reusable.yaml

name: Reusable Uffizzi Preview Workflow

env:
  LOGGER_KEY: "aHR0cHM6Ly80NGI3Zjk5MTFiODU0NWI5YTMzMDY4NzRhY2ZjYjJjOUBvMzI0MzExLmluZ2VzdC5zZW50cnkuaW8vNDUwNDM2MTIxMjI0ODA2NA=="

on:
  workflow_call:
    inputs:
      compose-file-cache-key:
        description: "GHA Cache Key for Docker Compose file ready to deploy"
        required: true
        type: string
      compose-file-cache-path:
        description: "GHA Cache Path for Docker Compose file ready to deploy"
        required: true
        type: string
      username:
        description: "Uffizzi username for login, usually an email address"
        required: false
        type: string
      server:
        description: "Uffizzi server URL"
        default: https://app.uffizzi.com
        required: false
        type: string
      project:
        description: "Uffizzi project name"
        default: default
        required: false
        type: string
      pr-number:
        description: "GitHub Pull Request Number"
        default: ''
        required: false
        type: string
      git-ref:
        description: "Branch or other git reference to checkout"
        default: ''
        required: false
        type: string
      healthcheck-url-path:
        description: "URL Path to the Uffizzi Preview URL where healthcheck would be performed. The URL Path has to start with a '/'."
        default: ''
        required: false
        type: string
    secrets:
      access-token:
        description: 'Github pipeline token'
        required: false
      password:
        description: "Uffizzi password for login"
        required: false
      url-username:
        description: "Username for authenticating to each Environment"
        required: false
      url-password:
        description: "Password for authentication to each Environment"
        required: false
      personal-access-token:
        description: "GitHub personal access token with access to container registry"
        required: false
      dockerhub-username:
        description: 'DockerHub username'
        required: false
      dockerhub-password:
        description: 'DockerHub password'
        required: false
      acr-username:
        description: 'Azure username'
        required: false
      acr-password:
        description: 'Azure password'
        required: false
      acr-registry-url:
        description: 'Azure registry url'
        required: false
      aws-access-key-id:
        description: 'Amazon Web Services access key id'
        required: false
      aws-secret-access-key:
        description: 'Amazon Web Services secret access key'
        required: false
      aws-registry-url:
        description: 'Amazon Web Services registry url'
        required: false
      gcloud-service-key:
        description: 'Google Cloud service key'
        required: false
      docker-registry-username:
        description: 'Custom docker registry username'
        required: false
      docker-registry-password:
        description: 'Custom docker registry password'
        required: false
      docker-registry-url:
        description: 'Custom docker registry url'
        required: false
  
    outputs:
      url:
        description: "URL to Uffizzi Preview Environment"
        value: ${{ jobs.uffizzi-preview.outputs.url }}
      id:
        description: "Uffizzi Preview Deployment ID"
        value: ${{ jobs.uffizzi-preview.outputs.id }}
      containers_uri:
        description: 'URL to Uffizzi Deployment Details'
        value: ${{ jobs.uffizzi-preview.outputs.containers_uri }}
      expiration_interval:
        description: "Uffizzi Preview Expiration Interval in Seconds"
        value: ${{ jobs.uffizzi-preview.outputs.expiration_interval }}
      expiration:
        description: "Uffizzi Preview Expiration Time String"
        value: ${{ jobs.uffizzi-preview.outputs.expiration }}
      expiration_timestamp:
        description: "Uffizzi Preview Expiration UNIX Timestamp"
        value: ${{ jobs.uffizzi-preview.outputs.expiration_timestamp }}

permissions:
  contents: read
  pull-requests: write
  id-token: write

jobs:
  uffizzi-preview:
    name: "Create, Update, or Delete Preview on Uffizzi"
    runs-on: ubuntu-20.04
    outputs:
      url: ${{ steps.outputs.outputs.url }}
      id: ${{ steps.outputs.outputs.id }}
      containers_uri: ${{ steps.outputs.outputs.containers_uri }}
      expiration_interval: ${{ steps.outputs.outputs.expiration_interval }}
      expiration: ${{ steps.outputs.outputs.expiration }}
      expiration_timestamp: ${{ steps.outputs.outputs.expiration_timestamp }}
    steps:
      - name: DEBUG - Dump GitHub context and environment info
        if: ${{ runner.debug }}
        uses: crazy-max/ghaction-dump-context@v1
      - name: Determine Pull Request Number
        id: pr
        run: |
          export INPUT_PR=${{ inputs.pr-number }}
          export CONTEXT_PR=${{ github.event.number }}
          export OUTPUT_PR=${INPUT_PR:-$CONTEXT_PR}
          echo "PR_NUMBER=$OUTPUT_PR" >> $GITHUB_ENV
      - name: Predict Deployment URL
        id: url
        # Replace dots in the repo name with the plus sign
        run: |
          REPO=$(echo ${{ github.repository }} | sed 's/\./+/g')
          echo "EXPECTED_URL=${{ inputs.server }}/github.com/$REPO/pull/$PR_NUMBER" >> $GITHUB_ENV
      - name: Obtain an a job token and an OIDC token request url from GHA
        uses: actions/github-script@v6
        id: ci-job-token
        with:
          debug: true
          script: |
            const token = process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN']
            const runtimeUrl = process.env['ACTIONS_ID_TOKEN_REQUEST_URL']
            core.setOutput('request-token', token.trim())
            core.setOutput('request-token-url', runtimeUrl.trim())
      # If PR event, look for an existing Preview Deployment.
      - name: Find Deployment for this Pull Request
        id: find-deployment
        uses: docker://uffizzi/cli:v1
        with:
          entrypoint: bash
          args: -c "/root/docker-entrypoint.sh && echo DEPLOYMENT_ID=$(/usr/local/bundle/bin/uffizzi preview list --filter \"github.repository=${{ github.repository }} github.event.number=$PR_NUMBER\") >> $GITHUB_ENV"
        env:
          UFFIZZI_PASSWORD: ${{ secrets.password }}
          UFFIZZI_SERVER: ${{ inputs.server }}
          UFFIZZI_USER: ${{ inputs.username }}
          UFFIZZI_PROJECT: ${{ inputs.project }}
          REQUEST_TOKEN: ${{ steps.ci-job-token.outputs.request-token }}
          REQUEST_TOKEN_URL: ${{ steps.ci-job-token.outputs.request-token-url }}
          LOGGER_KEY: ${{ env.LOGGER_KEY }}
          CI_WORKFLOW: "true"
      - name: DEBUG - Echo deployment ID
        run: 'echo ${{ env.DEPLOYMENT_ID }}'
      - name: Find comment for deployment URL
        uses: peter-evans/find-comment@v2
        id: find-comment
        with:
          issue-number: ${{ env.PR_NUMBER }}
          comment-author: 'github-actions[bot]'
          body-includes: '${{ env.EXPECTED_URL }}'
          direction: last

      - name: Delete Preview from Uffizzi
        if: ${{ inputs.compose-file-cache-key == '' }}
        uses: UffizziCloud/delete-preview-action@v1
        with:
          id: ${{ env.DEPLOYMENT_ID }}
          username: ${{ inputs.username }}
          server: ${{ inputs.server }}
          project: ${{ inputs.project }}
          password: ${{ secrets.password }}
          request-token: ${{ steps.ci-job-token.outputs.request-token }}
          request-token-url: ${{ steps.ci-job-token.outputs.request-token-url }}
          logger-key: ${{ env.LOGGER_KEY }}
      - name: Update Comment with Deletion
        uses: peter-evans/create-or-update-comment@v2
        if: ${{ inputs.compose-file-cache-key == '' }}
        with:
          comment-id: ${{ steps.find-comment.outputs.comment-id }}
          issue-number: ${{ env.PR_NUMBER }}
          body: |
            Uffizzi Preview `${{ env.DEPLOYMENT_ID }}` was deleted.
          edit-mode: replace

      - name: Create or Update Comment with Deployment Notification
        id: notification
        uses: peter-evans/create-or-update-comment@v2
        if: ${{ inputs.compose-file-cache-key != '' }}
        with:
          comment-id: ${{ steps.find-comment.outputs.comment-id }}
          issue-number: ${{ env.PR_NUMBER }}
          body: |
            ## Uffizzi Preview Environment

            :cloud: ${{ env.EXPECTED_URL }}

            :gear: Updating now by workflow run [${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).

            What is Uffizzi? [Learn more](https://github.com/UffizziCloud/uffizzi)
          edit-mode: replace

      - name: Checkout commit
        if: ${{ inputs.compose-file-cache-key != '' }}
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Fetch cached Compose File
        id: cache
        if: ${{ inputs.compose-file-cache-key != '' }}
        uses: actions/cache@v3
        with:
          path: ${{ inputs.compose-file-cache-path }}
          key: ${{ inputs.compose-file-cache-key }}
      - name: Deploy New Preview
        id: create-preview
        if: ${{ env.DEPLOYMENT_ID == '' && inputs.compose-file-cache-key != '' }}
        uses: UffizziCloud/preview-action@v2
        with:
          compose-file: ${{ inputs.compose-file-cache-path }}
          username: ${{ inputs.username }}
          server: ${{ inputs.server }}
          project: ${{ inputs.project }}
          password: ${{ secrets.password }}
          access-token: ${{ secrets.access-token }}
          ghcr-username: ${{ github.actor }}
          ghcr-access-token: ${{ secrets.personal-access-token }}
          github-event-number: ${{ env.PR_NUMBER }}
          github-ref: ${{ github.ref }}
          github-repository: ${{ github.repository }}
          request-token: ${{ steps.ci-job-token.outputs.request-token }}
          request-token-url: ${{ steps.ci-job-token.outputs.request-token-url }}
          dockerhub-username: ${{ secrets.dockerhub-username }}
          dockerhub-password: ${{ secrets.dockerhub-password }}
          acr-username: ${{ secrets.acr-username }}
          acr-password: ${{ secrets.acr-password }}
          acr-registry-url: ${{ secrets.acr-registry-url }}
          aws-access-key-id: ${{ secrets.aws-access-key-id }}
          aws-secret-access-key: ${{ secrets.aws-secret-access-key }}
          aws-registry-url: ${{ secrets.aws-registry-url }}
          gcloud-service-key: ${{ secrets.gcloud-service-key }}
          docker-registry-username: ${{ secrets.docker-registry-username }}
          docker-registry-password: ${{ secrets.docker-registry-password }}
          docker-registry-url: ${{ secrets.docker-registry-url }}
          logger-key: ${{ env.LOGGER_KEY }}

      - name: Check if URL Authentication is in use
        # GHA limitation workaround https://github.com/actions/runner/issues/520#issuecomment-700579336
        id: url-auth-for-create
        shell: bash
        run: if [ -z "${{ secrets.url-password }}" ]; then echo "No URL authentication."; else echo "URL_AUTHENTICATION=true" >> $GITHUB_ENV ; fi
      - name: Confirm Successful Preview Deployment
        if: ${{ env.DEPLOYMENT_ID == '' && github.event.action != 'closed' && env.URL_AUTHENTICATION == '' }}
        uses: docker://curlimages/curl:7.84.0
        with:
          args: --retry 12 --retry-all-errors --retry-delay 0 --fail --location ${{ steps.create-preview.outputs.url }}${{ inputs.healthcheck-url-path }}
      - name: Confirm Successful Preview Deployment with Authentication
        if: ${{ env.DEPLOYMENT_ID == '' && github.event.action != 'closed' && env.URL_AUTHENTICATION == 'true' }}
        uses: docker://curlimages/curl:7.84.0
        with:
          args: --basic --user ${{ secrets.url-username }}:${{ secrets.url-password }} --retry 12 --retry-all-errors --retry-delay 0 --fail --location ${{ steps.create-preview.outputs.url }}${{ inputs.healthcheck-url-path }}

      - name: Update Existing Preview
        uses: UffizziCloud/update-preview-action@v1
        id: update-preview
        if: ${{ env.DEPLOYMENT_ID != '' && inputs.compose-file-cache-key != '' }}
        with:
          preview-id: ${{ env.DEPLOYMENT_ID }}
          compose-file: ${{ inputs.compose-file-cache-path }}
          username: ${{ inputs.username }}
          server: ${{ inputs.server }}
          project: ${{ inputs.project }}
          password: ${{ secrets.password }}
          ghcr-username: ${{ github.actor }}
          ghcr-access-token: ${{ secrets.personal-access-token }}
          github-event-number: ${{ env.PR_NUMBER }}
          github-ref: ${{ github.ref }}
          github-repository: ${{ github.repository }}
          request-token: ${{ steps.ci-job-token.outputs.request-token }}
          request-token-url: ${{ steps.ci-job-token.outputs.request-token-url }}
          dockerhub-username: ${{ secrets.dockerhub-username }}
          dockerhub-password: ${{ secrets.dockerhub-password }}
          acr-username: ${{ secrets.acr-username }}
          acr-password: ${{ secrets.acr-password }}
          acr-registry-url: ${{ secrets.acr-registry-url }}
          aws-access-key-id: ${{ secrets.aws-access-key-id }}
          aws-secret-access-key: ${{ secrets.aws-secret-access-key }}
          aws-registry-url: ${{ secrets.aws-registry-url }}
          gcloud-service-key: ${{ secrets.gcloud-service-key }}
          docker-registry-username: ${{ secrets.docker-registry-username }}
          docker-registry-password: ${{ secrets.docker-registry-password }}
          docker-registry-url: ${{ secrets.docker-registry-url }}
          logger-key: ${{ env.LOGGER_KEY }}

      - name: Confirm Successful Preview Deployment
        if: ${{ env.DEPLOYMENT_ID != '' && inputs.compose-file-cache-key != '' && env.URL_AUTHENTICATION == '' }}
        uses: docker://curlimages/curl:7.84.0
        with:
          args: --retry 12 --retry-all-errors --retry-delay 0 --fail --location ${{ steps.update-preview.outputs.url }}${{ inputs.healthcheck-url-path }}
      - name: Confirm Successful Preview Deployment with Authentication
        if: ${{ env.DEPLOYMENT_ID != '' && inputs.compose-file-cache-key != '' && env.URL_AUTHENTICATION == 'true' }}
        uses: docker://curlimages/curl:7.84.0
        with:
          args: --basic --user ${{ secrets.url-username }}:${{ secrets.url-password }} --retry 12 --retry-all-errors --retry-delay 0 --fail --location ${{ steps.update-preview.outputs.url }}${{ inputs.healthcheck-url-path }}
      - name: Job output consolidation
        id: outputs
        if: ${{ github.event.action != 'closed' }}
        run: |
          export CREATE_URL=${{ steps.create-preview.outputs.url }}
          export CREATE_ID=${{ steps.create-preview.outputs.id }}
          export CREATE_CONTAINERS=${{ steps.create-preview.outputs.containers_uri }}
          export UPDATE_URL=${{ steps.update-preview.outputs.url }}
          export UPDATE_ID=${{ steps.update-preview.outputs.id }}
          export UPDATE_CONTAINERS=${{ steps.update-preview.outputs.containers_uri }}

          export OUTPUT_URL=${CREATE_URL:-$UPDATE_URL}
          export OUTPUT_ID=${CREATE_ID:-$UPDATE_ID}
          export OUTPUT_CONTAINERS=${CREATE_CONTAINERS:-$UPDATE_CONTAINERS}

          echo "Deployment ID $OUTPUT_ID at $OUTPUT_URL"

          echo "OUTPUT_ID=$OUTPUT_ID" >> $GITHUB_ENV
          echo "OUTPUT_URL=$OUTPUT_URL" >> $GITHUB_ENV
          echo "OUTPUT_CONTAINERS=$OUTPUT_CONTAINERS" >> $GITHUB_ENV

          export EXPIRATION_HOURS=$(grep --perl-regexp --only-matching '^[ \t]*(?!#)delete_preview_after: \K\d+' ${{ inputs.compose-file-cache-path }})
          if [ -z "$EXPIRATION_HOURS" ]
          then
            echo "No preview expiration parameter found."
          else
            export EXPIRATION_INTERVAL=$(( $EXPIRATION_HOURS * 3600 ))
            export EXPIRATION_TIMESTAMP=$(date +'%s')
            export EXPIRATION=$(date --utc --date=@$(($EXPIRATION_TIMESTAMP + $EXPIRATION_INTERVAL)))

            echo "Expiring in $EXPIRATION_INTERVAL seconds at $EXPIRATION."

            echo "EXPIRATION_INTERVAL=$EXPIRATION_INTERVAL" >> $GITHUB_ENV
            echo "EXPIRATION=:alarm_clock: This Preview will be destroyed in $EXPIRATION_HOURS hours at: $EXPIRATION" >> $GITHUB_ENV
          fi

          # Expose the step output variables
          echo "url=$OUTPUT_URL" >> $GITHUB_OUTPUT
          echo "id=$OUTPUT_ID" >> $GITHUB_OUTPUT
          echo "containers_uri=$OUTPUT_CONTAINERS" >> $GITHUB_OUTPUT
          echo "expiration_interval=$EXPIRATION_INTERVAL" >> $GITHUB_OUTPUT
          echo "expiration=$EXPIRATION" >> $GITHUB_OUTPUT
          echo "expiration_timestamp=$EXPIRATION_TIMESTAMP" >> $GITHUB_OUTPUT

      - name: Create or Update Comment with Deployment URL
        uses: peter-evans/create-or-update-comment@v2
        if: ${{ inputs.compose-file-cache-key != '' }}
        with:
          comment-id: ${{ steps.notification.outputs.comment-id }}
          issue-number: ${{ env.PR_NUMBER }}
          body: |
            ## Uffizzi Preview Environment `${{ env.OUTPUT_ID }}`

            :cloud: ${{ env.EXPECTED_URL }}

            :page_facing_up: [View Application Logs etc.](${{ env.OUTPUT_CONTAINERS }})

            ${{ env.EXPIRATION }}

            What is Uffizzi? [Learn more](https://github.com/UffizziCloud/uffizzi)
          edit-mode: replace