build.yml

name: CI

on:
  pull_request_target:
    types: [opened, synchronize, reopened, edited, ready_for_review, labeled]

jobs:
  setup:
    name: Setup CI
    runs-on: ubuntu-22.04
    outputs:
      run_build: ${{ steps.check_build_required.outputs.run-build }}
      verifier-action-image: ${{ steps.set-env.outputs.verifier-action-image }}
      insecure_skip_tls_verify: ${{ steps.set-env.outputs.insecure_skip_tls_verify }}

    if: |
      github.event.pull_request.draft == false &&
      (github.event.action != 'labeled' || github.event.label.name == 'force-publish') &&
      github.actor != 'redhat-mercury-bot'
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set up Python 3.x Part 1
        uses: actions/setup-python@v4
        with:
          python-version: "3.9"

      - name: Set up Python 3.x Part 2
        run: |
          # set up python
          python3 -m venv ve1
          cd scripts
          ../ve1/bin/pip3 install -r requirements.txt
          ../ve1/bin/python3 setup.py install
          cd ..

      - name: Check for CI changes
        id: check_ci_changes
        env:
          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
        run: |
          # check if workflow testing should run.
          echo "[INFO] check if PR contains only workflow changes and user is authorized"
          ve1/bin/check-pr-for-ci --verify-user=${{ github.event.pull_request.user.login }} --api-url=${{ github.event.pull_request._links.self.href }}

      - name: Check if PR created as part of release process
        id: check_created_release_pr
        if: ${{ steps.check_ci_changes.outputs.run-tests != true }}
        env:
          BOT_NAME: ${{ secrets.BOT_NAME }}
          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
        run: |
          # check if PR was created as part of release processing
          ./ve1/bin/release-checker --api-url=${{ github.event.pull_request._links.self.href }} \
                                    --sender='${{ github.event.sender.login }}' \
                                    --pr_branch='${{ github.event.pull_request.head.ref }}' \
                                    --pr_body="${{ github.event.pull_request.body }}" \
                                    --pr_base_repo='${{ github.event.pull_request.base.repo.full_name }}' \
                                    --pr_head_repo='${{ github.event.pull_request.head.repo.full_name }}'

      - name: Exit if build not required
        id: check_build_required
        env:
          RUN_TESTS: ${{ steps.check_ci_changes.outputs.run-tests }}
          NOT_CI_AUTHORIZED: ${{ steps.check_ci_changes.outputs.workflow-only-but-not-authorized }}
          NO_CODE_TO_BUILD: ${{ steps.check_ci_changes.outputs.do-not-build }}
          DEV_PR_FOR_RELEASE: ${{ steps.check_created_release_pr.outputs.dev_release_branch }}
          CHARTS_PR_FOR_RELEASE: ${{ steps.check_created_release_pr.outputs.charts_release_branch }}
        run: |
          # exit if build not required
          if [ "${RUN_TESTS}" == "true" ] || [ "${NOT_CI_AUTHORIZED}" == "true" ]; then
            echo "The PR is workflow changes only - do not continue."
            exit 0
          elif [ "${NO_CODE_TO_BUILD}" == "true" ]; then
            echo "The PR does not contain changes which need build or test."
            exit 0
          elif [ "${DEV_PR_FOR_RELEASE}" == "true" ]; then
            echo "The PR is part of release processing for the development repository - do not continue."
          elif [ "${CHART_PR_FOR_RELEASE}" == "true" ]; then
            echo "The PR is part of release processing for the charts repository - do not continue."
          else
            echo "run-build=true" >> $GITHUB_OUTPUT
          fi

      - name: Set Environment
        id: set-env
        run: |
          #set environment based on repository
          if [ $GITHUB_REPOSITORY == "openshift-helm-charts/charts" ]; then
            echo "Use latest verifier image"
            echo "verifier-action-image=latest" >> $GITHUB_OUTPUT
          else
            echo "Use dev verifier image"
            echo "verifier-action-image=0.1.0" >> $GITHUB_OUTPUT
          fi
          echo "insecure_skip_tls_verify=true" >> $GITHUB_OUTPUT


  chart-verifier:
    name: Run chart-verifier
    runs-on: ubuntu-22.04
    needs: [setup]

    outputs:
      report_content: ${{ steps.check_report.outputs.report_content }}
      redhat_to_community: ${{ steps.check_report.outputs.redhat_to_community }}
      message_file: ${{ steps.pr_comment.outputs.message-file }}
      message_text_base64: ${{ steps.encode_pr_comment.outputs.message-text-base64 }}
      web_catalog_only: ${{ steps.check_pr_content.outputs.web_catalog_only }}
      chart_entry_name: ${{ steps.check_pr_content.outputs.chart-entry-name }}
      release_tag: ${{ steps.check_pr_content.outputs.release_tag }}

    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Checkout PR Branch
        if: ${{ needs.setup.outputs.run_build == 'true' }}
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          path: "pr-branch"

      - name: Set up Python 3.x Part 1
        uses: actions/setup-python@v4
        with:
          python-version: "3.9"

      - name: Set up Python 3.x Part 2
        run: |
          # set up python
          python3 -m venv ve1
          cd scripts
          ../ve1/bin/pip3 install -r requirements.txt
          ../ve1/bin/python3 setup.py install
          cd ..

      - name: Check PR Content
        id: check_pr_content
        if: ${{ needs.setup.outputs.run_build == 'true' }}
        continue-on-error: true
        env:
          GITHUB_REF: ${{ github.ref }}
          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
        run: |
          INDEX_BRANCH=$(if [ "${GITHUB_REF}" = "refs/heads/main" ]; then echo "refs/heads/gh-pages"; else echo "${GITHUB_REF}-gh-pages"; fi)
          ./ve1/bin/check-pr-content --index-branch=${INDEX_BRANCH} --repository=${{ github.repository }} --api-url=${{ github.event.pull_request._links.self.href }}

      - name: Add 'content-ok' label
        uses: actions/github-script@v6
        if: ${{ steps.check_pr_content.outcome == 'success'}}
        continue-on-error: true
        with:
          github-token: ${{secrets.GITHUB_TOKEN}}
          script: |
            github.rest.issues.addLabels({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              labels: ['content-ok']
            })

      - name: Remove 'content-ok' label
        uses: actions/github-script@v6
        if: ${{ steps.check_pr_content.outcome == 'failure' && contains( github.event.pull_request.labels.*.name, 'content-ok') }}
        continue-on-error: true
        with:
          github-token: ${{secrets.GITHUB_TOKEN}}
          script: |
            github.rest.issues.removeLabel({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              name: 'content-ok'
            })

      - name: Reflect on PR Content check
        if: ${{ steps.check_pr_content.outcome == 'failure'}}
        run: |
          echo "The 'PR Content check' step has failed."
          exit 1

      - name: Remove 'authorized-request' label from PR
        uses: actions/github-script@v6
        if: ${{ needs.setup.outputs.run_build == 'true' && contains( github.event.pull_request.labels.*.name, 'authorized-request') }}
        continue-on-error: true
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            var issue_number = ${{ github.event.number }};
            github.rest.issues.removeLabel({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: Number(issue_number),
              name: 'authorized-request'
            })

      - name: install chart verifier for action
        uses: redhat-actions/openshift-tools-installer@v1
        with:
          source: github
          skip_cache: true
          chart-verifier: "${{ needs.setup.outputs.verifier-action-image }}"

      - name: determine verify requirements
        if: ${{ needs.setup.outputs.run_build == 'true' }}
        id: verify_requires
        env:
          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
        working-directory: ./pr-branch
        run: |
          ../ve1/bin/get-verify-params --directory=pr --api-url=${{ github.event.pull_request._links.self.href }}

      - name: Install oc
        id: install-oc
        if: ${{ steps.verify_requires.outputs.cluster_needed == 'true' }}
        uses: redhat-actions/openshift-tools-installer@v1
        with:
          oc: latest

      - name: Set cluster login params
        id: login-params
        if: ${{ steps.verify_requires.outputs.cluster_needed == 'true' }}
        run: |
          #calculate cluster params
          API_SERVER=$( echo -n ${{ secrets.API_SERVER }} | base64 -d)
          echo "API_SERVER=${API_SERVER}" >> $GITHUB_OUTPUT

      - uses: redhat-actions/oc-login@v1
        id: oc_login
        if: ${{ steps.verify_requires.outputs.cluster_needed == 'true' }}
        with:
          openshift_server_url: ${{ steps.login-params.outputs.API_SERVER }}
          openshift_token: ${{ secrets.CLUSTER_TOKEN }}
          insecure_skip_tls_verify: ${{ needs.setup.outputs.insecure_skip_tls_verify }}

      - name: create service account
        id: create_service_account
        if: ${{ steps.verify_requires.outputs.cluster_needed == 'true' }}
        env:
          API_SERVER: ${{ steps.login-params.outputs.API_SERVER }}
          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
        run: |
          ve1/bin/sa-for-chart-testing --create charts-${{ github.event.number }} --token token.txt --server ${API_SERVER}
          echo "delete_namespace=true" >> $GITHUB_OUTPUT
          echo $KUBECONFIG

      - uses: redhat-actions/chart-verifier@v1
        id: run-verifier
        if: ${{ steps.verify_requires.outputs.report_needed == 'true' }}
        with:
            chart_uri: ${{ steps.verify_requires.outputs.verify_uri }}
            verify_args: ${{ steps.verify_requires.outputs.verify_args }}
            report_type: all
            fail: false

      - name: check-verifier-result
        id: check-verifier-result
        if: ${{ always() && steps.run-verifier.outcome == 'failure' }}
        run: |
          error_message="The chart verifier returned an error when trying to obtain a verification report for the chart."
          echo "verifier_error_message=$error_message" >> $GITHUB_OUTPUT

      - name: Get profile version set in report provided by the user
        id: get-profile-version
        if: ${{ needs.setup.outputs.run_build == 'true' && steps.verify_requires.outputs.report_provided == 'true' }}
        uses: mikefarah/yq@v4.35.1
        with:
          cmd: yq '.metadata.tool.profile.version' ${{ format('./pr-branch/{0}', steps.verify_requires.outputs.provided_report_relative_path) }}

      - name: Get the range of Kubernetes versions set in the report provided by the user
        id: get-kube-range
        if: ${{ needs.setup.outputs.run_build == 'true' && steps.verify_requires.outputs.report_provided == 'true' }}
        continue-on-error: true
        uses: mikefarah/yq@v4.35.1
        with:
          cmd: yq '.metadata.chart.kubeversion' ${{ format('./pr-branch/{0}', steps.verify_requires.outputs.provided_report_relative_path) }}

      - name: Get the corresponding range of OCP versions
        id: get-ocp-range
        if: ${{ needs.setup.outputs.run_build == 'true' && steps.verify_requires.outputs.report_provided == 'true' }}
        continue-on-error: true
        uses: ./.github/actions/get-ocp-range
        with:
          kube-version-range: ${{ steps.get-kube-range.outputs.result }}

      - name: Only ignore errors in get-ocp-range for profile in version v1.0
        if: ${{ (steps.get-kube-range.outcome == 'failure' || steps.get-ocp-range.outcome == 'failure') && steps.get-profile-version.outputs.result != 'v1.0' }}
        run: |
          echo "::error file=.github/workflows/build.yaml::Failure in get-ocp-range, mandatory for profile version ${{ steps.get-profile-version.outputs.result }}"
          exit 1

      - name: Check Report
        id: check_report
        if: ${{ needs.setup.outputs.run_build == 'true' }}
        env:
          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
          VENDOR_TYPE: ${{ steps.check_pr_content.outputs.category }}
          WEB_CATALOG_ONLY: ${{ steps.check_pr_content.outputs.web_catalog_only }}
          REPORT_GENERATED: ${{ steps.verify_requires.outputs.report_needed }}
          GENERATED_REPORT_PATH: ${{ steps.run-verifier.outputs.report_file }}
          REPORT_SUMMARY_PATH: ${{ steps.run-verifier.outputs.report_info_file }}
          WORKFLOW_WORKING_DIRECTORY: "../pr"
          OCP_VERSION_RANGE: ${{ steps.get-ocp-range.outputs.ocp-version-range }}
        run: |
          cd pr-branch
          ../ve1/bin/chart-pr-review \
            --directory=../pr \
            --verify-user=${{ github.event.pull_request.user.login }} \
            --api-url=${{ github.event.pull_request._links.self.href }}
          cd ..

      - name: Delete Namespace
        if: ${{ always() && steps.oc_login.conclusion == 'success' }}
        env:
          KUBECONFIG: /tmp/ci-kubeconfig
        run: |
          API_SERVER=$( echo -n ${{ secrets.API_SERVER }} | base64 -d)
          oc login --token=${{ secrets.CLUSTER_TOKEN }} --server=${API_SERVER} --insecure-skip-tls-verify=${{ needs.setup.outputs.insecure_skip_tls_verify }}
          ve1/bin/sa-for-chart-testing --delete charts-${{ github.event.number }}

      - name: Save PR artifact
        env:
          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
        if: ${{ always() && needs.setup.outputs.run_build == 'true' }}
        run: |
          ve1/bin/pr-artifact --directory=./pr --pr-number=${{ github.event.number }} --api-url=${{ github.event.pull_request._links.self.href }}

      - name: Prepare PR comment
        id: pr_comment
        if: ${{ always() && needs.setup.outputs.run_build == 'true' }}
        env:
          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
          PR_CONTENT_ERROR_MESSAGE: ${{ steps.check_pr_content.outputs.pr-content-error-message }}
          OWNERS_ERROR_MESSAGE: ${{ steps.check_pr_content.outputs.owners-error-message }}
          COMMUNITY_MANUAL_REVIEW: ${{ steps.check_report.outputs.community_manual_review_required }}
          OC_INSTALL_RESULT: ${{ steps.install-oc.outcome }}
          VERIFIER_ERROR_MESSAGE: ${{ steps.check-verifier-result.outputs.verifier_error_message }}
        run: |
          ve1/bin/pr-comment ${{ steps.check_pr_content.outcome }} ${{ steps.run-verifier.outcome }} ${{ steps.check_report.conclusion }}

      # Note(komish): This step is a temporary fix for the metrics step in the next job
      # which expects the PR comment to exist at the specified filesystem location.
      - name: Encode PR Comment for Metrics
        id: encode_pr_comment
        if: ${{ always() && needs.setup.outputs.run_build == 'true' }}
        run: |
          commentBase64=$(base64 --wrap=0 ${{ steps.pr_comment.outputs.message-file }})
          echo "message-text-base64=${commentBase64}" | tee -a $GITHUB_OUTPUT
        
      - name: Comment on PR
        if: ${{ always() && needs.setup.outputs.run_build == 'true' }}
        uses: actions/github-script@v6
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            var fs = require('fs');
            var issue_number = ${{ github.event.number }};
            var comment = fs.readFileSync('./pr/comment', {encoding:'utf8', flag:'r'});
            github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: Number(issue_number),
              body: comment
            });

      - name: Add 'authorized-request' label to PR
        if: ${{ always() && steps.check_pr_content.outcome == 'success' && steps.run-verifier.outcome != 'failure' && needs.setup.outputs.run_build == 'true' }}
        uses: actions/github-script@v6
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            var fs = require('fs');
            var issue_number = ${{ github.event.number }};
            var vendor_label = fs.readFileSync('./pr/vendor');
            var chart_name = fs.readFileSync('./pr/chart');
            if (vendor_label.toString() !== "" && chart_name.toString() !== "") {
              github.rest.issues.addLabels({
                issue_number: Number(issue_number),
                owner: context.repo.owner,
                repo: context.repo.repo,
                labels: ['authorized-request']
            })};

      - name: Approve PR
        id: approve_pr
        if: ${{ steps.check_report.conclusion == 'success' }}
        uses: hmarr/auto-approve-action@v3
        with:
          # The token we use for this changes for the Sandbox repository because the sandbox repository
          # receives PRs from the openshift-helm-charts-bot, and that same bot cannot approve its own
          # PRs which breaks workflows. Instead, for the Sandbox repo, we approve with the GHA bot.
          github-token: ${{ github.repository == 'openshift-helm-charts/sandbox' && secrets.GITHUB_TOKEN || secrets.BOT_TOKEN }}

      - name: Merge PR
        id: merge_pr
        if: ${{ steps.approve_pr.conclusion == 'success' }}
        uses: pascalgn/automerge-action@v0.15.6
        env:
          GITHUB_TOKEN: ${{ secrets.BOT_TOKEN }}
          MERGE_METHOD: squash
          MERGE_LABELS: ""

      - name: Check for PR merge
        if: ${{ needs.setup.outputs.run_build == 'true' }}
        env:
          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
        run: |
          ./ve1/bin/check-auto-merge --api-url=${{ github.event.pull_request._links.self.href }}


  release:
    name: Release Chart
    runs-on: ubuntu-22.04
    needs: [setup, chart-verifier]

    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Checkout PR Branch
        if: ${{ needs.setup.outputs.run_build == 'true' }}
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          path: "pr-branch"

      - name: Set up Python 3.x Part 1
        uses: actions/setup-python@v4
        with:
          python-version: "3.9"

      - name: Set up Python 3.x Part 2
        run: |
          # set up python
          python3 -m venv ve1
          cd scripts
          ../ve1/bin/pip3 install -r requirements.txt
          ../ve1/bin/python3 setup.py install
          cd ..

      - name: install chart verifier for action
        uses: redhat-actions/openshift-tools-installer@v1
        with:
          source: github
          skip_cache: true
          chart-verifier: ${{ needs.setup.outputs.verifier-action-image }}

      - name: Block until there is no running workflow
        if: ${{ needs.setup.outputs.run_build == 'true' }}
        uses: softprops/turnstyle@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure Git
        if: ${{ needs.setup.outputs.run_build == 'true' }}
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Release Charts
        if: ${{ needs.setup.outputs.run_build == 'true' }}
        env:
          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITHUB_REF: ${{ github.ref }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPORT_CONTENT: ${{ needs.chart-verifier.outputs.report_content }}
          CHART_ENTRY_NAME: ${{ needs.chart-verifier.outputs.chart_entry_name }}
          REDHAT_TO_COMMUNITY: ${{ needs.chart-verifier.outputs.redhat_to_community }}
          WEB_CATALOG_ONLY: ${{ needs.chart-verifier.outputs.web_catalog_only }}
          OCP_VERSION_RANGE: ${{ steps.get-ocp-range.outputs.ocp-version-range }}
        id: release-charts
        run: |
          tar zxvf ./scripts/dependencies/helm-chart-releaser/chart-releaser_1.2.0_linux_amd64.tar.gz
          sudo cp -f cr /usr/local/bin/cr
          INDEX_BRANCH=$(if [ "${GITHUB_REF}" = "refs/heads/main" ]; then echo "refs/heads/gh-pages"; else echo "${GITHUB_REF}-gh-pages"; fi)
          CWD=`pwd`
          cd pr-branch
          ../ve1/bin/chart-repo-manager \
            --repository=${{ github.repository }} \
            --index-branch=${INDEX_BRANCH} \
            --api-url=${{ github.event.pull_request._links.self.href }} \
            --pr-number=${{ github.event.number }}
          cd ${CWD}

      - name: Release
        if: ${{ needs.chart-verifier.outputs.web_catalog_only == 'False' }}
        uses: softprops/action-gh-release@v0.1.12
        continue-on-error: true
        with:
          tag_name: ${{ needs.chart-verifier.outputs.release_tag }}
          files: |
              ${{ steps.release-charts.outputs.report_file }}
              ${{ steps.release-charts.outputs.public_key_file }}
          fail_on_unmatched_files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # Note(komish): This step is a temporary workaround. Metrics requires the PR comment
      # to be available, but it is written to the filesystem in the previous job.
      # This can be removed once the metrics execution is restructured to have access to the PR
      # comment, or pulled out of the release job entirely.
      - name: Retrieve PR comment for metrics
        if: ${{ always() && needs.setup.outputs.run_build == 'true' && env.GITHUB_REPOSITORY != 'openshift-helm-charts/sandbox' }}
        run: |
          mkdir -p $(dirname ${{ needs.chart-verifier.outputs.message_file }})
          echo ${{ needs.chart-verifier.outputs.message_text_base64 }} | base64 -d | tee ${{ needs.chart-verifier.outputs.message_file }}

      - name: Add metrics
        if: ${{ always() && needs.setup.outputs.run_build == 'true' && env.GITHUB_REPOSITORY != 'openshift-helm-charts/sandbox' }}
        env:
          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
        run: |
          if [ $GITHUB_REPOSITORY == "openshift-helm-charts/charts" ]; then
              WRITE_KEY=${{ secrets.SEGMENT_WRITE_KEY }}
              ID_PREFIX="helm-metric-pr"
              echo "Use segment production write key"
          else
              WRITE_KEY=${{ secrets.SEGMENT_TEST_WRITE_KEY }}
              ID_PREFIX="helm-test-metric-pr"
              echo "Use segment test write key"
          fi

          if [ "${WRITE_KEY}" != "" ]; then
              echo "add PR run metric"
              ve1/bin/metrics --write-key="${WRITE_KEY}" \
                              --metric-type="pull_request" \
                              --message-file="${{ needs.chart-verifier.outputs.message_file }}" \
                              --pr-number="${{ github.event.number }}" \
                              --pr-action="${{ github.event.action }}" \
                              --repository="${GITHUB_REPOSITORY}" \
                              --prefix="${ID_PREFIX}" \
                              --pr_dir="./pr-branch"
          else
              echo "Do not collect metrics, required segment write key is not set"
          fi