client-refresh-environment.yaml

name: Refresh Environment

# This workflow is meant to be called from other repositories' workflows to refresh/recalculate and apply
# version changes to an environment. This can be used to make a long-lived BEE get the latest versions, etc.
#
# Note that this workflow cannot modify anything marked within Sherlock as requiring suitability.
#
# The caller repository must have Workload Identity Federation configured to allow impersonation of the
# "gha-iap-accessor@dsp-devops-super-prod.iam.gserviceaccount.com" service account; steps 1 and 2 of the documentation:
# https://docs.google.com/document/d/1bnhDmWQHAMat_Saoa_z28FHwXmGWw6kywjdbKf208h4/edit
#
# With that configured, here's how you can call this workflow:
# ```yaml
# jobs:
#
#   refresh-environment:
#     uses: broadinstitute/sherlock/.github/workflows/client-refresh-environment.yaml@main
#     with:
#       environment-name: '<the-environment-to-update>'
#     permissions:
#       id-token: 'write'
#
# ```
#
# If you'd like to automatically sync the environment--meaning deploy whatever changes were made--you can provide
# a custom GitHub token to the workflow. It cannot be default one in the workflow as default tokens cannot use
# the workflow dispatch API.
#
# This can be helpful if the rest of your workflow requires the environment to be fully up to date.
#
# An example, assuming your repo has the BROADBOT_TOKEN available:
# ```yaml
# jobs:
#
#   refresh-environment:
#     uses: broadinstitute/sherlock/.github/workflows/client-refresh-environment.yaml@main
#     with:
#       environment-name: '<the-environment-to-update>'
#     permissions:
#       id-token: 'write'
#     secrets:
#       sync-git-token: ${{ secrets.BROADBOT_TOKEN }}
#
#   <your-existing-job-id>:
#     needs: refresh-environment
#     steps:
#       # ... (The rest of your existing job can stay the same)
#
# ```


on:
  workflow_call:

    secrets:
      sync-git-token:
        required: false
        description: "When provided, finish by calling out to terra-github-workflows to sync the affected chart release"

    inputs:

      ##
      ## Required configuration:
      ##

      environment-name:
        required: true
        type: string
        description: "The name of the environment to update"

env:
  SHERLOCK_PROD_URL: 'https://sherlock.dsp-devops-prod.broadinstitute.org'
  BEEHIVE_PROD_URL: 'https://beehive.dsp-devops-prod.broadinsitute.org'
  BEEHIVE_PROD_VANITY_URL: 'https://broad.io/beehive'

jobs:
  refresh:
    runs-on: ubuntu-22.04
    outputs:
      changesets: ${{ steps.changesets.outputs.changesets }}
    permissions:
      id-token: 'write'
    
    steps:

      ##
      ## Handle required:
      ##

      - name: "Write Request"
        shell: bash
        run: |
          echo '{
            "environments": [
              {
                "environment": "${{ inputs.environment-name }}"
              }
            ]
          }' > "$RUNNER_TEMP/body.json"

      ##
      ## Handle Sherlock:
      ##

      - name: "Log Request Body"
        shell: bash
        run: |
          cat "$RUNNER_TEMP/body.json"
          echo "## Set ${{ inputs.environment-name }}/${{ inputs.chart-name }} to ${{ inputs.new-version }} Sherlock" >> $GITHUB_STEP_SUMMARY

      - name: "Authenticate to GCP"
        id: 'iap_auth'
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: 'projects/1038484894585/locations/global/workloadIdentityPools/github-wi-pool/providers/github-wi-provider'
          service_account: 'gha-iap-accessor@dsp-devops-super-prod.iam.gserviceaccount.com'
          token_format: 'id_token'
          id_token_audience: '257801540345-1gqi6qi66bjbssbv01horu9243el2r8b.apps.googleusercontent.com'
          id_token_include_email: true
          create_credentials_file: false
          export_environment_variables: false

      - name: "Generate GHA OIDC Token"
        id: 'gha_auth'
        uses: actions/github-script@v7
        with:
          script: core.setOutput('id_token', await core.getIDToken())
      
      - name: "Send to Sherlock"
        shell: bash
        run: |
          set -ex
          curl --fail-with-body -X 'POST' \
            "$SHERLOCK_PROD_URL/api/changesets/procedures/v3/plan-and-apply" \
            -H 'Content-Type: application/json' \
            -H 'Authorization: Bearer ${{ steps.iap_auth.outputs.id_token }}' \
            -H 'X-GHA-OIDC-JWT: ${{ steps.gha_auth.outputs.id_token }}' \
            -d "@$RUNNER_TEMP/body.json" | jq > $RUNNER_TEMP/response.json
          cat $RUNNER_TEMP/response.json

      - name: "Parse changesets"
        id: changesets
        shell: bash
        run: |
          set -ex
          echo "changesets=$(cat $RUNNER_TEMP/response.json | jq -r 'map(.id) | join(",")')" >> $GITHUB_OUTPUT

  can-sync:
    runs-on: ubuntu-22.04
    outputs:
      can-sync: ${{ steps.check.outputs.can-sync }}
    steps:
    - name: "Check Token"
      id: check
      shell: bash
      run: |
        if [ -z "${{ secrets.sync-git-token }}" ]
        then
          echo "can-sync=false" >> $GITHUB_OUTPUT
        else
          echo "can-sync=true" >> $GITHUB_OUTPUT
        fi
  
  get-environment:
    needs: can-sync
    if: ${{ needs.can-sync.outputs.can-sync == 'true' }}
    uses: ./.github/workflows/client-get-environment.yaml
    permissions:
      id-token: 'write'
    with:
      environment-name: ${{ inputs.environment-name }}

  sync:
    needs: [refresh, get-environment, can-sync]
    if: ${{ needs.can-sync.outputs.can-sync == 'true' && needs.get-environment.outputs.lifecycle != 'template' }}
    runs-on: ubuntu-latest
    steps:

      ##
      ## Handle syncing:
      ##

      - name: "Dispatch to terra-github-workflows"
        uses: broadinstitute/workflow-dispatch@v4
        with: 
          repo: broadinstitute/terra-github-workflows
          workflow: .github/workflows/sync-environment.yaml
          ref: refs/heads/main
          token: ${{ secrets.sync-git-token }}
          inputs: '{ "environment-names": "${{ inputs.environment-name }}", "refresh-only": "false" }'

  report-workflow:
    uses: ./.github/workflows/client-report-workflow.yaml
    needs: refresh
    with:
      relates-to-environments: ${{ inputs.environment-name }}
      relates-to-changesets: ${{ needs.refresh.outputs.changesets }}
    permissions:
      id-token: write