action.yml

name: Skyhook Cloud Login
description: |
  Unified cloud authentication with optional Kubernetes context and registry login.
author: "Skyhook"

branding:
  icon: "tag"
  color: "purple"

inputs:
  # Discovery & routing
  image:
    description: "Docker image URL to auto-detect provider/account/location/registry"
    required: false
  provider:
    description: "Cloud provider (aws, gcp, azure, github, dockerhub, other) - auto-detected if image is provided. Use 'other' for BYOK/on-prem clusters with kubeconfig input."
    required: false

  # Unified location & identifiers
  account:
    description: "AWS account ID / GCP project ID / Azure subscription ID"
    required: false
  location:
    description: "AWS region (e.g., us-east-1) or GCP location (e.g., us|europe|asia|us-central1|us-central1-a). Not used for Azure."
    required: false
  cluster:
    description: "Kubernetes cluster name (EKS/GKE/AKS)"
    required: false

  # Registry controls
  login_to_container_registry:
    description: "Login to container registry (ECR/GAR/ACR/GHCR/Docker Hub)"
    required: false
    default: "false"
  repositories:
    description: "AWS ECR: repositories to ensure exist (comma-separated)"
    required: false
  acr_registry:
    description: "Azure ACR registry name (e.g., 'myacrname')"
    required: false

  # AWS auth
  aws_role_to_assume:
    description: "AWS IAM role ARN to assume (OIDC recommended)"
    required: false
  aws_access_key_id:
    description: "AWS Access Key ID (if not using OIDC)"
    required: false
  aws_secret_access_key:
    description: "AWS Secret Access Key (if not using OIDC)"
    required: false
  aws_session_duration:
    description: "AWS session duration in seconds"
    required: false
    default: "3600"

  # GCP auth
  gcp_credentials_json:
    description: "GCP Service Account JSON"
    required: false
  gcp_workload_identity_provider:
    description: "GCP Workload Identity Provider resource name"
    required: false
  gcp_service_account:
    description: "GCP Service Account email"
    required: false

  # Azure auth
  azure_client_id:
    description: "Azure client ID (Service Principal)"
    required: false
  azure_client_secret:
    description: "Azure client secret (Service Principal)"
    required: false
  azure_tenant_id:
    description: "Azure tenant ID"
    required: false
  azure_resource_group:
    description: "Azure resource group for AKS"
    required: false

  # BYOK / on-prem cluster access
  kubeconfig:
    description: "Base64-encoded kubeconfig for direct cluster access (BYOK/on-prem). Skips cloud-specific kubectl setup when provided."
    required: false

  # Generic registry inputs (works with any Docker Registry v2 API: Quay, Harbor, etc.)
  registry_server:
    description: "Container registry hostname (e.g., quay.io, ghcr.io, docker.io)"
    required: false
  registry_username:
    description: "Registry username"
    required: false
  registry_password:
    description: "Registry password or token"
    required: false

  # AWS CodeArtifact inputs (package manager authentication)
  aws_codeartifact_domain:
    description: "AWS CodeArtifact domain name"
    required: false
  aws_codeartifact_repository:
    description: "AWS CodeArtifact repository name"
    required: false
  aws_codeartifact_tool:
    description: "Tool to configure for CodeArtifact (npm, pip, twine, dotnet, nuget, swift, maven, gradle)"
    required: false
  aws_codeartifact_region:
    description: "Region for CodeArtifact (defaults to location/aws_region if not specified)"
    required: false
  aws_codeartifact_domain_owner:
    description: "AWS account ID that owns the CodeArtifact domain (defaults to authenticated account)"
    required: false
  aws_codeartifact_duration:
    description: "Duration of the CodeArtifact token in seconds"
    required: false
    default: "43200"
  aws_codeartifact_namespace:
    description: "CodeArtifact namespace for the repository"
    required: false
  aws_codeartifact_output_token:
    description: "Output the CodeArtifact token instead of using aws codeartifact login (useful for Docker builds)"
    required: false
    default: "false"

  # GHCR / Docker Hub / Quay (aliases for convenience - prefer registry_* inputs)
  github_token:
    description: "GitHub token for GHCR (defaults to GITHUB_TOKEN)"
    required: false
  dockerhub_username:
    description: "Docker Hub username (alias for registry_username when provider=dockerhub)"
    required: false
  dockerhub_token:
    description: "Docker Hub access token (alias for registry_password when provider=dockerhub)"
    required: false
  quay_username:
    description: "Quay username (alias for registry_username when provider=quay)"
    required: false
  quay_token:
    description: "Quay token (alias for registry_password when provider=quay)"
    required: false

outputs:
  account_id:
    description: "Resolved cloud account/subscription/project ID"
    value: ${{ steps.out-account.outputs.id }}
  registry_url:
    description: "Base registry URL if registry login was requested"
    value: ${{ steps.out-registry.outputs.url }}
  kubectl_context:
    description: "Current kubectl context if configured"
    value: ${{ steps.out-kubectl.outputs.context }}
  authenticated:
    description: "Whether authentication completed successfully"
    value: ${{ steps.out-status.outputs.authenticated }}

runs:
  using: "composite"
  steps:
    # 1) Parse image (optional)
    - name: Parse image
      id: parse
      if: inputs.image != ''
      uses: skyhook-io/parse-image-registry@v1
      with:
        image: ${{ inputs.image }}

    # 2) Determine effective config
    - name: Determine config
      id: config
      shell: bash
      run: |
        set -Eeuo pipefail

        # Provider resolution (+ mismatch check)
        INPUT_PROVIDER="${{ inputs.provider }}"
        PARSED_PROVIDER="${{ steps.parse.outputs.provider || '' }}"

        # Auto-detect provider from registry_server if not set
        if [[ -z "$INPUT_PROVIDER" && -n "${{ inputs.registry_server }}" ]]; then
          case "${{ inputs.registry_server }}" in
            ghcr.io) INPUT_PROVIDER="github" ;;
            docker.io|registry-1.docker.io) INPUT_PROVIDER="dockerhub" ;;
            quay.io) INPUT_PROVIDER="quay" ;;
            *) INPUT_PROVIDER="registry" ;;
          esac
        fi

        if [[ -n "$INPUT_PROVIDER" && -n "$PARSED_PROVIDER" && "$INPUT_PROVIDER" != "$PARSED_PROVIDER" ]]; then
          echo "::error::Provider mismatch: input='$INPUT_PROVIDER' vs image-detected='$PARSED_PROVIDER'"
          exit 1
        fi
        PROVIDER="$INPUT_PROVIDER"
        if [[ -z "$PROVIDER" && -n "$PARSED_PROVIDER" ]]; then
          PROVIDER="$PARSED_PROVIDER"
        fi

        # Account resolution
        ACCOUNT="${{ inputs.account || '' }}"
        if [[ -z "$ACCOUNT" && -n "${{ steps.parse.outputs.account || '' }}" ]]; then
          ACCOUNT="${{ steps.parse.outputs.account }}"
        fi

        # Location resolution (AWS region or GCP location)
        LOCATION="${{ inputs.location || '' }}"
        if [[ -z "$LOCATION" && -n "${{ steps.parse.outputs.region || '' }}" ]]; then
          LOCATION="${{ steps.parse.outputs.region }}"
        fi

        # Azure ACR name (from image if available)
        ACR_REGISTRY="${{ inputs.acr_registry || '' }}"
        if [[ -z "$ACR_REGISTRY" && "${PARSED_PROVIDER}" == "azure" && -n "${{ steps.parse.outputs.account || '' }}" ]]; then
          # parse-image-registry returns registry name in 'account' for Azure
          ACR_REGISTRY="${{ steps.parse.outputs.account }}"
        fi

        # AWS ECR repositories (from image if available)
        REPOSITORIES="${{ inputs.repositories || '' }}"
        if [[ -z "$REPOSITORIES" && "${PARSED_PROVIDER}" == "aws" && -n "${{ steps.parse.outputs.repository || '' }}" ]]; then
          REPOSITORIES="${{ steps.parse.outputs.repository }}"
        fi

        # Registry configuration (handle aliases)
        REGISTRY_SERVER="${{ inputs.registry_server || '' }}"
        REGISTRY_USERNAME="${{ inputs.registry_username || '' }}"
        REGISTRY_PASSWORD="${{ inputs.registry_password || '' }}"

        # Apply provider-specific aliases
        if [[ "$PROVIDER" == "dockerhub" ]]; then
          [[ -z "$REGISTRY_SERVER" ]] && REGISTRY_SERVER="docker.io"
          [[ -z "$REGISTRY_USERNAME" ]] && REGISTRY_USERNAME="${{ inputs.dockerhub_username || '' }}"
          [[ -z "$REGISTRY_PASSWORD" ]] && REGISTRY_PASSWORD="${{ inputs.dockerhub_token || '' }}"
        elif [[ "$PROVIDER" == "quay" ]]; then
          [[ -z "$REGISTRY_SERVER" ]] && REGISTRY_SERVER="quay.io"
          [[ -z "$REGISTRY_USERNAME" ]] && REGISTRY_USERNAME="${{ inputs.quay_username || '' }}"
          [[ -z "$REGISTRY_PASSWORD" ]] && REGISTRY_PASSWORD="${{ inputs.quay_token || '' }}"
        elif [[ "$PROVIDER" == "github" ]]; then
          [[ -z "$REGISTRY_SERVER" ]] && REGISTRY_SERVER="ghcr.io"
          # GHCR special case: can use GITHUB_TOKEN if no explicit creds
        fi

        echo "provider=$PROVIDER" >> "$GITHUB_OUTPUT"
        echo "account=$ACCOUNT" >> "$GITHUB_OUTPUT"
        echo "location=$LOCATION" >> "$GITHUB_OUTPUT"
        echo "acr_registry=$ACR_REGISTRY" >> "$GITHUB_OUTPUT"
        echo "repositories=$REPOSITORIES" >> "$GITHUB_OUTPUT"
        echo "registry_server=$REGISTRY_SERVER" >> "$GITHUB_OUTPUT"
        echo "registry_username=$REGISTRY_USERNAME" >> "$GITHUB_OUTPUT"
        echo "registry_password=$REGISTRY_PASSWORD" >> "$GITHUB_OUTPUT"

    # 3) Minimal validation (pragmatic)
    - name: Validate inputs
      shell: bash
      run: |
        set -Eeuo pipefail
        PROVIDER="${{ steps.config.outputs.provider }}"
        ACCOUNT="${{ steps.config.outputs.account }}"
        LOCATION="${{ steps.config.outputs.location }}"
        CLUSTER="${{ inputs.cluster }}"
        LOGIN="${{ inputs.login_to_container_registry }}"
        REGISTRY_SERVER="${{ steps.config.outputs.registry_server }}"
        REGISTRY_USERNAME="${{ steps.config.outputs.registry_username }}"
        REGISTRY_PASSWORD="${{ steps.config.outputs.registry_password }}"

        # Allow no provider if registry_* inputs are provided
        if [[ -z "$PROVIDER" && -z "$REGISTRY_SERVER" ]]; then
          echo "::error::Provide either 'image', 'provider', or 'registry_server'."
          exit 1
        fi

        # Validate provider if set
        if [[ -n "$PROVIDER" ]]; then
          case "$PROVIDER" in
            aws|gcp|azure|github|dockerhub|quay|registry|other) ;;
            *) echo "::error::Invalid provider: $PROVIDER"; exit 1 ;;
          esac
        fi

        # Validate registry login requirements
        if [[ "$LOGIN" == "true" && ( "$PROVIDER" == "quay" || "$PROVIDER" == "registry" || -n "$REGISTRY_SERVER" ) ]]; then
          if [[ -z "$REGISTRY_USERNAME" || -z "$REGISTRY_PASSWORD" ]]; then
            # Exception: GHCR can use defaults
            if [[ "$PROVIDER" != "github" || ( -z "${{ inputs.github_token || github.token }}" ) ]]; then
              echo "::error::Registry login requires 'registry_username' and 'registry_password' (or provider-specific aliases)."
              exit 1
            fi
          fi
        fi

        if [[ "$PROVIDER" == "aws" ]]; then
          if [[ -z "${{ inputs.aws_role_to_assume }}" && -z "${{ inputs.aws_access_key_id }}" ]]; then
            echo "::error::For AWS, provide either 'aws_role_to_assume' (OIDC) or access keys."
            exit 1
          fi
          if [[ ( -n "$CLUSTER" || "$LOGIN" == "true" ) && -z "$LOCATION" ]]; then
            echo "::error::'location' (AWS region) is required for EKS or ECR."
            exit 1
          fi
        fi

        if [[ "$PROVIDER" == "gcp" ]]; then
          if [[ ( -n "$CLUSTER" || "$LOGIN" == "true" ) && ( -z "$LOCATION" || -z "$ACCOUNT" ) ]]; then
            echo "::error::For GCP GKE/GAR, 'account' (project) and 'location' are required."
            exit 1
          fi
        fi

        if [[ "$PROVIDER" == "azure" ]]; then
          if [[ -z "$ACCOUNT" ]]; then
            echo "::error::Azure requires 'account' (subscription ID)."
            exit 1
          fi
          if [[ -n "$CLUSTER" && -z "${{ inputs.azure_resource_group }}" ]]; then
            echo "::error::For AKS, 'azure_resource_group' is required."
            exit 1
          fi
          if [[ "$LOGIN" == "true" && -z "${{ steps.config.outputs.acr_registry }}" ]]; then
            echo "::error::For ACR login, 'acr_registry' is required."
            exit 1
          fi
        fi

        # BYOK validation
        if [[ -n "${{ inputs.kubeconfig }}" && "$PROVIDER" != "other" && -n "$PROVIDER" ]]; then
          echo "::error::Cannot provide 'kubeconfig' input with provider '$PROVIDER'. Use provider='other' for BYOK kubeconfig, or remove the kubeconfig input to use cloud-native authentication."
          exit 1
        fi
        if [[ "$PROVIDER" == "other" ]]; then
          if [[ -z "${{ inputs.kubeconfig }}" && -n "$CLUSTER" ]]; then
            echo "::warning::Provider is 'other' (BYOK) with cluster '$CLUSTER' but no 'kubeconfig' input provided. kubectl commands will fail unless kubeconfig is already configured."
          fi
        fi

        echo "= Authenticating to $PROVIDER ..."

    # 4) AWS - Prepare role ARN if needed
    - name: Prepare AWS role ARN
      id: aws-role
      if: steps.config.outputs.provider == 'aws'
      shell: bash
      run: |
        set -Eeuo pipefail
        ROLE_INPUT="${{ inputs.aws_role_to_assume }}"
        ACCOUNT="${{ steps.config.outputs.account }}"

        # If no role provided, skip
        if [[ -z "$ROLE_INPUT" ]]; then
          echo "role_arn=" >> "$GITHUB_OUTPUT"
          exit 0
        fi

        # Check if it's already a full ARN
        if [[ "$ROLE_INPUT" =~ ^arn:aws:iam::[0-9]{12}:role/.+ ]]; then
          echo "Role is already a full ARN: $ROLE_INPUT"
          echo "role_arn=$ROLE_INPUT" >> "$GITHUB_OUTPUT"
        else
          # Not a full ARN - construct it
          if [[ -z "$ACCOUNT" ]]; then
            echo "::error::To use role name instead of full ARN, 'account' (AWS account ID) must be provided"
            exit 1
          fi

          # Construct the ARN
          ROLE_ARN="arn:aws:iam::${ACCOUNT}:role/${ROLE_INPUT}"
          echo "Constructing role ARN from account and role name:"
          echo "  Account: $ACCOUNT"
          echo "  Role name: $ROLE_INPUT"
          echo "  Full ARN: $ROLE_ARN"
          echo "role_arn=$ROLE_ARN" >> "$GITHUB_OUTPUT"
        fi

    # 5) AWS login (always via skyhook-io/login-aws)
    - name: AWS login
      if: steps.config.outputs.provider == 'aws'
      uses: skyhook-io/login-aws@v1
      with:
        aws_region: ${{ steps.config.outputs.location }}
        role_to_assume: ${{ steps.aws-role.outputs.role_arn }}
        role_duration: ${{ inputs.aws_session_duration }}
        aws_access_key_id: ${{ inputs.aws_access_key_id }}
        aws_secret_access_key: ${{ inputs.aws_secret_access_key }}
        eks_cluster_name: ${{ inputs.cluster }}
        enable_ecr_login: ${{ inputs.login_to_container_registry }}
        ecr_repositories: ${{ steps.config.outputs.repositories }}
        codeartifact_domain: ${{ inputs.aws_codeartifact_domain }}
        codeartifact_repository: ${{ inputs.aws_codeartifact_repository }}
        codeartifact_tool: ${{ inputs.aws_codeartifact_tool }}
        codeartifact_region: ${{ inputs.aws_codeartifact_region }}
        codeartifact_domain_owner: ${{ inputs.aws_codeartifact_domain_owner }}
        codeartifact_duration: ${{ inputs.aws_codeartifact_duration }}
        codeartifact_namespace: ${{ inputs.aws_codeartifact_namespace }}
        codeartifact_output_token: ${{ inputs.aws_codeartifact_output_token }}

    # 6) GCP (via skyhook-io/login-gcp-gke - uses pre-installed gcloud)
    - name: GCP login
      if: steps.config.outputs.provider == 'gcp'
      uses: skyhook-io/login-gcp-gke@v1
      with:
        credentials_json: ${{ inputs.gcp_credentials_json }}
        workload_identity_provider: ${{ inputs.gcp_workload_identity_provider }}
        service_account: ${{ inputs.gcp_service_account }}
        project_id: ${{ steps.config.outputs.account }}
        location: ${{ steps.config.outputs.location }}
        cluster_name: ${{ inputs.cluster }}
        # login to GAR unless user turned it off
        skip_gar_login: ${{ inputs.login_to_container_registry != 'true' }}

    # 7) Azure (beta) — unified via a Skyhook action
    - name: Azure login
      if: steps.config.outputs.provider == 'azure'
      uses: skyhook-io/login-azure-aks@v1
      with:
        subscription_id: ${{ steps.config.outputs.account }}
        resource_group: ${{ inputs.azure_resource_group }}
        cluster_name: ${{ inputs.cluster }}
        client_id: ${{ inputs.azure_client_id }}
        client_secret: ${{ inputs.azure_client_secret }}
        tenant_id: ${{ inputs.azure_tenant_id }}
        enable_acr_login: ${{ inputs.login_to_container_registry }}
        acr_registry: ${{ steps.config.outputs.acr_registry }}

    # 7.5) BYOK / on-prem: configure kubectl from kubeconfig secret
    - name: Configure kubeconfig (BYOK)
      if: inputs.kubeconfig != '' && steps.config.outputs.provider == 'other'
      shell: bash
      run: |
        set -Eeuo pipefail
        mkdir -p ~/.kube

        # Decode kubeconfig with clear error on invalid base64
        if ! echo "${{ inputs.kubeconfig }}" | base64 -d > ~/.kube/config 2>/tmp/b64err; then
          echo "::error::Failed to decode 'kubeconfig' input. Ensure the value is base64-encoded. Encode with: cat kubeconfig.yaml | base64"
          cat /tmp/b64err
          exit 1
        fi
        chmod 600 ~/.kube/config

        # Validate kubeconfig is parseable YAML
        if ! kubectl config view --kubeconfig="$HOME/.kube/config" > /dev/null 2>&1; then
          echo "::error::The decoded kubeconfig is not a valid kubeconfig file. Check the contents of your KUBECONFIG secret."
          exit 1
        fi

        echo "✅ Kubeconfig configured from secret"

        # Connectivity probe (expected to fail for private clusters or exec-based auth)
        if ! kubectl cluster-info --request-timeout=5s > /dev/null 2>&1; then
          echo "::notice::kubectl cluster-info probe failed — this is expected for private clusters or exec-based auth plugins. If kubectl commands fail in later steps, check cluster reachability and kubeconfig auth."
        fi

    # 8) Unified registry login (GHCR / Docker Hub / Quay / Generic)
    - name: Registry login
      if: |
        inputs.login_to_container_registry == 'true' &&
        (steps.config.outputs.provider == 'github' ||
         steps.config.outputs.provider == 'dockerhub' ||
         steps.config.outputs.provider == 'quay' ||
         steps.config.outputs.provider == 'registry' ||
         steps.config.outputs.registry_server != '')
      uses: docker/login-action@v4
      with:
        registry: ${{ steps.config.outputs.registry_server }}
        username: ${{ steps.config.outputs.registry_username != '' && steps.config.outputs.registry_username || (steps.config.outputs.provider == 'github' && github.actor || '') }}
        password: ${{ steps.config.outputs.registry_password != '' && steps.config.outputs.registry_password || (steps.config.outputs.provider == 'github' && (inputs.github_token || github.token) || '') }}

    # 9) Outputs
    - name: Output account
      id: out-account
      shell: bash
      run: |
        set -Eeuo pipefail
        PROV="${{ steps.config.outputs.provider }}"
        if [[ "$PROV" == "aws" ]]; then
          ACC="$(aws sts get-caller-identity --query Account --output text 2>/dev/null || true)"
          [[ -z "$ACC" ]] && ACC="unknown"
        elif [[ "$PROV" == "gcp" ]]; then
          ACC="${{ steps.config.outputs.account }}"
          [[ -z "$ACC" ]] && ACC="unknown"
        elif [[ "$PROV" == "azure" ]]; then
          ACC="${{ steps.config.outputs.account }}"
          [[ -z "$ACC" ]] && ACC="unknown"
        else
          ACC="unknown"
        fi
        echo "id=$ACC" >> "$GITHUB_OUTPUT"

    - name: Output registry URL
      id: out-registry
      shell: bash
      run: |
        set -Eeuo pipefail
        URL=""
        if [[ "${{ inputs.login_to_container_registry }}" == "true" ]]; then
          case "${{ steps.config.outputs.provider }}" in
            aws)
              ACC="$(aws sts get-caller-identity --query Account --output text 2>/dev/null || true)"
              if [[ -n "$ACC" && -n "${{ steps.config.outputs.location }}" ]]; then
                URL="${ACC}.dkr.ecr.${{ steps.config.outputs.location }}.amazonaws.com"
              fi
              ;;
            gcp)
              LOC="${{ steps.config.outputs.location }}"
              # If a zone was provided (e.g., us-central1-a), strip the trailing "-<letter>"
              BASE="$LOC"
              if [[ "$LOC" =~ ^[a-z]+-[a-z]+[0-9]-[a-z]$ ]]; then
                BASE="${LOC%-?}"
              fi
              HOST="${BASE}-docker.pkg.dev"
              if [[ -n "${{ steps.config.outputs.account }}" ]]; then
                URL="${HOST}/${{ steps.config.outputs.account }}"
              fi
              ;;
            azure)
              if [[ -n "${{ steps.config.outputs.acr_registry }}" ]]; then
                URL="${{ steps.config.outputs.acr_registry }}.azurecr.io"
              fi
              ;;
            github|dockerhub|quay|registry)
              # Use the configured registry server
              URL="${{ steps.config.outputs.registry_server }}"
              ;;
          esac
        fi
        echo "url=$URL" >> "$GITHUB_OUTPUT"

    - name: Output kubectl context
      id: out-kubectl
      shell: bash
      run: |
        set -Eeuo pipefail
        if [[ -n "${{ inputs.cluster }}" ]]; then
          CTX="$(kubectl config current-context 2>/dev/null || true)"
          echo "context=${CTX}" >> "$GITHUB_OUTPUT"
        else
          echo "context=" >> "$GITHUB_OUTPUT"
        fi

    - name: Output status & summary
      id: out-status
      shell: bash
      run: |
        set -Eeuo pipefail
        echo "authenticated=true" >> "$GITHUB_OUTPUT"

        echo "### Cloud Authentication Summary" >> "$GITHUB_STEP_SUMMARY"
        echo "" >> "$GITHUB_STEP_SUMMARY"
        echo "| Property | Value |" >> "$GITHUB_STEP_SUMMARY"
        echo "|---|---|" >> "$GITHUB_STEP_SUMMARY"
        echo "| **Provider** | ${{ steps.config.outputs.provider }} |" >> "$GITHUB_STEP_SUMMARY"
        echo "| **Location** | ${{ steps.config.outputs.location }} |" >> "$GITHUB_STEP_SUMMARY"
        echo "| **Account** | ${{ steps.out-account.outputs.id }} |" >> "$GITHUB_STEP_SUMMARY"
        if [[ -n "${{ steps.out-registry.outputs.url }}" ]]; then
          echo "| **Registry** | ${{ steps.out-registry.outputs.url }} |" >> "$GITHUB_STEP_SUMMARY"
        fi
        if [[ -n "${{ inputs.cluster }}" ]]; then
          echo "| **Cluster** | ${{ inputs.cluster }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| **Context** | ${{ steps.out-kubectl.outputs.context }} |" >> "$GITHUB_STEP_SUMMARY"
        fi