Initial version of reusable workflow for trigger-gitlab-pipeline

Author: Jauler

.github/workflows/trigger-gitlab-pipeline.yml

@@ -0,0 +1,89 @@
+name: Trigger GitLab pipeline
+on:
+  workflow_call:
+    inputs:
+      triggered-ref:
+        description: 'GitLab project ref to trigger'
+        required: true
+        type: string
+      schedule:
+        description: 'Indication if it is a automatically scheduled request'
+        required: false
+        default: false
+        type: boolean
+      cancel-outdated-pipelines:
+        description: 'If set to true, it will cancel previous pipelines that are running for the same github ref'
+        required: false
+        default: true
+        type: boolean
+    secrets:
+      ci-api-v4-url:
+        description: 'GitLab API v4 root URL'
+        required: true
+      access-token:
+        description: 'GitLab API access token'
+        required: true
+      trigger-token:
+        description: 'GitLab API trigger token'
+        required: true
+      project-id:
+        description: 'GitLab project ID'
+        required: true
+
+jobs:
+  authorize:
+    environment:  ${{ (github.event_name == 'pull_request_target' &&
+      github.event.pull_request.head.repo.full_name != github.repository) &&
+      'External' || 'Internal' }}
+    runs-on: ubuntu-latest
+    id: authorize-job
+    steps:
+      - name: Authorization confirmation
+        run: echo "Authorized the job to run" # This step will only execute if
+                                              # the pipeline has necessary approvals to run
+
+  # We need workflow resolution to run on non-private runner due to required dependencies
+  # missing in private runner. Additionally for clarity it is separated into separate job
+  resolve-workflow-ref:
+    needs: authorize
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get Workflow Version
+        uses: canonical/get-workflow-version-action@a5d53b08d254a157ea441c9819ea5002ffc12edc
+        id: workflow-ref
+        with:
+          repository-name: NordSecurity/trigger-gitlab-pipeline
+          file-name: .github/workflows/trigger-gitlab-pipeline.yml
+    outputs:
+      workflow-ref: ${{ steps.workflow-ref.output.sha }}
+
+  trigger-gitlab-pipeline:
+    # In the current form, "authorize" job is implicitly required by trigger-gitlab-pipeline job
+    # To make this dependency super explicit and a bit more future-proof against modifications of
+    # this workflow - it is stated explicitly in the list of dependencies, even though it is
+    # redundant
+    needs: [resolve-workflow-ref, authorize]
+    runs-on: [self-hosted, gitlab]
+    steps:
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+        with:
+          repository: NordSecurity/trigger-gitlab-pipeline
+          ref: ${{ needs.resolve-workflow-ref.outputs.workflow-ref }}
+      - uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
+        with:
+          node-version: 20
+      - name: Dependencies install
+        run: npm install
+      - name: Run triggering script
+        run: node index.js # It will not be accessible as of now, but it is enough for testing.
+        env:
+          TRIGGERED_REF: ${{ inputs.triggered-ref }}
+          SCHEDULE: ${{ inputs.schedule }}
+          CANCEL_OUTDATED_PIPELINES: ${{ inputs.cancel-outdated-pipelines }}
+          CI_API_V4_URL: ${{ secrets.ci-api-v4-url }}
+          ACCESS_TOKEN: ${{ secrets.access-token }}
+          TRIGGER_TOKEN: ${{ secrets.trigger-token }}
+          PROJECT_ID: ${{ secrets.project-id }}
+
+
+

index.js

@@ -115,15 +115,32 @@ async function execute (inputConfig, githubConfig) {
     return resp.id;
 }
 
+function getEnv (name) {
+    const val = process.env[name] || '';
+    if (!val) {
+        throw new Error(`Environment variable expected, but not supplied: ${name}`);
+    }
+    return val;
+}
+
+function getBooleanEnv (name) {
+    const trueValue = ['true', 'True', 'TRUE'];
+    const falseValue = ['false', 'False', 'FALSE'];
+    const val = getEnv(name);
+    if (trueValue.includes(val)) return true;
+    if (falseValue.includes(val)) return false;
+    throw new TypeError(`Input could not be converted to boolean value: ${name}`);
+}
+
 async function main () {
     const inputConfig = {
-        apiUrl: core.getInput('ci-api-v4-url', { required: true }),
-        accesToken: core.getInput('access-token', { required: true }),
-        triggerToken: core.getInput('trigger-token', { required: true }),
-        projectId: core.getInput('project-id', { required: true }),
-        triggeredRef: core.getInput('triggered-ref', { required: true }),
-        schedule: core.getBooleanInput('schedule', { required: false }),
-        cancelOutdatedPipelines: core.getBooleanInput('cancel-outdated-pipelines', { required: false })
+        apiUrl: getEnv('CI_API_V4_URL'),
+        accesToken: getEnv('ACCESS_TOKEN'),
+        triggerToken: getEnv('TRIGGER_TOKEN'),
+        projectId: getEnv('PROJECT_ID'),
+        triggeredRef: getEnv('TRIGGERED_REF'),
+        schedule: getBooleanEnv('SCHEDULE'),
+        cancelOutdatedPipelines: getBooleanEnv('CANCEL_OUTDATED_PIPELINES')
     };
 
     const githubConfig = {