -1267,6 +1436,11 @@ const protectDefaultBranch = {
   type: "boolean",
   description: `Protect the default branch after creating the repository. The default value is 'true'`
 };
+const protectEnforceAdmins = {
+  title: "Enforce Admins On Protected Branches",
+  type: "boolean",
+  description: `Enforce admins to adhere to default branch protection. The default value is 'true'`
+};
 const gitCommitMessage = {
   title: "Git Commit Message",
   type: "string",
@@ -1345,7 +1519,21 @@ function createGithubRepoCreateAction(options) {
       if (!owner) {
         throw new errors.InputError("Invalid repository owner provided in repoUrl");
       }
-      const newRepo = await createGithubRepoWithCollaboratorsAndTopics(client, repo, owner, repoVisibility, description, deleteBranchOnMerge, allowMergeCommit, allowSquashMerge, allowRebaseMerge, access, collaborators, topics, ctx.logger);
+      const newRepo = await createGithubRepoWithCollaboratorsAndTopics(
+        client,
+        repo,
+        owner,
+        repoVisibility,
+        description,
+        deleteBranchOnMerge,
+        allowMergeCommit,
+        allowSquashMerge,
+        allowRebaseMerge,
+        access,
+        collaborators,
+        topics,
+        ctx.logger
+      );
       ctx.output("remoteUrl", newRepo.clone_url);
     }
   });
@@ -1366,6 +1554,7 @@ function createGithubRepoPushAction(options) {
           requiredStatusCheckContexts: requiredStatusCheckContexts,
           defaultBranch: defaultBranch,
           protectDefaultBranch: protectDefaultBranch,
+          protectEnforceAdmins: protectEnforceAdmins,
           gitCommitMessage: gitCommitMessage,
           gitAuthorName: gitAuthorName,
           gitAuthorEmail: gitAuthorEmail,
@@ -1386,6 +1575,7 @@ function createGithubRepoPushAction(options) {
         repoUrl,
         defaultBranch = "master",
         protectDefaultBranch = true,
+        protectEnforceAdmins = true,
         gitCommitMessage = "initial commit",
         gitAuthorName,
         gitAuthorEmail,
@@ -1407,7 +1597,25 @@ function createGithubRepoPushAction(options) {
       const targetRepo = await client.rest.repos.get({ owner, repo });
       const remoteUrl = targetRepo.data.clone_url;
       const repoContentsUrl = `${targetRepo.data.html_url}/blob/${defaultBranch}`;
-      await initRepoPushAndProtect(remoteUrl, octokitOptions.auth, ctx.workspacePath, ctx.input.sourcePath, defaultBranch, protectDefaultBranch, owner, client, repo, requireCodeOwnerReviews, requiredStatusCheckContexts, config, ctx.logger, gitCommitMessage, gitAuthorName, gitAuthorEmail);
+      await initRepoPushAndProtect(
+        remoteUrl,
+        octokitOptions.auth,
+        ctx.workspacePath,
+        ctx.input.sourcePath,
+        defaultBranch,
+        protectDefaultBranch,
+        protectEnforceAdmins,
+        owner,
+        client,
+        repo,
+        requireCodeOwnerReviews,
+        requiredStatusCheckContexts,
+        config,
+        ctx.logger,
+        gitCommitMessage,
+        gitAuthorName,
+        gitAuthorEmail
+      );
       ctx.output("remoteUrl", remoteUrl);
       ctx.output("repoContentsUrl", repoContentsUrl);
     }
@@ -1499,12 +1707,14 @@ function createGithubWebhookAction(options) {
       if (!owner) {
         throw new errors.InputError("Invalid repository owner provided in repoUrl");
       }
-      const client = new octokit.Octokit(await getOctokitOptions({
-        integrations,
-        credentialsProvider: githubCredentialsProvider,
-        repoUrl,
-        token: providedToken
-      }));
+      const client = new octokit.Octokit(
+        await getOctokitOptions({
+          integrations,
+          credentialsProvider: githubCredentialsProvider,
+          repoUrl,
+          token: providedToken
+        })
+      );
       try {
         const insecure_ssl = insecureSsl ? "1" : "0";
         await client.rest.repos.createWebhook({
@@ -1522,7 +1732,9 @@ function createGithubWebhookAction(options) {
         ctx.logger.info(`Webhook '${webhookUrl}' created successfully`);
       } catch (e) {
         errors.assertError(e);
-        ctx.logger.warn(`Failed: create webhook '${webhookUrl}' on repo: '${repo}', ${e.message}`);
+        ctx.logger.warn(
+          `Failed: create webhook '${webhookUrl}' on repo: '${repo}', ${e.message}`
+        );
       }
     }
   });
@@ -1601,13 +1813,20 @@ function createPublishAzureAction(options) {
         gitAuthorName,
         gitAuthorEmail
       } = ctx.input;
-      const { owner, repo, host, organization } = parseRepoUrl(repoUrl, integrations);
+      const { owner, repo, host, organization } = parseRepoUrl(
+        repoUrl,
+        integrations
+      );
       if (!organization) {
-        throw new errors.InputError(`Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing organization`);
+        throw new errors.InputError(
+          `Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing organization`
+        );
       }
       const integrationConfig = integrations.azure.byHost(host);
       if (!integrationConfig) {
-        throw new errors.InputError(`No matching integration configuration for host ${host}, please check your integrations config`);
+        throw new errors.InputError(
+          `No matching integration configuration for host ${host}, please check your integrations config`
+        );
       }
       if (!integrationConfig.config.token && !ctx.input.token) {
         throw new errors.InputError(`No token provided for Azure Integration ${host}`);
@@ -1619,12 +1838,16 @@ function createPublishAzureAction(options) {
       const createOptions = { name: repo };
       const returnedRepo = await client.createRepository(createOptions, owner);
       if (!returnedRepo) {
-        throw new errors.InputError(`Unable to create the repository with Organization ${organization}, Project ${owner} and Repo ${repo}.
-          Please make sure that both the Org and Project are typed corrected and exist.`);
+        throw new errors.InputError(
+          `Unable to create the repository with Organization ${organization}, Project ${owner} and Repo ${repo}.
+          Please make sure that both the Org and Project are typed corrected and exist.`
+        );
       }
       const remoteUrl = returnedRepo.remoteUrl;
       if (!remoteUrl) {
-        throw new errors.InputError("No remote URL returned from create repository for Azure");
+        throw new errors.InputError(
+          "No remote URL returned from create repository for Azure"
+        );
       }
       const repoContentsUrl = remoteUrl;
       const gitAuthorInfo = {
@@ -1675,12 +1898,17 @@ const createBitbucketCloudRepository = async (opts) => {
   };
   let response;
   try {
-    response = await fetch__default["default"](`${apiBaseUrl}/repositories/${workspace}/${repo}`, options);
+    response = await fetch__default["default"](
+      `${apiBaseUrl}/repositories/${workspace}/${repo}`,
+      options
+    );
   } catch (e) {
     throw new Error(`Unable to create repository, ${e}`);
   }
   if (response.status !== 200) {
-    throw new Error(`Unable to create repository, ${response.status} ${response.statusText}, ${await response.text()}`);
+    throw new Error(
+      `Unable to create repository, ${response.status} ${response.statusText}, ${await response.text()}`
+    );
   }
   const r = await response.json();
   let remoteUrl = "";
@@ -1720,7 +1948,9 @@ const createBitbucketServerRepository = async (opts) => {
     throw new Error(`Unable to create repository, ${e}`);
   }
   if (response.status !== 201) {
-    throw new Error(`Unable to create repository, ${response.status} ${response.statusText}, ${await response.text()}`);
+    throw new Error(
+      `Unable to create repository, ${response.status} ${response.statusText}, ${await response.text()}`
+    );
   }
   const r = await response.json();
   let remoteUrl = "";
@@ -1732,15 +1962,20 @@ const createBitbucketServerRepository = async (opts) => {
   const repoContentsUrl = `${r.links.self[0].href}`;
   return { remoteUrl, repoContentsUrl };
 };
-const getAuthorizationHeader$2 = (config) => {
+const getAuthorizationHeader$1 = (config) => {
   if (config.username && config.appPassword) {
-    const buffer = Buffer.from(`${config.username}:${config.appPassword}`, "utf8");
+    const buffer = Buffer.from(
+      `${config.username}:${config.appPassword}`,
+      "utf8"
+    );
     return `Basic ${buffer.toString("base64")}`;
   }
   if (config.token) {
     return `Bearer ${config.token}`;
   }
-  throw new Error(`Authorization has not been provided for Bitbucket. Please add either username + appPassword or token to the Integrations config`);
+  throw new Error(
+    `Authorization has not been provided for Bitbucket. Please add either username + appPassword or token to the Integrations config`
+  );
 };
 const performEnableLFS$1 = async (opts) => {
   const { authorization, host, project, repo } = opts;
@@ -1750,9 +1985,14 @@ const performEnableLFS$1 = async (opts) => {
       Authorization: authorization
     }
   };
-  const { ok, status, statusText } = await fetch__default["default"](`https://${host}/rest/git-lfs/admin/projects/${project}/repos/${repo}/enabled`, options);
+  const { ok, status, statusText } = await fetch__default["default"](
+    `https://${host}/rest/git-lfs/admin/projects/${project}/repos/${repo}/enabled`,
+    options
+  );
   if (!ok)
-    throw new Error(`Failed to enable LFS in the repository, ${status}: ${statusText}`);
+    throw new Error(
+      `Failed to enable LFS in the repository, ${status}: ${statusText}`
+    );
 };
 function createPublishBitbucketAction(options) {
   const { integrations, config } = options;
@@ -1830,7 +2070,9 @@ function createPublishBitbucketAction(options) {
     },
     async handler(ctx) {
       var _a;
-      ctx.logger.warn(`[Deprecated] Please migrate the use of action "publish:bitbucket" to "publish:bitbucketCloud" or "publish:bitbucketServer".`);
+      ctx.logger.warn(
+        `[Deprecated] Please migrate the use of action "publish:bitbucket" to "publish:bitbucketCloud" or "publish:bitbucketServer".`
+      );
       const {
         repoUrl,
         description,
@@ -1841,24 +2083,35 @@ function createPublishBitbucketAction(options) {
         gitAuthorName,
         gitAuthorEmail
       } = ctx.input;
-      const { workspace, project, repo, host } = parseRepoUrl(repoUrl, integrations);
+      const { workspace, project, repo, host } = parseRepoUrl(
+        repoUrl,
+        integrations
+      );
       if (host === "bitbucket.org") {
         if (!workspace) {
-          throw new errors.InputError(`Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing workspace`);
+          throw new errors.InputError(
+            `Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing workspace`
+          );
         }
       }
       if (!project) {
-        throw new errors.InputError(`Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing project`);
+        throw new errors.InputError(
+          `Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing project`
+        );
       }
       const integrationConfig = integrations.bitbucket.byHost(host);
       if (!integrationConfig) {
-        throw new errors.InputError(`No matching integration configuration for host ${host}, please check your integrations config`);
+        throw new errors.InputError(
+          `No matching integration configuration for host ${host}, please check your integrations config`
+        );
       }
-      const authorization = getAuthorizationHeader$2(ctx.input.token ? {
-        host: integrationConfig.config.host,
-        apiBaseUrl: integrationConfig.config.apiBaseUrl,
-        token: ctx.input.token
-      } : integrationConfig.config);
+      const authorization = getAuthorizationHeader$1(
+        ctx.input.token ? {
+          host: integrationConfig.config.host,
+          apiBaseUrl: integrationConfig.config.apiBaseUrl,
+          token: ctx.input.token
+        } : integrationConfig.config
+      );
       const apiBaseUrl = integrationConfig.config.apiBaseUrl;
       const createMethod = host === "bitbucket.org" ? createBitbucketCloudRepository : createBitbucketServerRepository;
       const { remoteUrl, repoContentsUrl } = await createMethod({
@@ -1931,12 +2184,17 @@ const createRepository$1 = async (opts) => {
   };
   let response;
   try {
-    response = await fetch__default["default"](`${apiBaseUrl}/repositories/${workspace}/${repo}`, options);
+    response = await fetch__default["default"](
+      `${apiBaseUrl}/repositories/${workspace}/${repo}`,
+      options
+    );
   } catch (e) {
     throw new Error(`Unable to create repository, ${e}`);
   }
   if (response.status !== 200) {
-    throw new Error(`Unable to create repository, ${response.status} ${response.statusText}, ${await response.text()}`);
+    throw new Error(
+      `Unable to create repository, ${response.status} ${response.statusText}, ${await response.text()}`
+    );
   }
   const r = await response.json();
   let remoteUrl = "";
@@ -1948,15 +2206,20 @@ const createRepository$1 = async (opts) => {
   const repoContentsUrl = `${r.links.html.href}/src/${mainBranch}`;
   return { remoteUrl, repoContentsUrl };
 };
-const getAuthorizationHeader$1 = (config) => {
+const getAuthorizationHeader = (config) => {
   if (config.username && config.appPassword) {
-    const buffer = Buffer.from(`${config.username}:${config.appPassword}`, "utf8");
+    const buffer = Buffer.from(
+      `${config.username}:${config.appPassword}`,
+      "utf8"
+    );
     return `Basic ${buffer.toString("base64")}`;
   }
   if (config.token) {
     return `Bearer ${config.token}`;
   }
-  throw new Error(`Authorization has not been provided for Bitbucket Cloud. Please add either username + appPassword to the Integrations config or a user login auth token`);
+  throw new Error(
+    `Authorization has not been provided for Bitbucket Cloud. Please add either username + appPassword to the Integrations config or a user login auth token`
+  );
 };
 function createPublishBitbucketCloudAction(options) {
   const { integrations, config } = options;
@@ -2019,18 +2282,29 @@ function createPublishBitbucketCloudAction(options) {
         defaultBranch = "master",
         repoVisibility = "private"
       } = ctx.input;
-      const { workspace, project, repo, host } = parseRepoUrl(repoUrl, integrations);
+      const { workspace, project, repo, host } = parseRepoUrl(
+        repoUrl,
+        integrations
+      );
       if (!workspace) {
-        throw new errors.InputError(`Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing workspace`);
+        throw new errors.InputError(
+          `Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing workspace`
+        );
       }
       if (!project) {
-        throw new errors.InputError(`Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing project`);
+        throw new errors.InputError(
+          `Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing project`
+        );
       }
       const integrationConfig = integrations.bitbucketCloud.byHost(host);
       if (!integrationConfig) {
-        throw new errors.InputError(`No matching integration configuration for host ${host}, please check your integrations config`);
+        throw new errors.InputError(
+          `No matching integration configuration for host ${host}, please check your integrations config`
+        );
       }
-      const authorization = getAuthorizationHeader$1(ctx.input.token ? { token: ctx.input.token } : integrationConfig.config);
+      const authorization = getAuthorizationHeader(
+        ctx.input.token ? { token: ctx.input.token } : integrationConfig.config
+      );
       const apiBaseUrl = integrationConfig.config.apiBaseUrl;
       const { remoteUrl, repoContentsUrl } = await createRepository$1({
         authorization,
@@ -2054,7 +2328,9 @@ function createPublishBitbucketCloudAction(options) {
         };
       } else {
         if (!integrationConfig.config.username || !integrationConfig.config.appPassword) {
-          throw new Error("Credentials for Bitbucket Cloud integration required for this action.");
+          throw new Error(
+            "Credentials for Bitbucket Cloud integration required for this action."
+          );
         }
         auth = {
           username: integrationConfig.config.username,
@@ -2067,7 +2343,9 @@ function createPublishBitbucketCloudAction(options) {
         auth,
         defaultBranch,
         logger: ctx.logger,
-        commitMessage: config.getOptionalString("scaffolder.defaultCommitMessage"),
+        commitMessage: config.getOptionalString(
+          "scaffolder.defaultCommitMessage"
+        ),
         gitAuthorInfo
       });
       ctx.output("remoteUrl", remoteUrl);
@@ -2104,7 +2382,9 @@ const createRepository = async (opts) => {
     throw new Error(`Unable to create repository, ${e}`);
   }
   if (response.status !== 201) {
-    throw new Error(`Unable to create repository, ${response.status} ${response.statusText}, ${await response.text()}`);
+    throw new Error(
+      `Unable to create repository, ${response.status} ${response.statusText}, ${await response.text()}`
+    );
   }
   const r = await response.json();
   let remoteUrl = "";
@@ -2116,9 +2396,6 @@ const createRepository = async (opts) => {
   const repoContentsUrl = `${r.links.self[0].href}`;
   return { remoteUrl, repoContentsUrl };
 };
-const getAuthorizationHeader = (config) => {
-  return `Bearer ${config.token}`;
-};
 const performEnableLFS = async (opts) => {
   const { authorization, host, project, repo } = opts;
   const options = {
@@ -2127,9 +2404,14 @@ const performEnableLFS = async (opts) => {
       Authorization: authorization
     }
   };
-  const { ok, status, statusText } = await fetch__default["default"](`https://${host}/rest/git-lfs/admin/projects/${project}/repos/${repo}/enabled`, options);
+  const { ok, status, statusText } = await fetch__default["default"](
+    `https://${host}/rest/git-lfs/admin/projects/${project}/repos/${repo}/enabled`,
+    options
+  );
   if (!ok)
-    throw new Error(`Failed to enable LFS in the repository, ${status}: ${statusText}`);
+    throw new Error(
+      `Failed to enable LFS in the repository, ${status}: ${statusText}`
+    );
 };
 function createPublishBitbucketServerAction(options) {
   const { integrations, config } = options;
@@ -2201,17 +2483,28 @@ function createPublishBitbucketServerAction(options) {
       } = ctx.input;
       const { project, repo, host } = parseRepoUrl(repoUrl, integrations);
       if (!project) {
-        throw new errors.InputError(`Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing project`);
+        throw new errors.InputError(
+          `Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing project`
+        );
       }
       const integrationConfig = integrations.bitbucketServer.byHost(host);
       if (!integrationConfig) {
-        throw new errors.InputError(`No matching integration configuration for host ${host}, please check your integrations config`);
+        throw new errors.InputError(
+          `No matching integration configuration for host ${host}, please check your integrations config`
+        );
       }
       const token = (_a = ctx.input.token) != null ? _a : integrationConfig.config.token;
-      if (!token) {
-        throw new Error(`Authorization has not been provided for ${integrationConfig.config.host}. Please add either token to the Integrations config or a user login auth token`);
+      const authConfig = {
+        ...integrationConfig.config,
+        ...{ token }
+      };
+      const reqOpts = integration.getBitbucketServerRequestOptions(authConfig);
+      const authorization = reqOpts.headers.Authorization;
+      if (!authorization) {
+        throw new Error(
+          `Authorization has not been provided for ${integrationConfig.config.host}. Please add either (a) a user login auth token, or (b) a token or (c) username + password to the integration config.`
+        );
       }
-      const authorization = getAuthorizationHeader({ token });
       const apiBaseUrl = integrationConfig.config.apiBaseUrl;
       const { remoteUrl, repoContentsUrl } = await createRepository({
         authorization,
@@ -2225,9 +2518,11 @@ function createPublishBitbucketServerAction(options) {
         name: config.getOptionalString("scaffolder.defaultAuthor.name"),
         email: config.getOptionalString("scaffolder.defaultAuthor.email")
       };
-      const auth = {
-        username: "x-token-auth",
-        password: token
+      const auth = authConfig.token ? {
+        token
+      } : {
+        username: authConfig.username,
+        password: authConfig.password
       };
       await initRepoAndPush({
         dir: getRepoSourceDirectory(ctx.workspacePath, ctx.input.sourcePath),
@@ -2235,7 +2530,9 @@ function createPublishBitbucketServerAction(options) {
         auth,
         defaultBranch,
         logger: ctx.logger,
-        commitMessage: config.getOptionalString("scaffolder.defaultCommitMessage"),
+        commitMessage: config.getOptionalString(
+          "scaffolder.defaultCommitMessage"
+        ),
         gitAuthorInfo
       });
       if (enableLFS) {
@@ -2282,7 +2579,7 @@ const createGerritProject = async (config, options) => {
     body: JSON.stringify({
       parent,
       description,
-      owners: [owner],
+      owners: owner ? [owner] : [],
       create_empty_commit: false
     }),
     headers: {
@@ -2290,9 +2587,14 @@ const createGerritProject = async (config, options) => {
       "Content-Type": "application/json"
     }
   };
-  const response = await fetch__default["default"](`${config.baseUrl}/a/projects/${encodeURIComponent(projectName)}`, fetchOptions);
+  const response = await fetch__default["default"](
+    `${config.baseUrl}/a/projects/${encodeURIComponent(projectName)}`,
+    fetchOptions
+  );
   if (response.status !== 201) {
-    throw new Error(`Unable to create repository, ${response.status} ${response.statusText}, ${await response.text()}`);
+    throw new Error(
+      `Unable to create repository, ${response.status} ${response.statusText}, ${await response.text()}`
+    );
   }
 };
 const generateCommitMessage = (config, commitSubject) => {
@@ -2339,6 +2641,11 @@ function createPublishGerritAction(options) {
             title: "Default Author Email",
             type: "string",
             description: `Sets the default author email for the commit.`
+          },
+          sourcePath: {
+            title: "Source Path",
+            type: "string",
+            description: `Path within the workspace that will be used as the repository root. If omitted, the entire workspace will be published as the repository.`
           }
         }
       },
@@ -2363,18 +2670,23 @@ function createPublishGerritAction(options) {
         defaultBranch = "master",
         gitAuthorName,
         gitAuthorEmail,
-        gitCommitMessage = "initial commit"
+        gitCommitMessage = "initial commit",
+        sourcePath
       } = ctx.input;
-      const { repo, host, owner, workspace } = parseRepoUrl(repoUrl, integrations);
+      const { repo, host, owner, workspace } = parseRepoUrl(
+        repoUrl,
+        integrations
+      );
       const integrationConfig = integrations.gerrit.byHost(host);
       if (!integrationConfig) {
-        throw new errors.InputError(`No matching integration configuration for host ${host}, please check your integrations config`);
-      }
-      if (!owner) {
-        throw new errors.InputError(`Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing owner`);
+        throw new errors.InputError(
+          `No matching integration configuration for host ${host}, please check your integrations config`
+        );
       }
       if (!workspace) {
-        throw new errors.InputError(`Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing workspace`);
+        throw new errors.InputError(
+          `Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing workspace`
+        );
       }
       await createGerritProject(integrationConfig.config, {
         description,
@@ -2392,7 +2704,7 @@ function createPublishGerritAction(options) {
       };
       const remoteUrl = `${integrationConfig.config.cloneUrl}/a/${repo}`;
       await initRepoAndPush({
-        dir: getRepoSourceDirectory(ctx.workspacePath, void 0),
+        dir: getRepoSourceDirectory(ctx.workspacePath, sourcePath),
         remoteUrl,
         auth,
         defaultBranch,
@@ -2407,6 +2719,115 @@ function createPublishGerritAction(options) {
   });
 }
 
+const generateGerritChangeId = () => {
+  const changeId = crypto__default["default"].randomBytes(20).toString("hex");
+  return `I${changeId}`;
+};
+function createPublishGerritReviewAction(options) {
+  const { integrations, config } = options;
+  return createTemplateAction({
+    id: "publish:gerrit:review",
+    description: "Creates a new Gerrit review.",
+    schema: {
+      input: {
+        type: "object",
+        required: ["repoUrl", "gitCommitMessage"],
+        properties: {
+          repoUrl: {
+            title: "Repository Location",
+            type: "string"
+          },
+          branch: {
+            title: "Repository branch",
+            type: "string",
+            description: "Branch of the repository the review will be created on"
+          },
+          sourcePath: {
+            type: "string",
+            title: "Working Subdirectory",
+            description: "Subdirectory of working directory containing the repository"
+          },
+          gitCommitMessage: {
+            title: "Git Commit Message",
+            type: "string",
+            description: `Sets the commit message on the repository.`
+          },
+          gitAuthorName: {
+            title: "Default Author Name",
+            type: "string",
+            description: `Sets the default author name for the commit. The default value is 'Scaffolder'`
+          },
+          gitAuthorEmail: {
+            title: "Default Author Email",
+            type: "string",
+            description: `Sets the default author email for the commit.`
+          }
+        }
+      },
+      output: {
+        type: "object",
+        properties: {
+          reviewUrl: {
+            title: "A URL to the review",
+            type: "string"
+          },
+          repoContentsUrl: {
+            title: "A URL to the root of the repository",
+            type: "string"
+          }
+        }
+      }
+    },
+    async handler(ctx) {
+      var _a;
+      const {
+        repoUrl,
+        branch = "master",
+        sourcePath,
+        gitAuthorName,
+        gitAuthorEmail,
+        gitCommitMessage
+      } = ctx.input;
+      const { host, repo } = parseRepoUrl(repoUrl, integrations);
+      if (!gitCommitMessage) {
+        throw new errors.InputError(`Missing gitCommitMessage input`);
+      }
+      const integrationConfig = integrations.gerrit.byHost(host);
+      if (!integrationConfig) {
+        throw new errors.InputError(
+          `No matching integration configuration for host ${host}, please check your integrations config`
+        );
+      }
+      const auth = {
+        username: integrationConfig.config.username,
+        password: integrationConfig.config.password
+      };
+      const gitAuthorInfo = {
+        name: gitAuthorName ? gitAuthorName : config.getOptionalString("scaffolder.defaultAuthor.name"),
+        email: gitAuthorEmail ? gitAuthorEmail : config.getOptionalString("scaffolder.defaultAuthor.email")
+      };
+      const changeId = generateGerritChangeId();
+      const commitMessage = `${gitCommitMessage}
+
+Change-Id: ${changeId}`;
+      await commitAndPushRepo({
+        dir: getRepoSourceDirectory(ctx.workspacePath, sourcePath),
+        auth,
+        logger: ctx.logger,
+        commitMessage,
+        gitAuthorInfo,
+        branch,
+        remoteRef: `refs/for/${branch}`
+      });
+      const repoContentsUrl = `${integrationConfig.config.gitilesBaseUrl}/${repo}/+/refs/heads/${branch}`;
+      const reviewUrl = `${integrationConfig.config.baseUrl}/#/q/${changeId}`;
+      (_a = ctx.logger) == null ? void 0 : _a.info(`Review available on ${reviewUrl}`);
+      ctx.output("repoContentsUrl", repoContentsUrl);
+      ctx.output("reviewUrl", reviewUrl);
+    }
+  });
+}
+
 function createPublishGithubAction(options) {
   const { integrations, config, githubCredentialsProvider } = options;
   return createTemplateAction({
@@ -2425,6 +2846,7 @@ function createPublishGithubAction(options) {
           repoVisibility: repoVisibility,
           defaultBranch: defaultBranch,
           protectDefaultBranch: protectDefaultBranch,
+          protectEnforceAdmins: protectEnforceAdmins,
           deleteBranchOnMerge: deleteBranchOnMerge,
           gitCommitMessage: gitCommitMessage,
           gitAuthorName: gitAuthorName,
@@ -2456,6 +2878,7 @@ function createPublishGithubAction(options) {
         repoVisibility = "private",
         defaultBranch = "master",
         protectDefaultBranch = true,
+        protectEnforceAdmins = true,
         deleteBranchOnMerge = false,
         gitCommitMessage = "initial commit",
         gitAuthorName,
@@ -2478,10 +2901,42 @@ function createPublishGithubAction(options) {
       if (!owner) {
         throw new errors.InputError("Invalid repository owner provided in repoUrl");
       }
-      const newRepo = await createGithubRepoWithCollaboratorsAndTopics(client, repo, owner, repoVisibility, description, deleteBranchOnMerge, allowMergeCommit, allowSquashMerge, allowRebaseMerge, access, collaborators, topics, ctx.logger);
+      const newRepo = await createGithubRepoWithCollaboratorsAndTopics(
+        client,
+        repo,
+        owner,
+        repoVisibility,
+        description,
+        deleteBranchOnMerge,
+        allowMergeCommit,
+        allowSquashMerge,
+        allowRebaseMerge,
+        access,
+        collaborators,
+        topics,
+        ctx.logger
+      );
       const remoteUrl = newRepo.clone_url;
       const repoContentsUrl = `${newRepo.html_url}/blob/${defaultBranch}`;
-      await initRepoPushAndProtect(remoteUrl, octokitOptions.auth, ctx.workspacePath, ctx.input.sourcePath, defaultBranch, protectDefaultBranch, owner, client, repo, requireCodeOwnerReviews, requiredStatusCheckContexts, config, ctx.logger, gitCommitMessage, gitAuthorName, gitAuthorEmail);
+      await initRepoPushAndProtect(
+        remoteUrl,
+        octokitOptions.auth,
+        ctx.workspacePath,
+        ctx.input.sourcePath,
+        defaultBranch,
+        protectDefaultBranch,
+        protectEnforceAdmins,
+        owner,
+        client,
+        repo,
+        requireCodeOwnerReviews,
+        requiredStatusCheckContexts,
+        config,
+        ctx.logger,
+        gitCommitMessage,
+        gitAuthorName,
+        gitAuthorEmail
+      );
       ctx.output("remoteUrl", remoteUrl);
       ctx.output("repoContentsUrl", repoContentsUrl);
     }
@@ -2508,11 +2963,15 @@ async function serializeDirectoryContents(sourcePath, options) {
     stats: true
   });
   const limiter = limiterFactory__default["default"](10);
-  return Promise.all(paths.map(async ({ path: path$1, stats }) => ({
-    path: path$1,
-    content: await limiter(async () => fs__default["default"].readFile(path.join(sourcePath, path$1))),
-    executable: isExecutable(stats == null ? void 0 : stats.mode)
-  })));
+  return Promise.all(
+    paths.map(async ({ path: path$1, stats }) => ({
+      path: path$1,
+      content: await limiter(
+        async () => fs__default["default"].readFile(path.join(sourcePath, path$1))
+      ),
+      executable: isExecutable(stats == null ? void 0 : stats.mode)
+    }))
+  );
 }
 
 async function deserializeDirectoryContents(targetPath, files) {
@@ -2533,7 +2992,9 @@ const defaultClientFactory = async ({
   host = "github.com",
   token: providedToken
 }) => {
-  const [encodedHost, encodedOwner, encodedRepo] = [host, owner, repo].map(encodeURIComponent);
+  const [encodedHost, encodedOwner, encodedRepo] = [host, owner, repo].map(
+    encodeURIComponent
+  );
   const octokitOptions = await getOctokitOptions({
     integrations,
     credentialsProvider: githubCredentialsProvider,
@@ -2627,7 +3088,9 @@ const createPublishGithubPullRequestAction = ({
       } = ctx.input;
       const { owner, repo, host } = parseRepoUrl(repoUrl, integrations);
       if (!owner) {
-        throw new errors.InputError(`No owner provided for host: ${host}, and repo ${repo}`);
+        throw new errors.InputError(
+          `No owner provided for host: ${host}, and repo ${repo}`
+        );
       }
       const client = await clientFactory({
         integrations,
@@ -2641,14 +3104,16 @@ const createPublishGithubPullRequestAction = ({
       const directoryContents = await serializeDirectoryContents(fileRoot, {
         gitignore: true
       });
-      const files = Object.fromEntries(directoryContents.map((file) => [
-        targetPath ? path__default["default"].posix.join(targetPath, file.path) : file.path,
-        {
-          mode: file.executable ? "100755" : "100644",
-          encoding: "base64",
-          content: file.content.toString("base64")
-        }
-      ]));
+      const files = Object.fromEntries(
+        directoryContents.map((file) => [
+          targetPath ? path__default["default"].posix.join(targetPath, file.path) : file.path,
+          {
+            mode: file.executable ? "100755" : "100644",
+            encoding: "base64",
+            content: file.content.toString("base64")
+          }
+        ])
+      );
       try {
         const response = await client.createPullRequest({
           owner,
@@ -2758,11 +3223,15 @@ function createPublishGitlabAction(options) {
       } = ctx.input;
       const { owner, repo, host } = parseRepoUrl(repoUrl, integrations);
       if (!owner) {
-        throw new errors.InputError(`No owner provided for host: ${host}, and repo ${repo}`);
+        throw new errors.InputError(
+          `No owner provided for host: ${host}, and repo ${repo}`
+        );
       }
       const integrationConfig = integrations.gitlab.byHost(host);
       if (!integrationConfig) {
-        throw new errors.InputError(`No matching integration configuration for host ${host}, please check your integrations config`);
+        throw new errors.InputError(
+          `No matching integration configuration for host ${host}, please check your integrations config`
+        );
       }
       if (!integrationConfig.config.token && !ctx.input.token) {
         throw new errors.InputError(`No token available for host ${host}`);
@@ -2858,10 +3327,21 @@ const createPublishGitlabMergeRequestAction = (options) => {
             type: "string",
             description: "The token to use for authorization to GitLab"
           },
+          commitAction: {
+            title: "Commit action",
+            type: "string",
+            enum: ["create", "update", "delete"],
+            description: "The action to be used for git commit. Defaults to create."
+          },
           removeSourceBranch: {
             title: "Delete source branch",
             type: "boolean",
             description: "Option to delete source branch once the MR has been merged. Default: false"
+          },
+          assignee: {
+            title: "Merge Request Assignee",
+            type: "string",
+            description: "User this merge request will be assigned to"
           }
         }
       },
@@ -2897,7 +3377,9 @@ const createPublishGitlabMergeRequestAction = (options) => {
       const integrationConfig = integrations.gitlab.byHost(host);
       const destinationBranch = ctx.input.branchName;
       if (!integrationConfig) {
-        throw new errors.InputError(`No matching integration configuration for host ${host}, please check your integrations config`);
+        throw new errors.InputError(
+          `No matching integration configuration for host ${host}, please check your integrations config`
+        );
       }
       if (!integrationConfig.config.token && !ctx.input.token) {
         throw new errors.InputError(`No token available for host ${host}`);
@@ -2908,34 +3390,70 @@ const createPublishGitlabMergeRequestAction = (options) => {
         host: integrationConfig.config.baseUrl,
         [tokenType]: token
       });
-      const targetPath = backendCommon.resolveSafeChildPath(ctx.workspacePath, ctx.input.targetPath);
+      const assignee = ctx.input.assignee;
+      let assigneeId = void 0;
+      if (assignee !== void 0) {
+        try {
+          const assigneeUser = await api.Users.username(assignee);
+          assigneeId = assigneeUser[0].id;
+        } catch (e) {
+          ctx.logger.warn(
+            `Failed to find gitlab user id for ${assignee}: ${e}. Proceeding with MR creation without an assignee.`
+          );
+        }
+      }
+      const targetPath = backendCommon.resolveSafeChildPath(
+        ctx.workspacePath,
+        ctx.input.targetPath
+      );
       const fileContents = await serializeDirectoryContents(targetPath, {
         gitignore: true
       });
-      const actions = fileContents.map((file) => ({
-        action: "create",
-        filePath: path__default["default"].posix.join(ctx.input.targetPath, file.path),
-        encoding: "base64",
-        content: file.content.toString("base64"),
-        execute_filemode: file.executable
-      }));
+      const actions = fileContents.map((file) => {
+        var _a2;
+        return {
+          action: (_a2 = ctx.input.commitAction) != null ? _a2 : "create",
+          filePath: path__default["default"].posix.join(ctx.input.targetPath, file.path),
+          encoding: "base64",
+          content: file.content.toString("base64"),
+          execute_filemode: file.executable
+        };
+      });
       const projects = await api.Projects.show(projectPath);
       const { default_branch: defaultBranch } = projects;
       try {
-        await api.Branches.create(projectPath, destinationBranch, String(defaultBranch));
+        await api.Branches.create(
+          projectPath,
+          destinationBranch,
+          String(defaultBranch)
+        );
       } catch (e) {
         throw new errors.InputError(`The branch creation failed ${e}`);
       }
       try {
-        await api.Commits.create(projectPath, destinationBranch, ctx.input.title, actions);
+        await api.Commits.create(
+          projectPath,
+          destinationBranch,
+          ctx.input.title,
+          actions
+        );
       } catch (e) {
-        throw new errors.InputError(`Committing the changes to ${destinationBranch} failed ${e}`);
+        throw new errors.InputError(
+          `Committing the changes to ${destinationBranch} failed ${e}`
+        );
       }
       try {
-        const mergeRequestUrl = await api.MergeRequests.create(projectPath, destinationBranch, String(defaultBranch), ctx.input.title, {
-          description: ctx.input.description,
-          removeSourceBranch: ctx.input.removeSourceBranch ? ctx.input.removeSourceBranch : false
-        }).then((mergeRequest) => {
+        const mergeRequestUrl = await api.MergeRequests.create(
+          projectPath,
+          destinationBranch,
+          String(defaultBranch),
+          ctx.input.title,
+          {
+            description: ctx.input.description,
+            removeSourceBranch: ctx.input.removeSourceBranch ? ctx.input.removeSourceBranch : false,
+            assigneeId
+          }
+        ).then((mergeRequest) => {
           return mergeRequest.web_url;
         });
         ctx.output("projectid", projectPath);
@@ -2971,6 +3489,10 @@ const createBuiltinActions = (options) => {
       integrations,
       config
     }),
+    createPublishGerritReviewAction({
+      integrations,
+      config
+    }),
     createPublishGithubAction({
       integrations,
       config,
@@ -3039,14 +3561,18 @@ class TemplateActionRegistry {
   }
   register(action) {
     if (this.actions.has(action.id)) {
-      throw new errors.ConflictError(`Template action with ID '${action.id}' has already been registered`);
+      throw new errors.ConflictError(
+        `Template action with ID '${action.id}' has already been registered`
+      );
     }
     this.actions.set(action.id, action);
   }
   get(actionId) {
     const action = this.actions.get(actionId);
     if (!action) {
-      throw new errors.NotFoundError(`Template action with ID '${actionId}' is not registered.`);
+      throw new errors.NotFoundError(
+        `Template action with ID '${actionId}' is not registered.`
+      );
     }
     return action;
   }
@@ -3055,7 +3581,10 @@ class TemplateActionRegistry {
   }
 }
 
-const migrationsDir = backendCommon.resolvePackagePath("@backstage/plugin-scaffolder-backend", "migrations");
+const migrationsDir = backendCommon.resolvePackagePath(
+  "@backstage/plugin-scaffolder-backend",
+  "migrations"
+);
 const parseSqlDateToIsoString = (input) => {
   if (typeof input === "string") {
     return luxon.DateTime.fromSQL(input, { zone: "UTC" }).toISO();
@@ -3170,10 +3699,14 @@ class DatabaseTaskStore {
     }
   }
   async listStaleTasks({ timeoutS }) {
-    const rawRows = await this.db("tasks").where("status", "processing").andWhere("last_heartbeat_at", "<=", this.db.client.config.client.includes("sqlite3") ? this.db.raw(`datetime('now', ?)`, [`-${timeoutS} seconds`]) : this.db.raw(`dateadd('second', ?, ?)`, [
-      `-${timeoutS}`,
-      this.db.fn.now()
-    ]));
+    const rawRows = await this.db("tasks").where("status", "processing").andWhere(
+      "last_heartbeat_at",
+      "<=",
+      this.db.client.config.client.includes("sqlite3") ? this.db.raw(`datetime('now', ?)`, [`-${timeoutS} seconds`]) : this.db.raw(`dateadd('second', ?, ?)`, [
+        `-${timeoutS}`,
+        this.db.fn.now()
+      ])
+    );
     const tasks = rawRows.map((row) => ({
       taskId: row.id
     }));
@@ -3188,7 +3721,9 @@ class DatabaseTaskStore {
     if (status === "failed" || status === "completed") {
       oldStatus = "processing";
     } else {
-      throw new Error(`Invalid status update of run '${taskId}' to status '${status}'`);
+      throw new Error(
+        `Invalid status update of run '${taskId}' to status '${status}'`
+      );
     }
     await this.db.transaction(async (tx) => {
       const [task] = await tx("tasks").where({
@@ -3198,7 +3733,9 @@ class DatabaseTaskStore {
         throw new Error(`No task with taskId ${taskId} found`);
       }
       if (task.status !== oldStatus) {
-        throw new errors.ConflictError(`Refusing to update status of run '${taskId}' to status '${status}' as it is currently '${task.status}', expected '${oldStatus}'`);
+        throw new errors.ConflictError(
+          `Refusing to update status of run '${taskId}' to status '${status}' as it is currently '${task.status}', expected '${oldStatus}'`
+        );
       }
       const updateCount = await tx("tasks").where({
         id: taskId,
@@ -3207,7 +3744,9 @@ class DatabaseTaskStore {
         status
       });
       if (updateCount !== 1) {
-        throw new errors.ConflictError(`Failed to update status to '${status}' for taskId ${taskId}`);
+        throw new errors.ConflictError(
+          `Failed to update status to '${status}' for taskId ${taskId}`
+        );
       }
       await tx("task_events").insert({
         task_id: taskId,
@@ -3247,7 +3786,9 @@ class DatabaseTaskStore {
           createdAt: parseSqlDateToIsoString(event.created_at)
         };
       } catch (error) {
-        throw new Error(`Failed to parse event body from event taskId=${taskId} id=${event.id}, ${error}`);
+        throw new Error(
+          `Failed to parse event body from event taskId=${taskId} id=${event.id}, ${error}`
+        );
       }
     });
     return { events };
@@ -3308,7 +3849,10 @@ class TaskManager {
         this.startTimeout();
       } catch (error) {
         this.isDone = true;
-        this.logger.error(`Heartbeat for task ${this.task.taskId} failed`, error);
+        this.logger.error(
+          `Heartbeat for task ${this.task.taskId} failed`,
+          error
+        );
       }
     }, 1e3);
   }
@@ -3329,7 +3873,9 @@ class StorageTaskBroker {
   }
   async list(options) {
     if (!this.storage.list) {
-      throw new Error("TaskStore does not implement the list method. Please implement the list method to be able to list tasks");
+      throw new Error(
+        "TaskStore does not implement the list method. Please implement the list method to be able to list tasks"
+      );
     }
     return await this.storage.list({ createdBy: options == null ? void 0 : options.createdBy });
   }
@@ -3337,12 +3883,16 @@ class StorageTaskBroker {
     for (; ; ) {
       const pendingTask = await this.storage.claimTask();
       if (pendingTask) {
-        return TaskManager.create({
-          taskId: pendingTask.id,
-          spec: pendingTask.spec,
-          secrets: pendingTask.secrets,
-          createdBy: pendingTask.createdBy
-        }, this.storage, this.logger);
+        return TaskManager.create(
+          {
+            taskId: pendingTask.id,
+            spec: pendingTask.spec,
+            secrets: pendingTask.secrets,
+            createdBy: pendingTask.createdBy
+          },
+          this.storage,
+          this.logger
+        );
       }
       await this.waitForDispatch();
     }
@@ -3380,19 +3930,21 @@ class StorageTaskBroker {
   }
   async vacuumTasks(options) {
     const { tasks } = await this.storage.listStaleTasks(options);
-    await Promise.all(tasks.map(async (task) => {
-      try {
-        await this.storage.completeTask({
-          taskId: task.taskId,
-          status: "failed",
-          eventBody: {
-            message: "The task was cancelled because the task worker lost connection to the task broker"
-          }
-        });
-      } catch (error) {
-        this.logger.warn(`Failed to cancel task '${task.taskId}', ${error}`);
-      }
-    }));
+    await Promise.all(
+      tasks.map(async (task) => {
+        try {
+          await this.storage.completeTask({
+            taskId: task.taskId,
+            status: "failed",
+            eventBody: {
+              message: "The task was cancelled because the task worker lost connection to the task broker"
+            }
+          });
+        } catch (error) {
+          this.logger.warn(`Failed to cancel task '${task.taskId}', ${error}`);
+        }
+      })
+    );
   }
   waitForDispatch() {
     return this.deferredDispatch.promise;
@@ -3413,10 +3965,12 @@ function generateExampleOutput(schema) {
     return examples[0];
   }
   if (schema.type === "object") {
-    return Object.fromEntries(Object.entries((_a = schema.properties) != null ? _a : {}).map(([key, value]) => [
-      key,
-      generateExampleOutput(value)
-    ]));
+    return Object.fromEntries(
+      Object.entries((_a = schema.properties) != null ? _a : {}).map(([key, value]) => [
+        key,
+        generateExampleOutput(value)
+      ])
+    );
   } else if (schema.type === "array") {
     const [firstSchema] = (_b = [schema.items]) == null ? void 0 : _b.flat();
     if (firstSchema) {
@@ -3443,7 +3997,11 @@ const createStepLogger = ({
   const metadata = { stepId: step.id };
   const taskLogger = winston__namespace.createLogger({
     level: process.env.LOG_LEVEL || "info",
-    format: winston__namespace.format.combine(winston__namespace.format.colorize(), winston__namespace.format.timestamp(), winston__namespace.format.simple()),
+    format: winston__namespace.format.combine(
+      winston__namespace.format.colorize(),
+      winston__namespace.format.timestamp(),
+      winston__namespace.format.simple()
+    ),
     defaultMeta: {}
   });
   const streamLogger = new stream.PassThrough();
@@ -3463,13 +4021,17 @@ class NunjucksWorkflowRunner {
   isSingleTemplateString(input) {
     var _a, _b;
     const { parser, nodes } = nunjucks__default["default"];
-    const parsed = parser.parse(input, {}, {
-      autoescape: false,
-      tags: {
-        variableStart: "${{",
-        variableEnd: "}}"
+    const parsed = parser.parse(
+      input,
+      {},
+      {
+        autoescape: false,
+        tags: {
+          variableStart: "${{",
+          variableEnd: "}}"
+        }
       }
-    });
+    );
     return parsed.children.length === 1 && !(((_b = (_a = parsed.children[0]) == null ? void 0 : _a.children) == null ? void 0 : _b[0]) instanceof nodes.TemplateData);
   }
   render(input, context, renderTemplate) {
@@ -3478,7 +4040,10 @@ class NunjucksWorkflowRunner {
         if (typeof value === "string") {
           try {
             if (this.isSingleTemplateString(value)) {
-              const wrappedDumped = value.replace(/\${{(.+)}}/g, "${{ ( $1 ) | dump }}");
+              const wrappedDumped = value.replace(
+                /\${{(.+)}}/g,
+                "${{ ( $1 ) | dump }}"
+              );
               const templated2 = renderTemplate(wrappedDumped, context);
               if (templated2 === "") {
                 return void 0;
@@ -3486,7 +4051,9 @@ class NunjucksWorkflowRunner {
               return JSON.parse(templated2);
             }
           } catch (ex) {
-            this.options.logger.error(`Failed to parse template string: ${value} with error ${ex.message}`);
+            this.options.logger.error(
+              `Failed to parse template string: ${value} with error ${ex.message}`
+            );
           }
           const templated = renderTemplate(value, context);
           if (templated === "") {
@@ -3503,9 +4070,14 @@ class NunjucksWorkflowRunner {
   async execute(task) {
     var _a, _b, _c, _d, _e;
     if (!isValidTaskSpec(task.spec)) {
-      throw new errors.InputError("Wrong template version executed with the workflow engine");
+      throw new errors.InputError(
+        "Wrong template version executed with the workflow engine"
+      );
     }
-    const workspacePath = path__default["default"].join(this.options.workingDirectory, await task.getWorkspaceName());
+    const workspacePath = path__default["default"].join(
+      this.options.workingDirectory,
+      await task.getWorkspaceName()
+    );
     const { integrations } = this.options;
     const renderTemplate = await SecureTemplater.loadRenderer({
       parseRepoUrl(url) {
@@ -3515,7 +4087,9 @@ class NunjucksWorkflowRunner {
     });
     try {
       await fs__default["default"].ensureDir(workspacePath);
-      await task.emitLog(`Starting up task with ${task.spec.steps.length} steps`);
+      await task.emitLog(
+        `Starting up task with ${task.spec.steps.length} steps`
+      );
       const context = {
         parameters: task.spec.parameters,
         steps: {},
@@ -3524,9 +4098,16 @@ class NunjucksWorkflowRunner {
       for (const step of task.spec.steps) {
         try {
           if (step.if) {
-            const ifResult = await this.render(step.if, context, renderTemplate);
+            const ifResult = await this.render(
+              step.if,
+              context,
+              renderTemplate
+            );
             if (!isTruthy(ifResult)) {
-              await task.emitLog(`Skipping step ${step.id} because it's if condition was false`, { stepId: step.id, status: "skipped" });
+              await task.emitLog(
+                `Skipping step ${step.id} because it's if condition was false`,
+                { stepId: step.id, status: "skipped" }
+              );
               continue;
             }
           }
@@ -3537,10 +4118,13 @@ class NunjucksWorkflowRunner {
           const action = this.options.actionRegistry.get(step.action);
           const { taskLogger, streamLogger } = createStepLogger({ task, step });
           if (task.isDryRun && !action.supportsDryRun) {
-            task.emitLog(`Skipping because ${action.id} does not support dry-run`, {
-              stepId: step.id,
-              status: "skipped"
-            });
+            task.emitLog(
+              `Skipping because ${action.id} does not support dry-run`,
+              {
+                stepId: step.id,
+                status: "skipped"
+              }
+            );
             const outputSchema = (_a = action.schema) == null ? void 0 : _a.output;
             if (outputSchema) {
               context.steps[step.id] = {
@@ -3551,12 +4135,21 @@ class NunjucksWorkflowRunner {
             }
             continue;
           }
-          const input = (_c = step.input && this.render(step.input, { ...context, secrets: (_b = task.secrets) != null ? _b : {} }, renderTemplate)) != null ? _c : {};
+          const input = (_c = step.input && this.render(
+            step.input,
+            { ...context, secrets: (_b = task.secrets) != null ? _b : {} },
+            renderTemplate
+          )) != null ? _c : {};
           if ((_d = action.schema) == null ? void 0 : _d.input) {
-            const validateResult = jsonschema.validate(input, action.schema.input);
+            const validateResult = jsonschema.validate(
+              input,
+              action.schema.input
+            );
             if (!validateResult.valid) {
               const errors$1 = validateResult.errors.join(", ");
-              throw new errors.InputError(`Invalid input passed to action ${action.id}, ${errors$1}`);
+              throw new errors.InputError(
+                `Invalid input passed to action ${action.id}, ${errors$1}`
+              );
             }
           }
           const tmpDirs = new Array();
@@ -3568,7 +4161,9 @@ class NunjucksWorkflowRunner {
             logStream: streamLogger,
             workspacePath,
             createTemporaryDirectory: async () => {
-              const tmpDir = await fs__default["default"].mkdtemp(`${workspacePath}_step-${step.id}-`);
+              const tmpDir = await fs__default["default"].mkdtemp(
+                `${workspacePath}_step-${step.id}-`
+              );
               tmpDirs.push(tmpDir);
               return tmpDir;
             },
@@ -3639,9 +4234,13 @@ class TaskWorker {
   async runOneTask(task) {
     try {
       if (task.spec.apiVersion !== "scaffolder.backstage.io/v1beta3") {
-        throw new Error(`Unsupported Template apiVersion ${task.spec.apiVersion}`);
+        throw new Error(
+          `Unsupported Template apiVersion ${task.spec.apiVersion}`
+        );
       }
-      const { output } = await this.options.runners.workflowRunner.execute(task);
+      const { output } = await this.options.runners.workflowRunner.execute(
+        task
+      );
       await task.complete("completed", { output });
     } catch (error) {
       errors.assertError(error);
@@ -3688,7 +4287,10 @@ function createDryRunner(options) {
     });
     const dryRunId = uuid.v4();
     const log = new Array();
-    const contentsPath = backendCommon.resolveSafeChildPath(options.workingDirectory, `dry-run-content-${dryRunId}`);
+    const contentsPath = backendCommon.resolveSafeChildPath(
+      options.workingDirectory,
+      `dry-run-content-${dryRunId}`
+    );
     try {
       await deserializeDirectoryContents(contentsPath, input.directoryContents);
       const result = await workflowRunner.execute({
@@ -3704,7 +4306,9 @@ function createDryRunner(options) {
           ],
           templateInfo: {
             entityRef: "template:default/dry-run",
-            baseUrl: url.pathToFileURL(backendCommon.resolveSafeChildPath(contentsPath, "template.yaml")).toString()
+            baseUrl: url.pathToFileURL(
+              backendCommon.resolveSafeChildPath(contentsPath, "template.yaml")
+            ).toString()
           }
         },
         secrets: input.secrets,
@@ -3751,7 +4355,9 @@ async function getWorkingDirectory(config, logger) {
     logger.info(`using working directory: ${workingDirectory}`);
   } catch (err) {
     errors.assertError(err);
-    logger.error(`working directory ${workingDirectory} ${err.code === "ENOENT" ? "does not exist" : "is not writable"}`);
+    logger.error(
+      `working directory ${workingDirectory} ${err.code === "ENOENT" ? "does not exist" : "is not writable"}`
+    );
     throw err;
   }
   return workingDirectory;
@@ -3780,7 +4386,9 @@ async function findTemplate(options) {
   }
   const template = await catalogApi.getEntityByRef(entityRef, { token });
   if (!template) {
-    throw new errors.NotFoundError(`Template ${catalogModel.stringifyEntityRef(entityRef)} not found`);
+    throw new errors.NotFoundError(
+      `Template ${catalogModel.stringifyEntityRef(entityRef)} not found`
+    );
   }
   return template;
 }
@@ -3842,31 +4450,38 @@ async function createRouter(options) {
     workingDirectory,
     additionalTemplateFilters
   });
-  router.get("/v2/templates/:namespace/:kind/:name/parameter-schema", async (req, res) => {
-    var _a, _b;
-    const { namespace, kind, name } = req.params;
-    const { token } = parseBearerToken(req.headers.authorization);
-    const template = await findTemplate({
-      catalogApi: catalogClient,
-      entityRef: { kind, namespace, name },
-      token
-    });
-    if (isSupportedTemplate(template)) {
-      const parameters = [(_a = template.spec.parameters) != null ? _a : []].flat();
-      res.json({
-        title: (_b = template.metadata.title) != null ? _b : template.metadata.name,
-        steps: parameters.map((schema) => {
-          var _a2;
-          return {
-            title: (_a2 = schema.title) != null ? _a2 : "Fill in template parameters",
-            schema
-          };
-        })
+  router.get(
+    "/v2/templates/:namespace/:kind/:name/parameter-schema",
+    async (req, res) => {
+      var _a, _b;
+      const { namespace, kind, name } = req.params;
+      const { token } = parseBearerToken(req.headers.authorization);
+      const template = await findTemplate({
+        catalogApi: catalogClient,
+        entityRef: { kind, namespace, name },
+        token
       });
-    } else {
-      throw new errors.InputError(`Unsupported apiVersion field in schema entity, ${template.apiVersion}`);
+      if (isSupportedTemplate(template)) {
+        const parameters = [(_a = template.spec.parameters) != null ? _a : []].flat();
+        res.json({
+          title: (_b = template.metadata.title) != null ? _b : template.metadata.name,
+          description: template.metadata.description,
+          steps: parameters.map((schema) => {
+            var _a2;
+            return {
+              title: (_a2 = schema.title) != null ? _a2 : "Please enter the following information",
+              description: schema.description,
+              schema
+            };
+          })
+        });
+      } else {
+        throw new errors.InputError(
+          `Unsupported apiVersion field in schema entity, ${template.apiVersion}`
+        );
+      }
     }
-  }).get("/v2/actions", async (_req, res) => {
+  ).get("/v2/actions", async (_req, res) => {
     const actionsList = actionRegistry.list().map((action) => {
       return {
         id: action.id,
@@ -3881,8 +4496,15 @@ async function createRouter(options) {
     const { kind, namespace, name } = catalogModel.parseEntityRef(templateRef, {
       defaultKind: "template"
     });
-    const { token, entityRef: userEntityRef } = parseBearerToken(req.headers.authorization);
+    const { token, entityRef: userEntityRef } = parseBearerToken(
+      req.headers.authorization
+    );
     const userEntity = userEntityRef ? await catalogClient.getEntityByRef(userEntityRef, { token }) : void 0;
+    let auditLog = `Scaffolding task for ${templateRef}`;
+    if (userEntityRef) {
+      auditLog += ` created by ${userEntityRef}`;
+    }
+    logger.info(auditLog);
     const values = req.body.values;
     const template = await findTemplate({
       catalogApi: catalogClient,
@@ -3890,7 +4512,9 @@ async function createRouter(options) {
       token
     });
     if (!isSupportedTemplate(template)) {
-      throw new errors.InputError(`Unsupported apiVersion field in schema entity, ${template.apiVersion}`);
+      throw new errors.InputError(
+        `Unsupported apiVersion field in schema entity, ${template.apiVersion}`
+      );
     }
     for (const parameters of [(_a = template.spec.parameters) != null ? _a : []].flat()) {
       const result2 = jsonschema.validate(values, parameters);
@@ -3940,7 +4564,9 @@ async function createRouter(options) {
       throw new errors.InputError("createdBy query parameter must be a string");
     }
     if (!taskBroker.list) {
-      throw new Error("TaskBroker does not support listing tasks, please implement the list method on the TaskBroker.");
+      throw new Error(
+        "TaskBroker does not support listing tasks, please implement the list method on the TaskBroker."
+      );
     }
     const tasks = await taskBroker.list({
       createdBy: userEntityRef
@@ -3965,23 +4591,30 @@ async function createRouter(options) {
     });
     const subscription = taskBroker.event$({ taskId, after }).subscribe({
       error: (error) => {
-        logger.error(`Received error from event stream when observing taskId '${taskId}', ${error}`);
+        logger.error(
+          `Received error from event stream when observing taskId '${taskId}', ${error}`
+        );
+        res.end();
       },
       next: ({ events }) => {
         var _a;
         let shouldUnsubscribe = false;
         for (const event of events) {
-          res.write(`event: ${event.type}
+          res.write(
+            `event: ${event.type}
 data: ${JSON.stringify(event)}
 
-`);
+`
+          );
           if (event.type === "completion") {
             shouldUnsubscribe = true;
           }
         }
         (_a = res.flush) == null ? void 0 : _a.call(res);
-        if (shouldUnsubscribe)
+        if (shouldUnsubscribe) {
           subscription.unsubscribe();
+          res.end();
+        }
       }
     });
     req.on("close", () => {
@@ -3996,7 +4629,9 @@ data: ${JSON.stringify(event)}
     }, 3e4);
     const subscription = taskBroker.event$({ taskId, after }).subscribe({
       error: (error) => {
-        logger.error(`Received error from event stream when observing taskId '${taskId}', ${error}`);
+        logger.error(
+          `Received error from event stream when observing taskId '${taskId}', ${error}`
+        );
       },
       next: ({ events }) => {
         clearTimeout(timeout);
@@ -4014,7 +4649,9 @@ data: ${JSON.stringify(event)}
       template: zod.z.unknown(),
       values: zod.z.record(zod.z.unknown()),
       secrets: zod.z.record(zod.z.string()).optional(),
-      directoryContents: zod.z.array(zod.z.object({ path: zod.z.string(), base64Content: zod.z.string() }))
+      directoryContents: zod.z.array(
+        zod.z.object({ path: zod.z.string(), base64Content: zod.z.string() })
+      )
     });
     const body = await bodySchema.parseAsync(req.body).catch((e) => {
       throw new errors.InputError(`Malformed request: ${e}`);
@@ -4081,7 +4718,9 @@ function parseBearerToken(header) {
       throw new TypeError("Expected Bearer with JWT");
     }
     const [_header, rawPayload, _signature] = token.split(".");
-    const payload = JSON.parse(Buffer.from(rawPayload, "base64").toString());
+    const payload = JSON.parse(
+      Buffer.from(rawPayload, "base64").toString()
+    );
     if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
       throw new TypeError("Malformed JWT payload");
     }
@@ -4120,24 +4759,28 @@ class ScaffolderEntitiesProcessor {
           defaultKind: "Group",
           defaultNamespace: selfRef.namespace
         });
-        emit(pluginCatalogBackend.processingResult.relation({
-          source: selfRef,
-          type: catalogModel.RELATION_OWNED_BY,
-          target: {
-            kind: targetRef.kind,
-            namespace: targetRef.namespace,
-            name: targetRef.name
-          }
-        }));
-        emit(pluginCatalogBackend.processingResult.relation({
-          source: {
-            kind: targetRef.kind,
-            namespace: targetRef.namespace,
-            name: targetRef.name
-          },
-          type: catalogModel.RELATION_OWNER_OF,
-          target: selfRef
-        }));
+        emit(
+          pluginCatalogBackend.processingResult.relation({
+            source: selfRef,
+            type: catalogModel.RELATION_OWNED_BY,
+            target: {
+              kind: targetRef.kind,
+              namespace: targetRef.namespace,
+              name: targetRef.name
+            }
+          })
+        );
+        emit(
+          pluginCatalogBackend.processingResult.relation({
+            source: {
+              kind: targetRef.kind,
+              namespace: targetRef.namespace,
+              name: targetRef.name
+            },
+            type: catalogModel.RELATION_OWNER_OF,
+            target: selfRef
+          })
+        );
       }
     }
     return entity;
@@ -4153,7 +4796,9 @@ const scaffolderCatalogModule = backendPluginApi.createBackendModule({
         catalogProcessingExtensionPoint: pluginCatalogNode.catalogProcessingExtentionPoint
       },
       async init({ catalogProcessingExtensionPoint }) {
-        catalogProcessingExtensionPoint.addProcessor(new ScaffolderEntitiesProcessor());
+        catalogProcessingExtensionPoint.addProcessor(
+          new ScaffolderEntitiesProcessor()
+        );
       }
     });
   }
@@ -4183,6 +4828,7 @@ exports.createPublishBitbucketCloudAction = createPublishBitbucketCloudAction;
 exports.createPublishBitbucketServerAction = createPublishBitbucketServerAction;
 exports.createPublishFileAction = createPublishFileAction;
 exports.createPublishGerritAction = createPublishGerritAction;
+exports.createPublishGerritReviewAction = createPublishGerritReviewAction;
 exports.createPublishGithubAction = createPublishGithubAction;
 exports.createPublishGithubPullRequestAction = createPublishGithubPullRequestAction;
 exports.createPublishGitlabAction = createPublishGitlabAction;