deployParticipant.yaml

name: DeployParticipant

on:
  workflow_call:
    inputs:
      participant_name:
        description: 'Name of the participant.'
        required: true
        type: string
      resources_prefix:
        description: 'Resources name prefix used to avoid naming conflicts between resources of different DataSpaces.'
        required: true
        type: string
      registry_service_url:
        description: 'Url of the Dataspace registry service.'
        required: true
        type: string
      participant_country_code:
        description: 'Country code of the participant, e.g. FR, DE...'
        required: true
        type: string

  workflow_dispatch:
    inputs:
      participant_name:
        description: 'Name of the participant.'
        required: true
        type: string
      resources_prefix:
        description: 'Resources name prefix used to avoid naming conflicts between resources of different DataSpaces.'
        required: true
        type: string
      registry_service_url:
        description: 'Url of the Dataspace registry service.'
        required: true
        type: string
      participant_country_code:
        description: 'Country code of the participant, e.g. FR, DE...'
        required: true
        type: string

# Grant permissions to obtain federated identity credentials
# see https://docs.github.com/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-azure
permissions:
  id-token: write
  contents: read

env:
  PARTICIPANT_NAME: ${{ github.event.inputs.participant_name || inputs.participant_name }}
  RESOURCES_PREFIX: ${{ github.event.inputs.resources_prefix || inputs.resources_prefix }}
  REGISTRATION_SERVICE_URL: ${{ github.event.inputs.registry_service_url || inputs.registry_service_url }}
  PARTICIPANT_COUNTRY_CODE: ${{ github.event.inputs.participant_country_code || inputs.participant_country_code }}

jobs:

  # Build runtime image in Azure Container Registry, tagged with the unique run_number.
  Build-Connector:
    runs-on: ubuntu-latest
    env:
      ACR_NAME: ${{ secrets.ACR_NAME }}
    steps:
      # Checkout MVD code
      - uses: actions/checkout@v2

      - name: 'Az CLI login'
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.ARM_CLIENT_ID }}
          tenant-id: ${{ secrets.ARM_TENANT_ID }}
          subscription-id: ${{ secrets.ARM_SUBSCRIPTION_ID }}

      - name: 'Login to ACR'
        run: az acr login -n $ACR_NAME

      - uses: ./.github/actions/gradle-setup

      # Build MVD runtime JAR locally.
      # The result is a JAR file in MVD/launcher/build/libs.
      - name: 'Build runtime JAR'
        run: ./gradlew launcher:shadowJar

      # Build Docker runtime image remotely on ACR & push it to the registry.
      - name: 'Build image'
        run: az acr build --registry $ACR_NAME --image mvd/connector:${{ env.RESOURCES_PREFIX }} .
        working-directory: launcher

  # Build data dashboard webapp
  Build-Dashboard:
    runs-on: ubuntu-latest
    env:
      ACR_NAME: ${{ secrets.ACR_NAME }}
    steps:
      - name: Checkout DataDashboard
        uses: actions/checkout@v2
        with:
          repository: bscholtes1A/DataDashboard
          ref: e2842f1439bdc2cccbc65f5c1d64f0a1b941049b

      - name: 'Az CLI login'
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.ARM_CLIENT_ID }}
          tenant-id: ${{ secrets.ARM_TENANT_ID }}
          subscription-id: ${{ secrets.ARM_SUBSCRIPTION_ID }}

      - name: 'Login to ACR'
        run: az acr login -n $ACR_NAME

      # Build Docker runtime image remotely on ACR & push it to the registry.
      - name: 'Build image'
        run: az acr build --registry $ACR_NAME --image mvd/data-dashboard:${{ env.RESOURCES_PREFIX }} .

  # Deploy dataspace participant.
  Deploy-Participant:
    needs:
      - Build-Connector
      - Build-Dashboard
    runs-on: ubuntu-latest
    outputs:
      company1_edc_host: ${{ steps.runterraform.outputs.company1_edc_host }}
      company1_key_vault: ${{ steps.runterraform.outputs.company1_key_vault }}
      company1_api_key: ${{ steps.runterraform.outputs.company1_api_key }}
      company1_did_host: ${{ steps.runterraform.outputs.company1_did_host }}
      company1_connector_name: ${{ steps.runterraform.outputs.company1_connector_name }}
      company1_assets_storage_account: ${{ steps.runterraform.outputs.company1_assets_storage_account }}

    defaults:
      run:
        working-directory: deployment/terraform/participant

    steps:
      - uses: actions/checkout@v2

      - name: 'Generate key'
        run: |
          openssl ecparam -name prime256v1 -genkey -noout -out key.pem
          openssl ec -in key.pem -pubout -out key.public.pem
          docker run -i danedmunds/pem-to-jwk:1.2.1 --public --pretty < key.public.pem > key.public.jwk
          
      - name: 'Prepare GAIA-X self-description signature request'
        uses: cuchi/jinja2-action@v1.2.0
        with:
          template: deployment/terraform/participant/WrappedParticipantSelfDescription.json.j2
          output_file: deployment/terraform/participant/SignedWrappedParticipantSelfDescription.json
          strict: true
          variables: |
            registrationNumber=DEANY1234NUMBER
            country=${{ env.PARTICIPANT_COUNTRY_CODE }}

      - name: 'Output GAIA-X self-description signature request'
        run: cat SignedWrappedParticipantSelfDescription.json

# TODO: Hackathon #4: sign self-description with compliance API
#      - name: 'Request GAIA-X self-description signature'
#        run: |
#          curl --fail --location 'https://compliance.gaia-x.eu/api/v1/participant/signature/sign' \
#          --header 'Content-Type: application/json' \
#          --data @WrappedParticipantSelfDescription.json \
#          --output SignedWrappedParticipantSelfDescription.json
#
#      - name: 'Verify GAIA-X self-description signature'
#        run: |
#          curl --fail --location 'https://compliance.gaia-x.eu/api/v1/participant/verify/raw' \
#          --header 'Content-Type: application/json' \
#          --data @SignedWrappedParticipantSelfDescription.json

      - name: 'Create tfvars file'
        run: |
          cat > terraform.tfvars <<EOF
          acr_resource_group = "${{ secrets.COMMON_RESOURCE_GROUP }}"
          acr_name = "${{ secrets.ACR_NAME }}"
          participant_name = "${{ env.PARTICIPANT_NAME }}"
          participant_region = "eu"
          data_dashboard_theme = "theme-1"
          prefix = "${{ env.RESOURCES_PREFIX }}"
          resource_group = "rg-${{ env.PARTICIPANT_NAME }}-${{ env.RESOURCES_PREFIX }}"
          runtime_image = "mvd/connector:${{ env.RESOURCES_PREFIX }}"
          dashboard_image = "mvd/data-dashboard:${{ env.RESOURCES_PREFIX }}"
          application_sp_object_id = "${{ secrets.APP_OBJECT_ID }}"
          application_sp_client_id = "${{ secrets.APP_CLIENT_ID }}"
          registration_service_api_url = "${{ needs.Deploy-Dataspace.outputs.registration_service_url }}/api"
          EOF

      - name: 'Az CLI login'
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.ARM_CLIENT_ID }}
          tenant-id: ${{ secrets.ARM_TENANT_ID }}
          subscription-id: ${{ secrets.ARM_SUBSCRIPTION_ID }}

      - name: 'Upload tfvars file'
        run: az storage blob upload --account-name "${{ secrets.TERRAFORM_STATE_STORAGE_ACCOUNT }}" -c "${{ secrets.TERRAFORM_STATE_CONTAINER }}" -f terraform.tfvars -n "${{ env.PARTICIPANT_NAME }}${{ env.RESOURCES_PREFIX }}.tfvars" --auth-mode key

      - name: 'Run terraform'
        id: runterraform
        run: |
          # Create backend.conf file to retrieve the remote terraform state during terraform init.
          echo '
            resource_group_name  = "${{ secrets.COMMON_RESOURCE_GROUP }}"
            storage_account_name = "${{ secrets.TERRAFORM_STATE_STORAGE_ACCOUNT }}"
            container_name       = "${{ secrets.TERRAFORM_STATE_CONTAINER }}"
            key                  = "${{ env.PARTICIPANT_NAME }}${{ env.RESOURCES_PREFIX }}.tfstate"
          ' >> backend.conf
          terraform init -backend-config=backend.conf
          terraform apply -auto-approve
          CONNECTOR_NAME=$(terraform output -raw connector_name)
          DID_HOST=$(terraform output -raw did_host)
          EDC_HOST=$(terraform output -raw edc_host)
          ASSETS_STORAGE_ACCOUNT=$(terraform output -raw assets_storage_account)
          KEY_VAULT=$(terraform output -raw key_vault)
          WEBAPP_URL=$(terraform output -raw webapp_url)
          API_KEY=$(terraform output -raw api_key)
          echo "::notice title=MVD WebApp for ${{ env.PARTICIPANT_NAME }}::$WEBAPP_URL"
          echo "ASSETS_STORAGE_ACCOUNT=$ASSETS_STORAGE_ACCOUNT" >> $GITHUB_ENV
          echo "DID_HOST=$DID_HOST" >> $GITHUB_ENV
          echo "EDC_HOST=$EDC_HOST" >> $GITHUB_ENV
          echo "API_KEY=$API_KEY" >> $GITHUB_ENV
          echo "::set-output name=${{ env.PARTICIPANT_NAME }}_edc_host::${EDC_HOST}"
          echo "::set-output name=${{ env.PARTICIPANT_NAME }}_key_vault::${KEY_VAULT}"
          echo "::set-output name=${{ env.PARTICIPANT_NAME }}_api_key::${API_KEY}"
          echo "::set-output name=${{ env.PARTICIPANT_NAME }}_connector_name::${CONNECTOR_NAME}"
          echo "::set-output name=${{ env.PARTICIPANT_NAME }}_did_host::${DID_HOST}"
          echo "::set-output name=${{ env.PARTICIPANT_NAME }}_assets_storage_account::${ASSETS_STORAGE_ACCOUNT}"

        env:

          # Authentication settings for Terraform AzureRM provider
          # See https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs
          ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
          ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
          ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}

          # Terraform variables not included in terraform.tfvars.
          TF_VAR_key_file: "key.pem"
          TF_VAR_public_key_jwk_file: "key.public.jwk"
          TF_VAR_self_description_file: "SignedWrappedParticipantSelfDescription.json"
          TF_VAR_application_sp_client_secret: ${{ secrets.APP_CLIENT_SECRET }}

      - name: 'Verify did endpoint is available'
        run: curl https://$DID_HOST/.well-known/did.json | jq '.id'

      - name: 'Verify deployed EDC is healthy'
        run: curl --retry 6 --fail http://${EDC_HOST}:8181/api/check/health

      - name: 'Register participant'
        run: |
          curl -vfd '{ "name": "${{ env.PARTICIPANT_NAME }}", "supportedProtocols": [ "ids-multipart" ], "url": "http://${{ env.EDC_HOST }}:8282" }' \
            -HContent-type:application/json \
            $REGISTRATION_SERVICE_API_URL/registry/participant
        env:
          REGISTRATION_SERVICE_API_URL: ${{ env.REGISTRATION_SERVICE_URL }}/api