action.yml

name: OpenShift Deployer
description: OpenShift deployer with route verification or penetration testing
branding:
  icon: package
  color: blue

inputs:
  ### Required
  file:
    description: Template file (e.g. frontend/openshift.deploy.yml)
    required: true
  oc_namespace:
    description: OpenShift namespace (e.g. abc123-dev)
    required: true
  oc_server:
    description: OpenShift server (e.g. https://api.silver.devops.gov.bc.ca:6443)
    required: true
  oc_token:
    description: OpenShift access token
    required: true
  overwrite:
    description: Replace existing objects/artifacts? (true|false)
    required: true

  ### Typical / recommended
  name:
    description: Name for any penetration test issues or artifacts; e.g. frontend
    default: "name_unset"
  parameters:
    description: Template parameters/variables to pass (e.g. -p ZONE=...)
  penetration_test:
    description: Run a ZAProxy penetration test against any routes? [true|false]
    default: "false"
  penetration_test_fail:
    description: Allow ZAProxy alerts to fail the workflow? [true|false]
    default: "false"
  timeout:
    description: Timeout for deployment. [default=15m]
    default: "15m"
  triggers:
    description: Omit to always build, otherwise trigger by path; e.g. ('./backend/', './frontend/)
  verification_path:
    description: Sets the health endpoint to be used during check stage, does not require the '/' at the begining
    default: ""

  ### Usually a bad idea / not recommended
  delete_completed:
    description: Delete completed pods
    default: true
  diff_branch:
    description: Branch to diff against
    default: ${{ github.event.repository.default_branch }}
  repository:
    description: Optionally, specify a different repo to clone
    default: ${{ github.repository }}
  penetration_test_create_issue:
    description: Create an issue with penetration test results?  [true|false]
    default: "true"
  penetration_test_token:
    description: Specify token (GH or PAT), instead of inheriting one from the calling workflow
    default: ${{ github.token }}
  verification_retry_attempts:
    description: Number of times to attempt deployment verification
    default: "3"
  verification_retry_seconds:
    description: Seconds to wait between deployment verification attempts
    default: "10"

  ### Deprecated
  penetration_test_artifact:
    description: Provide a name to attach ZAProxy scan artifacts to workflows; e.g. frontend, backend
  penetration_test_issue:
    description: Provide a name to enable ZAProxy issue creation; e.g. frontend, backend

runs:
  using: composite
  steps:
    # Notify about bugs and deprecations
    - shell: bash
      run: |
        # Notify about bugs and deprecations
        set -eu

        # Bug mitigation - OpenShift hates images with capitals in org/repo names
        REPO=${{ inputs.repository }}
        if [[ $REPO != ${REPO,,} ]]; then
          echo -e "An OpenShift bug prevents capital letters in repo names.\n"
          echo -e "Please handle that using the `repository` parameter.\n"
          exit 1
        fi

        # Deprecation notices
        if [ ! -z ${{ inputs.penetration_test_artifact }} ]||[ ! -z ${{ inputs.penetration_test_issue }} ]; then
          echo -e "Params penetration_test_artifact and penetration_test_issue have been deprecated. \n"
          echo -e "Please use param: name instead.  Exiting.\n"
          exit 1
        fi

    # Current/calling repo is required for diff/triggers
    - uses: actions/checkout@v4
    - id: triggers
      shell: bash
      run: |
        # Process triggers
        set -eu

        # Triggers
        TRIGGERS=${{ inputs.triggers }}
        if [ -z "${TRIGGERS}" ]; then
          echo "Triggers omitted, deployment required"
          echo "triggered=true" >> $GITHUB_OUTPUT
          exit 0
        else
          echo "Processing triggers"
          git fetch origin "${{ inputs.diff_branch }}"
          while read -r check; do
            for t in "${TRIGGERS[@]}"; do
              if [[ "${check}" =~ "${t}" ]]; then
                  echo -e "Triggered: ${t}\n --> ${check}"
                  echo "triggered=true" >> $GITHUB_OUTPUT
                  exit 0
              fi
            done
          done < <(git diff origin/"${{ inputs.diff_branch }}" --name-only)
        fi
        echo "Triggers not matched, deployment skipped"

    # Process variables and inputs
    # Remote/override repo is required if one has been specified (input)
    - name: Checkout remote/override repo
      if: ${{ github.repository }} != ${{ inputs.repository }}
      uses: actions/checkout@v4
      with:
        repository: ${{ inputs.repository }}
    - id: vars
      shell: bash
      run: |
        # Expand for inputs and variables
        set -eu

        # Process template, consuming variables/parameters
        TEMPLATE="$(oc process -f ${{ inputs.file }} ${{ inputs.parameters }} --local)"

        # ImageStream, DeploymentConfig and Route Host from template
        DC=$(jq -rn "${TEMPLATE} | .items[] | select(.kind==\"DeploymentConfig\").metadata.name //empty")
        IS=$(jq -rn "${TEMPLATE} | .items[] | select(.kind==\"ImageStream\").metadata.name //empty")
        echo imageStream=${IS} >> $GITHUB_OUTPUT
        echo deploymentConfig=${DC} >> $GITHUB_OUTPUT

        # Output URL (host + path), but only if ROUTE_HOST is populated
        ROUTE_HOST=$(jq -rn "${TEMPLATE} | .items[] | select(.kind==\"Route\").spec.host //empty")
        if [ ! -z ${ROUTE_HOST} ]; then
          # Path from inputs takes priority over template
          ROUTE_PATH=${{ inputs.verification_path }}
          [ ! -z ${ROUTE_PATH} ]|| \
            ROUTE_PATH=$(jq -rn "${TEMPLATE} | .items[] | select(.kind==\"Route\").spec.path //empty")

          # Remove any duplicate slashes and pass to GITHUB_OUTPUT
          echo url="${ROUTE_HOST}/${ROUTE_PATH}" | sed 's // / g' >> $GITHUB_OUTPUT
        fi

    - name: Deploy
      if: steps.triggers.outputs.triggered == 'true'
      shell: bash
      run: |
        # Expand for deployment steps

        # Allow pipefail, since we could be catching oc create errors
        set +o pipefail

        # Login to OpenShift (NOTE: project command is a safeguard)
        oc login --token=${{ inputs.oc_token }} --server=${{ inputs.oc_server }}
        oc project ${{ inputs.oc_namespace }}

        # Clean previous image, if any
        IFS=" " read -ra IS <<< "${{ steps.vars.outputs.imageStream }}"
        for i in "${IS[@]}"
        do
          [ ! $(oc get is -o name | grep ^imagestream.image.openshift.io/${i}$) ]|| oc delete is/${i}
        done

        # Apply (overwrites) or create (does not overwrite) using processed template
        TEMPLATE="$(oc process -f ${{ inputs.file }} ${{ inputs.parameters }} --local)"
        if [ "${{ inputs.overwrite }}" == "true" ]; then
          oc apply --timeout=${{ inputs.timeout }} -f - <<< "${TEMPLATE}"
        else
          # Suppress AlreadyExists errors and expected failure
          oc create -f - 2>&1 <<< "${TEMPLATE}" | sed 's/.*: //'
        fi

        # Follow any active rollouts (see deploymentconfigs)
        DC=${{ steps.vars.outputs.deploymentConfig }}
        [ -z "${DC}" ]|| oc rollout status dc/${DC} -w

    - name: Route Verification
      if: steps.vars.outputs.url &&
        ( steps.triggers.outputs.triggered == 'true' )&&
        ( inputs.penetration_test != 'true' )
      shell: bash
      run: |
        # Expand for route verification

        # Check for URL (route + path)
        URL_HOST_PATH=${{ steps.vars.outputs.url }}
        if [ -z "${URL_HOST_PATH}" ]; then
          echo "No route found. Skipping."
          exit 0
        fi
        echo -e "URL: ${URL_HOST_PATH}"

        # Curl and verify
        TRIES="${{ inputs.verification_retry_attempts }}"
        SECONDS="${{ inputs.verification_retry_seconds }}"
        for (( i=0; i<"${TRIES}"; i++ )); do
          HTTP_CODE=$(curl -Lso /dev/null -w "%{http_code}" "${URL_HOST_PATH}")
          if [ "${HTTP_CODE}" -eq 200 ]; then
            echo -e "Route verification successful!\n"
            exit 0
          fi
          echo -e "HTTP_CODE:${HTTP_CODE}, Try: #${i}"
          sleep "${SECONDS}"
        done
        echo -e "\nRoute verification failed"
        exit 1

    - name: Penetration Test
      if: steps.vars.outputs.url &&
        ( steps.triggers.outputs.triggered == 'true' )&&
        ( inputs.penetration_test == 'true' )
      uses: zaproxy/action-full-scan@v0.8.0
      with:
        allow_issue_writing: "${{ inputs.penetration_test_create_issue }}"
        artifact_name: "zap_${{ inputs.name }}"
        cmd_options: "-a"
        fail_action: "${{ inputs.penetration_test_fail }}"
        issue_title: "ZAP: ${{ inputs.name }}"
        target: https://${{ steps.vars.outputs.url }}
        token: "${{ inputs.penetration_test_token }}"

    - if: inputs.delete_completed == 'true'
      shell: bash
      run: |
        # Pod Cleanup

        # Login to OpenShift (NOTE: project command is a safeguard)
        oc login --token=${{ inputs.oc_token }} --server=${{ inputs.oc_server }}
        oc project ${{ inputs.oc_namespace }}

        # Cleanup completed pods
        oc delete po --field-selector=status.phase==Succeeded

    # Action repo needs to be present for cleanup/tests
    - name: Checkout local repo to make sure action.yml is present
      if: ${{ github.repository }} != ${{ inputs.repository }}
      uses: actions/checkout@v4