client-set-environment-app-version.yaml

name: Set Environment App Version

# This workflow is meant to be called from other repositories' workflows to set a Sherlock environment to have a
# specific version for some app.
#
# Note that this workflow cannot modify anything marked within Sherlock as requiring suitability.
#
# The caller repository must have Workload Identity Federation configured to allow impersonation of the
# "gha-iap-accessor@dsp-devops-super-prod.iam.gserviceaccount.com" service account; steps 1 and 2 of the documentation:
# https://docs.google.com/document/d/1bnhDmWQHAMat_Saoa_z28FHwXmGWw6kywjdbKf208h4/edit
#
# With that configured, here's how you can call this workflow from whatever workflow currently publishes the app:
# ```yaml
# jobs:
#
#   <your-existing-job-id>:
#     # Output the version from your existing job's tag/bump step, something like this:
#     outputs:
#       tag: ${{ steps.tag.outputs.tag }}
#     steps:
#       # ... (The rest of your existing job can stay the same)
#
#   set-app-version-in-environment:
#     uses: broadinstitute/sherlock/.github/workflows/client-set-environment-app-version.yaml@main
#     needs: <your-existing-job-id>
#     with:
#       new-version: ${{ needs.<your-existing-job-id>.outputs.tag }}
#       chart-name: '<your-app-helm-chart-name>'
#       environment-name: '<the-environment-to-update>'
#     permissions:
#       id-token: 'write'
# ```
#
# If you'd like to automatically sync the environment--meaning deploy whatever changes were made--you can provide
# a custom GitHub token to the workflow. It cannot be default one in the workflow as default tokens cannot use
# the workflow dispatch API.
#
# An example, assuming your repo has the BROADBOT_TOKEN available:
# ```yaml
# jobs:
#
#   <your-existing-job-id>:
#     # Output the version from your existing job's tag/bump step, something like this:
#     outputs:
#       tag: ${{ steps.tag.outputs.tag }}
#     steps:
#       # ... (The rest of your existing job can stay the same)
#
#   set-app-version-in-environment:
#     uses: broadinstitute/sherlock/.github/workflows/client-set-environment-app-version.yaml@main
#     needs: <your-existing-job-id>
#     with:
#       new-version: ${{ needs.<your-existing-job-id>.outputs.tag }}
#       chart-name: '<your-app-helm-chart-name>'
#       environment-name: '<the-environment-to-update>'
#     secrets:
#       sync-git-token: ${{ secrets.BROADBOT_TOKEN }}
#     permissions:
#       id-token: 'write'
# ```


on:
  workflow_call:

    secrets:
      sync-git-token:
        required: false
        description: "When provided, finish by calling out to terra-github-workflows to sync the affected chart release"

    inputs:

      ##
      ## Required configuration:
      ##

      new-version:
        required: true
        type: string
        description: "The app's new semantic version to record in Sherlock"
      chart-name:
        required: true
        type: string
        description: "The name of the Helm Chart that deploys this app"
      environment-name:
        required: true
        type: string
        description: "The name of the environment to update"

env:
  SHERLOCK_PROD_URL: 'https://sherlock.dsp-devops-prod.broadinstitute.org'
  BEEHIVE_PROD_URL: 'https://beehive.dsp-devops-prod.broadinsitute.org'
  BEEHIVE_PROD_VANITY_URL: 'https://broad.io/beehive'

jobs:
  get-chart-release:
    uses: ./.github/workflows/client-get-chart-release.yaml
    permissions:
      id-token: 'write'
    with:
      chart-release-name: ${{ inputs.environment-name }}/${{ inputs.chart-name }}

  set-version:
    needs: get-chart-release
    runs-on: ubuntu-22.04
    outputs:
      changesets: ${{ steps.changesets.outputs.changesets }}
    permissions:
      id-token: 'write'
    
    steps:

      ##
      ## Handle required:
      ##

      - name: "Write Request"
        shell: bash
        run: |
          echo '{
            "chartReleases": [
              {
                "chartRelease": "${{ inputs.environment-name }}/${{ inputs.chart-name }}",
                "toAppVersionResolver": "exact",
                "toAppVersionExact": "${{ inputs.new-version }}"
              }
            ]
          }' > "$RUNNER_TEMP/body.json"

      ##
      ## Handle Sherlock:
      ##

      - name: "Log Request Body"
        shell: bash
        run: |
          cat "$RUNNER_TEMP/body.json"
          echo "## Set ${{ inputs.environment-name }}/${{ inputs.chart-name }} to ${{ inputs.chart-name }}/${{ inputs.new-version }} in Sherlock" >> $GITHUB_STEP_SUMMARY

      - name: "Authenticate to GCP"
        id: 'iap_auth'
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: 'projects/1038484894585/locations/global/workloadIdentityPools/github-wi-pool/providers/github-wi-provider'
          service_account: 'gha-iap-accessor@dsp-devops-super-prod.iam.gserviceaccount.com'
          token_format: 'id_token'
          id_token_audience: '257801540345-1gqi6qi66bjbssbv01horu9243el2r8b.apps.googleusercontent.com'
          id_token_include_email: true
          create_credentials_file: false
          export_environment_variables: false

      - name: "Generate GHA OIDC Token"
        id: 'gha_auth'
        uses: actions/github-script@v7
        with:
          script: core.setOutput('id_token', await core.getIDToken())
      
      - name: "Send to Sherlock"
        shell: bash
        run: |
          set -ex
          curl --fail-with-body -X 'POST' \
            "$SHERLOCK_PROD_URL/api/changesets/procedures/v3/plan-and-apply" \
            -H 'Content-Type: application/json' \
            -H 'Authorization: Bearer ${{ steps.iap_auth.outputs.id_token }}' \
            -H 'X-GHA-OIDC-JWT: ${{ steps.gha_auth.outputs.id_token }}' \
            -d "@$RUNNER_TEMP/body.json" | jq > $RUNNER_TEMP/response.json
          cat $RUNNER_TEMP/response.json
          echo "### Available in Beehive at $BEEHIVE_PROD_VANITY_URL/r/chart-release/${{ inputs.environment-name }}/${{ inputs.chart-name }}" >> $GITHUB_STEP_SUMMARY

      - name: "Parse changesets"
        id: changesets
        shell: bash
        run: |
          set -ex
          echo "changesets=$(cat $RUNNER_TEMP/response.json | jq -r 'map(.id) | join(",")')" >> $GITHUB_OUTPUT

  report-workflow:
    uses: ./.github/workflows/client-report-workflow.yaml
    needs: set-version
    with:
      relates-to-changesets: ${{ needs.set-version.outputs.changesets }}
    permissions:
      id-token: write

  can-sync:
    runs-on: ubuntu-22.04
    outputs:
      can-sync: ${{ steps.check.outputs.can-sync }}
    steps:
    - name: "Check Token"
      id: check
      shell: bash
      run: |
        if [ -z "${{ secrets.sync-git-token }}" ]
        then
          echo "can-sync=false" >> $GITHUB_OUTPUT
        else
          echo "can-sync=true" >> $GITHUB_OUTPUT
        fi

  get-environment:
    needs: can-sync
    if: ${{ needs.can-sync.outputs.can-sync == 'true' }}
    uses: ./.github/workflows/client-get-environment.yaml
    permissions:
      id-token: 'write'
    with:
      environment-name: ${{ inputs.environment-name }}

  sync:
    needs: [set-version, get-environment, get-chart-release, can-sync]
    if: ${{ needs.can-sync.outputs.can-sync == 'true' && needs.get-environment.outputs.lifecycle != 'template' }}
    runs-on: ubuntu-latest
    steps:

      ##
      ## Handle syncing:
      ##

      - name: "Dispatch to terra-github-workflows"
        uses: broadinstitute/workflow-dispatch@v4
        with: 
          repo: broadinstitute/terra-github-workflows
          workflow: .github/workflows/sync-release.yaml
          ref: refs/heads/main
          token: ${{ secrets.sync-git-token }}
          inputs: '{ "chart-release-names": "${{ needs.get-chart-release.outputs.name }}", "changeset-ids": "${{ needs.set-version.outputs.changesets }}", "refresh-only": "false" }'