client-report-app-version.yaml

name: Report App Version

# This workflow is meant to be called from other repositories' workflows to report a new app version to Sherlock.
#
# The caller repository must have Workload Identity Federation configured to allow impersonation of the
# "gha-iap-accessor@dsp-devops-super-prod.iam.gserviceaccount.com" service account; steps 1 and 2 of the documentation:
# https://docs.google.com/document/d/1bnhDmWQHAMat_Saoa_z28FHwXmGWw6kywjdbKf208h4/edit
#
# With that configured, here's how you can call this workflow from whatever workflow currently publishes the app:
# ```yaml
# jobs:
#
#   <your-existing-job-id>:
#     # Output the version from your existing job's tag/bump step, something like this:
#     outputs:
#       tag: ${{ steps.tag.outputs.tag }}
#     steps:
#       # ... (The rest of your existing job can stay the same)
#
#   report-to-sherlock:
#     uses: broadinstitute/sherlock/.github/workflows/client-report-app-version.yaml@main
#     needs: <your-existing-job-id>
#     with:
#       new-version: ${{ needs.<your-existing-job-id>.outputs.tag }}
#       chart-name: '<your-app-helm-chart-name>'
#     permissions:
#       contents: 'read'
#       id-token: 'write'
# ```

on:
  workflow_call:

    secrets:
      custom-git-token:
        required: false
        description: "Use a specific token instead of the one automatically available from the calling workflow"

    inputs:

      ##
      ## Required configuration:
      ##

      new-version:
        required: true
        type: string
        description: "The app's new semantic version to record in Sherlock"
      chart-name:
        required: true
        type: string
        description: "The name of the Helm Chart that deploys this app"

      ##
      ## Git configuration:
      ##   (Note that custom-git-token is available, just defined below in the secrets block)
      ##

      use-git:
        required: false
        type: boolean
        default: true
        description: "If extra version information should be gleaned from Git"

      custom-git-repo:
        required: false
        type: string
        description: "Checkout another repo instead of the calling workflow's"
  
      override-branch:
        required: false
        type: string
        description: "Optionally provide a specific branch of the repo, instead of the calling workflow's context or custom git repo's default"
      override-commit:
        required: false
        type: string
        description: "Optionall provide a specific commit of the branch, instead of HEAD"
      override-description:
        required: false
        type: string
        description: "Optionally provide a custom description for the version instead of the commit message"
      override-parent:
        required: false
        type: string
        description: "Optionally provide the parent version for the new version"

      no-parent:
        required: false
        type: string
        description: "Entirely omit the parent field, useful when the repository doesn't tag versions"

env:
  SHERLOCK_PROD_URL: 'https://sherlock.dsp-devops-prod.broadinstitute.org'
  BEEHIVE_PROD_URL: 'https://beehive.dsp-devops-prod.broadinsitute.org'
  BEEHIVE_PROD_VANITY_URL: 'https://broad.io/beehive'

jobs:
  report-new-version:
    runs-on: ubuntu-22.04
    permissions:
      contents: 'read'
      id-token: 'write'
    
    steps:

      ##
      ## Handle required:
      ##

      - name: "Begin Request Body"
        shell: bash
        run: |
          echo '{
            "appVersion": "${{ inputs.new-version }}",
            "chart": "${{ inputs.chart-name }}"
          }' > "$RUNNER_TEMP/body.json"

      ##
      ## Handle Git:
      ##

      - name: "Checkout"
        if: ${{ inputs.use-git == true }}
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          repository: ${{ inputs.custom-git-repo || github.repository }}
          token: ${{ secrets.custom-git-token || github.token }}
          persist-credentials: false

      # Branch:

      - name: "If a PR, Use the Target Branch"
        if: ${{ inputs.use-git == true && inputs.override-branch == '' && github.head_ref != '' }}
        shell: bash
        run: |
          git checkout "${{ github.head_ref }}"
      - name: "Parse Branch From Git"
        if: ${{ inputs.use-git == true && inputs.override-branch == '' }}
        shell: bash
        run: |
          export BRANCH="$(git branch --show-current || true)"
          
          # If $BRANCH is empty, we weren't directly on a branch. Presumably we're on a tag or commit.
          # List branches containing the current commit and pick the first one.
          # We have to filter out empty spaces (awk) and ones that say "detached at" (grep) and then
          # pick the first option since there could be multiple (head).
          # This is at least better than throwing our hands up.
          if [ -z "$BRANCH" ]
          then
            export BRANCH="$((git branch --format='%(refname:short)' --list --contains $(git rev-parse HEAD) | awk '{$1=$1};NF' | grep -v -F " " | head -n 1) || true)"
          fi
          
          # If $BRANCH is not empty, then we go and write it into the request body.
          if [ -n "$BRANCH" ]
          then
            cat <<< $(jq '.gitBranch = env.BRANCH' "$RUNNER_TEMP/body.json") > "$RUNNER_TEMP/body.json"
          fi
      - name: "Use Overridden Branch"
        if: ${{ inputs.override-branch != '' }}
        shell: bash
        run: |
          cat <<< $(jq '.gitBranch = "${{ inputs.override-branch }}"' "$RUNNER_TEMP/body.json") > "$RUNNER_TEMP/body.json"
      - name: "Respect Overridden Branch Downstream"
        if: ${{ inputs.use-git == true && inputs.override-branch != '' }}
        shell: bash
        run: |
          git checkout ${{ inputs.override-branch }}

      # Commit:

      - name: "Parse Commit From Git"
        if: ${{ inputs.use-git == true && inputs.override-commit == '' }}
        shell: bash
        run: |
          export COMMIT="$(git rev-parse HEAD || true)"
          if [ -n "$COMMIT" ]
          then
            cat <<< $(jq '.gitCommit = env.COMMIT' "$RUNNER_TEMP/body.json") > "$RUNNER_TEMP/body.json"
          fi
      - name: "Use Overridden Commit"
        if: ${{ inputs.override-commit != '' }}
        shell: bash
        run: |
          cat <<< $(jq '.gitCommit = "${{ inputs.override-commit }}"' "$RUNNER_TEMP/body.json") > "$RUNNER_TEMP/body.json"
      - name: "Respect Overridden Commit Downstream"
        if: ${{ inputs.use-git == true && inputs.override-commit != '' }}
        shell: bash
        run: |
          git checkout ${{ inputs.override-commit }}

      # Description:

      - name: "Parse Commit Message From Git as Description"
        if: ${{ inputs.use-git == true && inputs.override-description == '' }}
        shell: bash
        run: |
          export DESCRIPTION="$(git log -1 --pretty=%B || true)"
          if [ -n "$DESCRIPTION" ]
          then
            cat <<< $(jq '.description = env.DESCRIPTION' "$RUNNER_TEMP/body.json") > "$RUNNER_TEMP/body.json"
          fi
      - name: "Use Overridden Description"
        if: ${{ inputs.override-description != '' }}
        shell: bash
        run: |
          cat <<< $(jq '.description = "${{ inputs.override-description }}"' "$RUNNER_TEMP/body.json") > "$RUNNER_TEMP/body.json"

      # Parent

      - name: "Parse Last Tag From Git as Parent"
        if: ${{ inputs.use-git == true && inputs.no-parent == false && inputs.override-parent == '' }}
        shell: bash
        run: |
          export PARENT="$(git describe --tags --abbrev=0 --exclude='*/**' HEAD^ || true)"
          if [ -n "$PARENT" ]
          then
            export PARENT="${{ inputs.chart-name }}/$PARENT"
            cat <<< $(jq '.parentAppVersion = env.PARENT' "$RUNNER_TEMP/body.json") > "$RUNNER_TEMP/body.json"
          fi
      - name: "Use Overridden Parent"
        if: ${{ inputs.no-parent == false && inputs.override-parent != '' }}
        shell: bash
        run: |
          cat <<< $(jq '.parentAppVersion = "${{ inputs.chart-name }}/${{ inputs.override-parent }}"' "$RUNNER_TEMP/body.json") > "$RUNNER_TEMP/body.json"

      ##
      ## Handle Sherlock:
      ##

      - name: "Log Request Body"
        shell: bash
        run: |
          cat "$RUNNER_TEMP/body.json"
          echo "## Reported ${{ inputs.chart-name }}/${{ inputs.new-version }} to Sherlock" >> $GITHUB_STEP_SUMMARY

      - name: "Authenticate to GCP"
        id: 'iap_auth'
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: 'projects/1038484894585/locations/global/workloadIdentityPools/github-wi-pool/providers/github-wi-provider'
          service_account: 'gha-iap-accessor@dsp-devops-super-prod.iam.gserviceaccount.com'
          token_format: 'id_token'
          id_token_audience: '257801540345-1gqi6qi66bjbssbv01horu9243el2r8b.apps.googleusercontent.com'
          id_token_include_email: true
          create_credentials_file: false
          export_environment_variables: false

      - name: "Generate GHA OIDC Token"
        id: 'gha_auth'
        uses: actions/github-script@v7
        with:
          script: core.setOutput('id_token', await core.getIDToken())

      - name: "Send to Sherlock"
        shell: bash
        run: |
          set -ex
          curl --fail-with-body -X 'PUT' \
            "$SHERLOCK_PROD_URL/api/app-versions/v3" \
            -H 'Content-Type: application/json' \
            -H 'Authorization: Bearer ${{ steps.iap_auth.outputs.id_token }}' \
            -H 'X-GHA-OIDC-JWT: ${{ steps.gha_auth.outputs.id_token }}' \
            -d "@$RUNNER_TEMP/body.json" | jq
          echo "### Available in Beehive at $BEEHIVE_PROD_VANITY_URL/r/app-version/${{ inputs.chart-name }}/${{ inputs.new-version }}" >> $GITHUB_STEP_SUMMARY

  report-workflow:
    uses: ./.github/workflows/client-report-workflow.yaml
    needs: report-new-version
    with:
      relates-to-app-versions: ${{ inputs.chart-name }}/${{ inputs.new-version }}
    permissions:
      id-token: write