charts-policies.yml

# Copyright (C) Nicolas Lamirault <nicolas.lamirault@gmail.com>
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0

name: Charts / Update policies

on:
  workflow_dispatch:
    inputs:
      policies:
        description: "Policies version"
        required: true
      loglevel:
        description: "Log level"
        required: true
        default: info
      python-version:
        description: "Python runtime"
        required: true
        default: "3.8"
      poetry-version:
        description: "Poetry"
        required: true
        default: "1.1.12"

permissions:
  contents: read

jobs:
  kyverno:
    permissions:
      contents: write  # for peter-evans/create-pull-request to create branch
      pull-requests: write  # for peter-evans/create-pull-request to create a PR
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

    - uses: actions/setup-python@v5.0.0
      with:
        python-version: ${{ github.event.inputs.python-version }}

    - name: Run image
      uses: abatilo/actions-poetry@v3.0.0
      with:
        poetry-version: ${{ github.event.inputs.poetry-version }}

    - name: Install dependencies
      run: |
        poetry install

    - name: Retrieve version
      id: version
      run: |
        version=$(grep 'version = ' ./hack/policies.py | awk -F'"' '{ print $2 }')
        echo "::set-output name=POLICIES_VERSION::$version"

    - name: Kyverno policies
      id: kyverno-policies
      run: |
        poetry run ./hack/policies.py portefaix-kyverno --release ${{ github.event.inputs.policies }} --log ${{ github.event.inputs.loglevel }}

    - name: Create pull request for charts updates
      id: cpr
      uses: peter-evans/create-pull-request@v6.0.5
      with:
        token: ${{ secrets.GITHUB_TOKEN }}
        branch: "policies/update-portefaix-kyverno-${{ github.event.inputs.policies }}"
        delete-branch: true
        title: "Update Kyverno policies to portefaix-policies-${{ github.event.inputs.policies }}"
        signoff: true
        draft: false
        committer: "Nicolas Lamirault <nlamirault@users.noreply.github.com>"
        author: "Nicolas Lamirault <nlamirault@users.noreply.github.com>"
        assignees: "nlamirault"
        commit-message: "Update: portefaix-policies set to ${{ github.event.inputs.policies }} for Portefaix Kyverno"
        body: |
          - Portefaix Policies set to ${{ github.event.inputs.policies }}
          - Auto-generated by [create-pull-request][1]

          [1]: https://github.com/peter-evans/create-pull-request

          Signed-off-by: Nicolas Lamirault <nlamirault@users.noreply.github.com>
        labels: |
          kind/feature
          lifecycle/active
          status/review_needed
          area/helm
          priority/medium

    - name: Check outputs
      run: |
        echo "Pull Request Number - ${{ steps.cpr.outputs.pull-request-number }}"
        echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"