action.yml

name: OpenShift Deployer
description: OpenShift deployer with route verification
branding:
  icon: package
  color: blue

inputs:
  ### Required
  file:
    description: Template file (e.g. frontend/openshift.deploy.yml)
    required: true
  oc_namespace:
    description: OpenShift namespace (e.g. abc123-dev)
    required: true
  oc_server:
    description: OpenShift server (e.g. https://api.silver.devops.gov.bc.ca:6443)
    required: true
  oc_token:
    description: OpenShift access token
    required: true
  overwrite:
    description: Replace existing objects/artifacts? (true|false)
    required: true

  ### Typical / recommended
  oc_version:
    description: Non-default OpenShift version; e.g. 4.13
  parameters:
    description: Template parameters/variables to pass (e.g. -p ZONE=...)
  post_rollout:
    description: Post deployment command; e.g. oc create job "thing-$(date +%s)" --from=cronjob/thing
  timeout:
    description: Timeout for deployment. [default=15m]
    default: "15m"
  triggers:
    description: Omit to always build, otherwise trigger by path; e.g. ('./backend/', './frontend/)
  verification_path:
    description: Sets the health endpoint to be used for verification, does not need '/'
    default: ""

  ### Usually a bad idea / not recommended
  delete_completed:
    description: Delete completed pods
    default: true
  diff_branch:
    description: Branch to diff against
    default: ${{ github.event.repository.default_branch }}
  repository:
    description: Optionally, specify a different repo to clone
    default: ${{ github.repository }}

  verification_retry_attempts:
    description: Number of times to attempt deployment verification
    default: "3"
  verification_retry_seconds:
    description: Seconds to wait between deployment verification attempts
    default: "10"

  ### Deprecated
  # All penetration tests have been deprecated in favour of scheduled jobs
  penetration_test:
    default: false
  # penetration_test_fail:
  # penetration_test_create_issue:
  # penetration_test_token:
  # penetration_test_artifact:
  # penetration_test_issue:

outputs:
  triggered:
    description: Did a deployment trigger?  [true|false]
    value: ${{ steps.diff.outputs.triggered }}

runs:
  using: composite
  steps:
    # Notify about bugs and deprecations
    - shell: bash
      run: |
        # Notify about bugs and deprecations
        set -eu

        # Bug mitigation - OpenShift hates images with capitals in org/repo names
        REPO=${{ inputs.repository }}
        if [[ $REPO != ${REPO,,} ]]; then
          echo -e "An OpenShift bug prevents capital letters in repo names.\n"
          echo -e "Please handle that using the `repository` parameter.\n"
          exit 1
        fi

        # Deprecation notices
        if [ ! -z ${{ inputs.penetration_test }} != "false" ]; then
          echo -e "All penetration testing has been deprecated.  Instead we recommend running in a scheduled job. \n"
          echo -e "Please see https://github.com/zaproxy/action-full-scan for the source action.\n"
          echo -e "An example of a scheduled job with ZAP penetration testing can be found here:"
          echo -e "  => https://github.com/bcgov/quickstart-openshift/blob/main/.github/workflows/scheduled.yml\n"
          exit 1
        fi

    # Send triggers to diff action
    - id: diff
      uses: bcgov-nr/action-diff-triggers@v0.2.0
      with:
        triggers: ${{ inputs.triggers }}
        diff_branch: ${{ inputs.diff_branch }}

    # Override OpenShift version, if specified
    - name: Install CLI tools from OpenShift Mirror
      uses: redhat-actions/openshift-tools-installer@v1
      with:
        oc: ${{ inputs.oc_version || '4' }}

    # Process variables and inputs
    # Remote/override repo is required if one has been specified (input)
    - name: Checkout remote/override repo
      if: ${{ github.repository }} != ${{ inputs.repository }}
      uses: actions/checkout@v4
      with:
        repository: ${{ inputs.repository }}
    - id: vars
      shell: bash
      run: |
        # Expand for inputs and variables
        set -eu

        # Process template, consuming variables/parameters
        TEMPLATE="$(oc process -f ${{ inputs.file }} ${{ inputs.parameters }} --local)"

        # ImageStream, Deployment and Route Host from template (note: DeploymentConfig is deprecated, but still supported)
        DDC=$(jq -rn "${TEMPLATE} | .items[] | select([.kind] | inside([\"Deployment\", \"DeploymentConfig\"])).metadata.name //empty")
        IS=$(jq -rn "${TEMPLATE} | .items[] | select(.kind==\"ImageStream\").metadata.name //empty")
        echo imageStream=${IS} >> $GITHUB_OUTPUT
        echo deployment=${DDC} >> $GITHUB_OUTPUT

        # Output URL (host + path), but only if ROUTE_HOST is populated
        ROUTE_HOST=$(jq -rn "${TEMPLATE} | .items[] | select(.kind==\"Route\").spec.host //empty")
        if [ ! -z ${ROUTE_HOST} ]; then
          # Path from inputs takes priority over template
          ROUTE_PATH=${{ inputs.verification_path }}
          [ ! -z ${ROUTE_PATH} ]|| \
            ROUTE_PATH=$(jq -rn "${TEMPLATE} | .items[] | select(.kind==\"Route\").spec.path //empty")

          # Remove any duplicate slashes and pass to GITHUB_OUTPUT
          echo url="${ROUTE_HOST}/${ROUTE_PATH}" | sed 's // / g' >> $GITHUB_OUTPUT
        fi

    - name: Deploy
      if: steps.diff.outputs.triggered == 'true'
      shell: bash
      run: |
        # Expand for deployment steps

        # Allow pipefail, since we could be catching oc create errors
        set +o pipefail

        oc login --token=${{ inputs.oc_token }} --server=${{ inputs.oc_server }}
        oc project ${{ inputs.oc_namespace }} #Safeguard!

        # Clean any previous ImageStreams
        IFS=" " read -ra IS <<< "${{ steps.vars.outputs.imageStream }}"
        for i in "${IS[@]}"
        do
          [ ! $(oc get is -o name | grep ^imagestream.image.openshift.io/${i}$) ]|| oc delete is/${i}
        done

        # Apply (overwrites) or create (does not overwrite) using processed template
        TEMPLATE="$(oc process -f ${{ inputs.file }} ${{ inputs.parameters }} --local)"
        if [ "${{ inputs.overwrite }}" == "true" ]; then
          oc apply --timeout=${{ inputs.timeout || '15m' }} -f - <<< "${TEMPLATE}"
        else
          # Suppress AlreadyExists errors and expected failure
          oc create -f - 2>&1 <<< "${TEMPLATE}" | sed 's/.*: //'
        fi

        # Follow any active rollouts; temporary support for DeploymentConfigs
        DDC=${{ steps.vars.outputs.deployment }}
        if [ ! -z "${DDC}" ]&&[ ! -z $(oc get deployment ${DDC} -o name --ignore-not-found) ]; then
          # oc rollout restart deployment/${DDC}
          oc rollout status deployment/${DDC} -w
        elif [ ! -z "${DDC}" ]&&[ ! -z $(oc get deploymentconfig ${DDC} -o name --ignore-not-found) ]; then
          oc rollout status deploymentconfig/${DDC} -w
        fi
        
    - name: Route Verification
      if: steps.vars.outputs.url &&
        ( steps.diff.outputs.triggered == 'true' )
      shell: bash
      run: |
        # Expand for route verification

        # Check for URL (route + path)
        URL_HOST_PATH=${{ steps.vars.outputs.url }}
        if [ -z "${URL_HOST_PATH}" ]; then
          echo "No route found. Skipping."
          exit 0
        fi
        echo -e "URL: http://${URL_HOST_PATH}"

        # Curl and verify
        TRIES="${{ inputs.verification_retry_attempts }} || 3"
        SECONDS="${{ inputs.verification_retry_seconds }} || 10"
        for (( i=0; i<"${TRIES}"; i++ )); do
          HTTP_CODE=$(curl -Lso /dev/null -w "%{http_code}" "${URL_HOST_PATH}")
          if [ "${HTTP_CODE}" -eq 200 ]; then
            echo -e "Route verification successful!\n"
            exit 0
          fi
          echo -e "HTTP_CODE:${HTTP_CODE}, Try: #${i}"
          sleep "${SECONDS}"
        done
        echo -e "\nRoute verification failed"
        exit 1
    
    - name: Post-Deployment
      if: inputs.post_rollout != '' && steps.diff.outputs.triggered == 'true'
      shell: bash
      run: |
        # Expand for post-deployment steps (optional)

        # Allow pipefail, since we could be catching oc create errors
        set +o pipefail

        oc login --token=${{ inputs.oc_token }} --server=${{ inputs.oc_server }}
        oc project ${{ inputs.oc_namespace }} #Safeguard!

        # Run post deployment command
        ${{ inputs.post_rollout }}

    - if: inputs.delete_completed == 'true' && steps.diff.outputs.triggered == 'true'
      shell: bash
      run: |
        # Expand for succeeded pod cleanup (optional)

        # Pod Cleanup
        oc login --token=${{ inputs.oc_token }} --server=${{ inputs.oc_server }}
        oc project ${{ inputs.oc_namespace }} #Safeguard!

        # Cleanup completed pods
        oc delete po --field-selector=status.phase==Succeeded

    # Action repo needs to be present for cleanup/tests
    - name: Checkout local repo to make sure action.yml is present
      if: ${{ github.repository }} != ${{ inputs.repository }}
      uses: actions/checkout@v4