action.yml

name: OpenShift Deployer
description: OpenShift deployer with route verification
branding:
  icon: package
  color: blue

inputs:
  ### Required
  file:
    description: Template file (e.g. frontend/openshift.deploy.yml)
    required: true
  oc_namespace:
    description: OpenShift namespace (e.g. abc123-dev)
    required: true
  oc_server:
    description: OpenShift server (e.g. https://api.silver.devops.gov.bc.ca:6443)
    required: true
  oc_token:
    description: OpenShift access token
    required: true
  overwrite:
    description: Replace existing objects/artifacts? (true|false)
    required: true

  ### Typical / recommended
  oc_version:
    description: Non-default OpenShift version; e.g. 4.13
  parameters:
    description: Template parameters/variables to pass (e.g. -p ZONE=...)
  post_rollout:
    description: Post deployment command; e.g. oc create job "thing-$(date +%s)" --from=cronjob/thing
  timeout:
    description: Timeout for deployment. [default=15m]
    default: "15m"
  triggers:
    description: Omit to always build, otherwise trigger by path; e.g. ('./backend/', './frontend/)
  verification_path:
    description: Sets the health endpoint to be used for verification, does not need '/'
    default: ""

  ### Usually a bad idea / not recommended
  delete_completed:
    description: Delete completed pods
    default: true
  diff_branch:
    description: Branch to diff against
    default: ${{ github.event.repository.default_branch }}
  repository:
    description: Optionally, specify a different repo to clone
    default: ${{ github.repository }}
  verification_retry_attempts:
    description: Number of times to attempt deployment verification
    default: "3"
  verification_retry_seconds:
    description: Seconds to wait between deployment verification attempts
    default: "10"

  ### Deprecated
  # All penetration tests have been deprecated in favour of scheduled jobs
  penetration_test:
    default: false
  # penetration_test_fail:
  # penetration_test_create_issue:
  # penetration_test_token:
  # penetration_test_artifact:
  # penetration_test_issue:

outputs:
  triggered:
    description: Did a deployment trigger?  [true|false]
    value: ${{ steps.deploy.outputs.triggered }}

runs:
  using: composite
  steps:
    # Notify about bugs and deprecations
    - shell: bash
      run: |
        # Notify about bugs and deprecations
        set -eu

        # Bug mitigation - OpenShift hates images with capitals in org/repo names
        REPO=${{ inputs.repository }}
        if [[ $REPO != ${REPO,,} ]]; then
          echo -e "An OpenShift bug prevents capital letters in repo names.\n"
          echo -e "Please handle that using the `repository` parameter.\n"
          exit 1
        fi

        # Deprecation notices
        if [ ! -z ${{ inputs.penetration_test }} != "false" ]; then
          echo -e "All penetration testing has been deprecated.  Instead we recommend running in a scheduled job. \n"
          echo -e "Please see https://github.com/zaproxy/action-full-scan for the source action.\n"
          echo -e "An example of a scheduled job with ZAP penetration testing can be found here:"
          echo -e "  => https://github.com/bcgov/quickstart-openshift/blob/main/.github/workflows/scheduled.yml\n"
          exit 1
        fi

    - uses: actions/checkout@v4
      with:
        repository: ${{ inputs.repository }}

    - uses: bcgov/action-oc-runner@v0.3.0
      with:
        oc_namespace: ${{ inputs.oc_namespace }}
        oc_token: ${{ inputs.oc_token }}
        oc_server: ${{ inputs.oc_server }}
        triggers: ${{ inputs.triggers }}
        commands: |
          # Remove any conflicting ImageStreams

          # Process template, consuming variables/parameters
          TEMPLATE="$(oc process -f ${{ inputs.file }} ${{ inputs.parameters }} --local)"

          # Clean any previous ImageStreams
          IS=$(jq -rn "${TEMPLATE} | .items[] | select(.kind==\"ImageStream\").metadata.name //empty")
          IFS=" " read -ra IS <<< "${IS}"
          for i in "${IS[@]}"
          do
            [ ! $(oc get is -o name | grep ^imagestream.image.openshift.io/${i}$) ]|| oc delete is/${i}
          done

    - uses: bcgov/action-oc-runner@v0.3.0
      id: deploy
      with:
        oc_namespace: ${{ inputs.oc_namespace }}
        oc_token: ${{ inputs.oc_token }}
        oc_server: ${{ inputs.oc_server }}
        triggers: ${{ inputs.triggers }}
        commands: |
          # Expand for deployment steps

          # Allow pipefail, since we could be catching oc create errors
          set +o pipefail

          # Apply (overwrites) or create (does not overwrite) using processed template
          TEMPLATE="$(oc process -f ${{ inputs.file }} ${{ inputs.parameters }} --local)"
          if [ "${{ inputs.overwrite }}" == "true" ]; then
            oc apply --timeout=${{ inputs.timeout || '15m' }} -f - <<< "${TEMPLATE}"
          else
            # Suppress AlreadyExists errors and expected failure
            oc create -f - 2>&1 <<< "${TEMPLATE}" | sed 's/.*: //'
          fi

          # Deployment and Route Host from template (note: DeploymentConfig is deprecated, but still supported)
          DDC="$(jq -rn "${TEMPLATE} | .items[] | select([.kind] | inside([\"Deployment\", \"DeploymentConfig\"])).metadata.name //empty")"

          # Follow any active rollouts; temporary support for DeploymentConfigs
          if [ ! -z "${DDC}" ]&&[ ! -z $(oc get deployment ${DDC} -o name --ignore-not-found) ]; then
            oc rollout status deployment/${DDC} -w
          elif [ ! -z "${DDC}" ]&&[ ! -z $(oc get deploymentconfig ${DDC} -o name --ignore-not-found) ]; then
            oc rollout status deploymentconfig/${DDC} -w
          fi

    - uses: bcgov/action-oc-runner@v0.3.0
      with:
        oc_namespace: ${{ inputs.oc_namespace }}
        oc_token: ${{ inputs.oc_token }}
        oc_server: ${{ inputs.oc_server }}
        triggers: ${{ inputs.triggers }}
        commands: |
          # Expand for route verification

          # Process template, consuming variables/parameters
          TEMPLATE="$(oc process -f ${{ inputs.file }} ${{ inputs.parameters }} --local)"

          # Output URL (host + path), but only if ROUTE_HOST is populated
          ROUTE_HOST=$(jq -rn "${TEMPLATE} | .items[] | select(.kind==\"Route\").spec.host //empty")
          if [ ! -z ${ROUTE_HOST} ]; then
            # Path from inputs takes priority over template
            ROUTE_PATH=${{ inputs.verification_path }}
            [ ! -z ${ROUTE_PATH} ]|| \
              ROUTE_PATH=$(jq -rn "${TEMPLATE} | .items[] | select(.kind==\"Route\").spec.path //empty")

            # Remove any duplicate slashes and pass to GITHUB_OUTPUT
            URL=$(echo "${ROUTE_HOST}/${ROUTE_PATH}" | sed 's // / g')
          fi

          # Check for URL (route + path)
          URL_HOST_PATH=${URL:-}
          if [ -z "${URL_HOST_PATH}" ]; then
            echo "No route found. Skipping."
            exit 0
          fi
          echo -e "URL: http://${URL_HOST_PATH}"

          # Curl and verify
          TRIES="${{ inputs.verification_retry_attempts }} || 3"
          SECONDS="${{ inputs.verification_retry_seconds }} || 10"
          for (( i=0; i<"${TRIES}"; i++ )); do
            HTTP_CODE=$(curl -Lso /dev/null -w "%{http_code}" "${URL_HOST_PATH}")
            if [ "${HTTP_CODE}" -eq 200 ]; then
              echo -e "Route verification successful!\n"
              exit 0
            fi
            echo -e "HTTP_CODE:${HTTP_CODE}, Try: #${i}"
            sleep "${SECONDS}"
          done
          echo -e "\nRoute verification failed"
          exit 1
    
    - uses: bcgov/action-oc-runner@v0.3.0
      if: inputs.post_rollout != ''
      with:
        oc_namespace: ${{ inputs.oc_namespace }}
        oc_token: ${{ inputs.oc_token }}
        oc_server: ${{ inputs.oc_server }}
        triggers: ${{ inputs.triggers }}
        commands: |
          # Run post deployment command (optional)
          ${{ inputs.post_rollout }}

    - uses: bcgov/action-oc-runner@v0.3.0
      if: inputs.delete_completed == 'true'
      with:
        oc_namespace: ${{ inputs.oc_namespace }}
        oc_token: ${{ inputs.oc_token }}
        oc_server: ${{ inputs.oc_server }}
        triggers: ${{ inputs.triggers }}
        commands: |
          # Cleanup completed pods
          oc delete po --field-selector=status.phase==Succeeded

    # Action repo needs to be present for cleanup/tests
    - name: Checkout local repo to make sure action.yml is present
      if: github.repository != inputs.repository
      uses: actions/checkout@v4