pr-env-deploy.yml

name: PR Environment Deploy

on:
  workflow_run:
    workflows:
      - PR
    types:
      - completed

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      pr_number: ${{ steps.pr_context.outputs.pr_number }}
      merge_commit_sha: ${{ steps.pr_context.outputs.merge_commit_sha }}
      head_repo_owner: ${{ steps.pr_context.outputs.head_repo_owner }}
      head_repo_name: ${{ steps.pr_context.outputs.head_repo_name }}
      head_branch: ${{ steps.pr_context.outputs.head_branch }}
      image_name: ${{ steps.pr_context.outputs.image_name }}
      image_tag: ${{ steps.pr_context.outputs.image_tag }}
      image_available: ${{ steps.pr_context.outputs.image_available }}
      image_digest: ${{ steps.pr_context.outputs.image_digest }}
      workflow_run_id: ${{ steps.pr_context.outputs.workflow_run_id }}
      artifact_name: ${{ steps.pr_context.outputs.artifact_name }}
      artifact_available: ${{ steps.pr_context.outputs.artifact_available }}
    permissions:
      contents: read
      packages: write
    steps:
      - name: Dump GitHub context # TODO: remove after debug
        run: echo "$GITHUB_CONTEXT"
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
      - name: Log in to the Container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Get PR context
        id: pr_context
        run: |
          #!/bin/bash
          set -x # TODO: remove after debug

          # Create temporary files
          PRS_DATA_FILE=$(mktemp)
          PR_DATA_FILE=$(mktemp)
          ARTIFACTS_DATA_FILE=$(mktemp)

          # Search for PR using the commit SHA and extract all required information
          curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \
            "${GITHUB_API_URL}/search/issues?q=${INPUT_HEAD_SHA}+repo:${INPUT_BASE_REPOSITORY}+is:pr+is:open" >"$PRS_DATA_FILE"
          PR_NUMBER=$(jq -r '.items[0].number' "$PRS_DATA_FILE")

          curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \
            "${GITHUB_API_URL}/repos/${INPUT_BASE_REPOSITORY}/pulls/${PR_NUMBER}" >"$PR_DATA_FILE"
          MERGE_COMMIT_SHA=$(jq -r '.merge_commit_sha' "$PR_DATA_FILE")
          HEAD_REPO_OWNER=$(jq -r '.head.repo.owner.login' "$PR_DATA_FILE")
          HEAD_REPO_NAME=$(jq -r '.head.repo.name' "$PR_DATA_FILE")
          HEAD_BRANCH=$(jq -r '.head.ref' "$PR_DATA_FILE")

          # Search for the image tag in GHCR
          IMAGE_NAME="${INPUT_BASE_REPOSITORY}"
          IMAGE_TAG="${MERGE_COMMIT_SHA}"
          if IMAGE_DIGEST=$(skopeo inspect \
            --no-tags \
            --retry-times 3 \
            --format '{{ .Digest }}' \
            "docker://ghcr.io/${IMAGE_NAME}:${IMAGE_TAG}" 2>/dev/null); then
            IMAGE_AVAILABLE=true
          else
            IMAGE_AVAILABLE=false
          fi

          # Search for the artifact
          ARTIFACT_NAME="$MERGE_COMMIT_SHA"
          curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \
            "${GITHUB_API_URL}/repos/${INPUT_BASE_REPOSITORY}/actions/runs/${INPUT_WORKFLOW_RUN_ID}/artifacts" >"$ARTIFACTS_DATA_FILE"
          ARTIFACT_AVAILABLE=$(jq --arg name "$ARTIFACT_NAME" '.artifacts | any(.name == $name and .expired == false)' "$ARTIFACTS_DATA_FILE")

          # Clean up temporary files
          rm -f "$PRS_DATA_FILE" "$PR_DATA_FILE" "$ARTIFACTS_DATA_FILE"

          # Exit with error if neither image nor artifact is found
          if [ "$IMAGE_AVAILABLE" != "true" ] && [ "$ARTIFACT_AVAILABLE" != "true" ]; then
            echo "::error::Neither image nor image artifact found, cannot proceed. Run the build workflow first"
            exit 1
          fi

          # Create markdown build summary TODO: remove after debug?
          {
            echo "| Variable            | Value                 |"
            echo "|---------------------|-----------------------|"
            echo "| pr_number           | ${PR_NUMBER}          |"
            echo "| merge_commit_sha    | ${MERGE_COMMIT_SHA}   |"
            echo "| head_repo_owner     | ${HEAD_REPO_OWNER}    |"
            echo "| head_repo_name      | ${HEAD_REPO_NAME}     |"
            echo "| head_branch         | ${HEAD_BRANCH}        |"
            echo "| image_name          | ${IMAGE_NAME}         |"
            echo "| image_tag           | ${IMAGE_TAG}          |"
            echo "| image_available     | ${IMAGE_AVAILABLE}    |"
            echo "| image_digest        | ${IMAGE_DIGEST}       |"
            echo "| workflow_run_id     | ${WORKFLOW_RUN_ID}    |"
            echo "| artifact_name       | ${ARTIFACT_NAME}      |"
            echo "| artifact_available  | ${ARTIFACT_AVAILABLE} |"
          } >>"$GITHUB_STEP_SUMMARY"

          # Set outputs
          echo "pr_number=$PR_NUMBER" >>$GITHUB_OUTPUT
          echo "merge_commit_sha=$MERGE_COMMIT_SHA" >>$GITHUB_OUTPUT
          echo "head_repo_owner=$HEAD_REPO_OWNER" >>$GITHUB_OUTPUT
          echo "head_repo_name=$HEAD_REPO_NAME" >>$GITHUB_OUTPUT
          echo "head_branch=$HEAD_BRANCH" >>$GITHUB_OUTPUT
          echo "image_name=$IMAGE_NAME" >>$GITHUB_OUTPUT
          echo "image_tag=$IMAGE_TAG" >>$GITHUB_OUTPUT
          echo "image_available=$IMAGE_AVAILABLE" >>$GITHUB_OUTPUT
          echo "image_digest=$IMAGE_DIGEST" >>$GITHUB_OUTPUT
          echo "workflow_run_id=${{ github.event.workflow_run.id }}" >>$GITHUB_OUTPUT
          echo artifact_name=$ARTIFACT_NAME >>$GITHUB_OUTPUT
          echo "artifact_available=$ARTIFACT_AVAILABLE" >>$GITHUB_OUTPUT
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          INPUT_BASE_REPOSITORY: ${{ github.repository }}
          INPUT_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
          INPUT_WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}

  plan:
    needs:
      - prepare
    uses: nepalevov/ai-dial-ci/.github/workflows/gh_environment.yml@main
    with:
      operation: plan
      environment_name: "pr-${{ needs.prepare.outputs.pr_number }}"

  deploy:
    if: ${{ needs.prepare.outputs.image_available == 'true' || needs.prepare.outputs.artifact_available == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      actions: read # Needed to access artifacts
      packages: write # To push to GHCR
      contents: read
    needs:
      - prepare
      - plan
    environment:
      name: ${{ needs.plan.outputs.environment_name }}
    env:
      INPUT_ARTIFACT_NAME: ${{ needs.prepare.outputs.artifact_name }}
      INPUT_ARTIFACT_FILE: /tmp/${{ needs.prepare.outputs.artifact_name }}.tar
      INPUT_IMAGE_NAME: ${{ needs.prepare.outputs.image_name }}
      INPUT_IMAGE_TAG: ${{ needs.prepare.outputs.image_tag }}
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Load Container Image from GHCR # TODO: remove after debug
        if: ${{ needs.prepare.outputs.image_available == 'true' }}
        run: |
          docker pull ghcr.io/${INPUT_IMAGE_NAME}:${INPUT_IMAGE_TAG}
      - name: Download Artifact from Previous Workflow Run
        if: ${{ needs.prepare.outputs.image_available == 'false' && needs.prepare.outputs.artifact_available == 'true' }}
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: ${{ env.INPUT_ARTIFACT_NAME }}
          path: /tmp
          run-id: ${{ needs.prepare.outputs.workflow_run_id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Load Container Image from Artifact
        if: ${{ needs.prepare.outputs.image_available == 'false' && needs.prepare.outputs.artifact_available == 'true' }}
        id: load_image
        run: |
          #!/bin/bash
          set -x # TODO: remove after debug

          if [ -f "$INPUT_ARTIFACT_FILE" ]; then
            docker load --input "$INPUT_ARTIFACT_FILE"
          else
            echo "::error::Artifact file not found"
            exit 1
          fi
      - name: List and Inspect Container Images # TODO: remove after debug
        run: |
          docker images ls
          docker inspect ghcr.io/${INPUT_IMAGE_NAME}:${INPUT_IMAGE_TAG}
          - name: Push Container Image to GHCR
            if: ${{ needs.prepare.outputs.image_available == 'false' && needs.prepare.outputs.artifact_available == 'true' }}
            run: |
              skopeo copy \
            docker-archive:${INPUT_ARTIFACT_FILE} \
            docker://ghcr.io/${INPUT_IMAGE_NAME}:${INPUT_IMAGE_TAG}
      # - uses: nepalevov/ai-dial-ci/actions/build_docker@main
      #   with:
      #     ghcr_username: ${{ github.actor }}
      #     ghcr_password: ${{ secrets.ACTIONS_BOT_TOKEN }}
      #     image_name: ghcr.io/${{ github.repository }}
      #     image_tag: ${{ steps.vars.outputs.sha }}
      #     push: true
      #     push_ghcr: true