deploy-chart.yml

# Reusable workflow: Deploy Helm chart
#
# Builds OCI images, releases a Helm chart and optionally triggers a
# follow-up deployment action (for example a repository-dispatch). This
# workflow supports multiple deployment types and is designed to be
# called via `workflow_call` from other workflows or repositories.
#
# Key features:
#
# - Builds OCI images using a separate reusable workflow.
# - Releases a Helm chart and injects image and placeholder values.
# - Supports configurable deployment actions (via `deploy-type` and
#   `deploy-parameters`).
# - Posts status and uses local actions via a self-checkout when needed.
---
name: Deploy chart

on:
  workflow_call:
    inputs:
      runs-on:
        description: |
          JSON array of runner(s) to use.
          See https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job.
        type: string
        default: '["ubuntu-latest"]'
        required: false
      environment:
        description: |
          Destination where to deploy given chart.
          Can be an environment name or an environment name with a dynamic identifier.
          Example: `review-apps:pr-1234`.
        type: string
        required: true
      tag:
        description: |
          Tag to use for the deployment.
          If not provided, will be set to the current commit SHA.
        type: string
        required: false
      url:
        description: |
          The URL which respond to deployed application.
          If not provided, will be set to the environment URL.
          URL can contains placeholders:
          - `{{ identifier }}`: will be replaced by the environment identifier.
          Example: `https://{{ identifier }}.my-application.com`.
        type: string
        required: false
      deploy-type:
        description: |
          Type of deployment to perform.
          Supported values:
          - [`helm-repository-dispatch`](../../actions/deploy/helm-repository-dispatch/README.md).
        type: string
        required: false
        default: helm-repository-dispatch
      deploy-parameters:
        description: |
          Inputs to pass to the deployment action.
          JSON object, depending on the deploy-type.
          For example, for `helm-repository-dispatch`:
          ```json
          {
            "repository": "my-org/my-repo"
          }
          ```
        type: string
      oci-registry:
        type: string
        description: "OCI registry where to pull and push images and chart."
        required: false
        default: ghcr.io
      images:
        description: |
          Images to build parameters.
          See https://github.com/hoverkraft-tech/ci-github-container/blob/main/.github/workflows/docker-build-images.md.
        type: string
        required: true
      chart-name:
        description: |
          Chart name to release.
          See https://github.com/hoverkraft-tech/ci-github-container/blob/main/actions/helm/release-chart/README.md.
        required: false
        type: string
        default: application
      chart-path:
        description: |
          Path to the chart to release.
          See https://github.com/hoverkraft-tech/ci-github-container/blob/main/actions/helm/release-chart/README.md.
        required: false
        type: string
        default: charts/application
      chart-values:
        description: |
          Define chart values to be filled.
          See https://github.com/hoverkraft-tech/ci-github-container/blob/main/actions/helm/release-chart/README.md.
          Accept placeholders:          
          - `{{ tag }}`: will be replaced by the tag.
          - `{{ url }}`: will be replaced by the URL.
          If "path" starts with "deploy", the chart value wil be passed to the deploy action.
          Example:
          ```json
          [
            { "path": ".image", "image": "application" },
            { "path": ".application.version", "value": "{{ tag }}" },
            { "path": "deploy.ingress.hosts[0].host", "value": "{{ url }}" }
          ]
          ```
        type: string
        required: false
        default: "[]"
      github-app-client-id:
        description: |
          GitHub App Client ID to generate GitHub token in place of github-token.
          See https://github.com/actions/create-github-app-token.
        required: false
        type: string
    secrets:
      oci-registry-password:
        description: "OCI registry password."
        required: true
      build-secrets:
        description: |
          List of secrets to expose to the build.
          See https://docs.docker.com/build/ci/github-actions/secrets/.
        required: false
      github-token:
        description: |
          GitHub token for deploying.
          Permissions:
            - contents: write
      github-app-key:
        description: |
          GitHub App private key to generate GitHub token in place of github-token.
          See https://github.com/actions/create-github-app-token.

permissions: {}

jobs:
  deploy-start:
    name: Start deploy
    uses: ./.github/workflows/deploy-start.yml
    permissions:
      actions: read
      contents: read
      deployments: write
      id-token: write # Needed for getting local workflow actions
      issues: write
      pull-requests: write
    with:
      runs-on: ${{ inputs.runs-on }}
      environment: ${{ inputs.environment }}

  prepare-deploy:
    name: Prepare deployment
    runs-on: ${{ fromJson(inputs.runs-on) }}
    needs: deploy-start
    if: ${{ needs.deploy-start.outputs.trigger }}
    outputs:
      tag: ${{ steps.get-tag.outputs.tag }}
      images: ${{ steps.set-images-tag.outputs.images }}
    permissions:
      contents: read
    steps:
      - uses: hoverkraft-tech/ci-github-common/actions/checkout@71b85947453f32b5d147ff3ab37351439a92d840 # 0.34.2
        if: inputs.tag == ''
        with:
          fetch-depth: 0

      - id: get-previous-tag
        if: inputs.tag == ''
        uses: WyriHaximus/github-action-get-previous-tag@61819f33034117e6c686e6a31dba995a85afc9de # v2.0.0
        with:
          fallback: 0.0.0

      - id: get-issue-number
        if: inputs.tag == '' && github.event_name == 'issue_comment'
        uses: hoverkraft-tech/ci-github-common/actions/get-issue-number@71b85947453f32b5d147ff3ab37351439a92d840 # 0.34.2

      - id: get-tag
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_TAG: ${{ inputs.tag }}
          PREVIOUS_TAG: ${{ steps.get-previous-tag.outputs.tag }}
          ISSUE_NUMBER: ${{ steps.get-issue-number.outputs.issue-number }}
        with:
          script: |
            let tag = process.env.INPUT_TAG.trim();
            if (tag) {
              core.setOutput('tag', tag);
              return;
            }

            const { stdout: gitTag } = await exec.getExecOutput('git', ['rev-parse', '--short', 'HEAD'], { silent: true });
            tag = gitTag.trim();
            if (!tag) {
              return core.setFailed("Cannot get current tag from git");
            }

            const issueNumber = process.env.ISSUE_NUMBER.trim();            
            if (issueNumber) {
              tag = `pr-${issueNumber}-${tag}`;
            }

            const previousTag = process.env.PREVIOUS_TAG.trim();
            if (previousTag) {
              tag = `${previousTag}-${tag}`;
            }

            core.setOutput('tag', tag);

      - id: set-images-tag
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          TAG: ${{ steps.get-tag.outputs.tag }}
          IMAGES: ${{ inputs.images }}
        with:
          script: |
            const tag = process.env.TAG;

            const imagesInput = process.env.IMAGES;

            // Check if is valid JSON
            let images = null;
            try {
              images = JSON.parse(imagesInput);
            } catch (error) {
              throw new Error(`"images" input is not a valid JSON: ${error}`);
            }

            // Check if images are valid
            if (!Array.isArray(images)) {
              throw new Error(`"images" input is not a valid array: ${images}`);
            }

            images.forEach((image) => { image.tag = tag; });

            core.setOutput('images', JSON.stringify(images));

  build-oci-images:
    name: Build OCI images
    needs: prepare-deploy
    uses: hoverkraft-tech/ci-github-container/.github/workflows/docker-build-images.yml@e4bf7a12228a2a4b5993d2d36b99b4dd0ec80bf5 # 0.32.1
    permissions:
      contents: read
      id-token: write
      issues: read
      packages: write
      pull-requests: read
    with:
      runs-on: ${{ inputs.runs-on }}
      oci-registry: ${{ inputs.oci-registry }}
      images: ${{ needs.prepare-deploy.outputs.images }}
    secrets:
      oci-registry-password: ${{ secrets.oci-registry-password }}
      build-secrets: ${{ secrets.build-secrets }}

  release-chart:
    name: Release chart
    runs-on: ${{ fromJson(inputs.runs-on) }}
    needs: [prepare-deploy, build-oci-images]
    permissions:
      contents: read
      packages: write
    outputs:
      chart: ${{ steps.release.outputs.image }}
      deploy-values: ${{ steps.set-chart-values.outputs.deploy-values }}
    steps:
      - id: set-chart-values
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          TAG: ${{ needs.prepare-deploy.outputs.tag }}
          BUILT_IMAGES: ${{ needs.build-oci-images.outputs.built-images }}
          CHART_VALUES: ${{ inputs.chart-values }}
        with:
          script: |
            const tag = process.env.TAG;

            const builtImagesInput = process.env.BUILT_IMAGES;
            let builtImages = null;
            try {
              builtImages = JSON.parse(builtImagesInput);
            } catch (error) {
              throw new Error(`"built-images" input is not a valid JSON: ${error}`);
            }
            if (!builtImages) {
              throw new Error(`"built-images" input is empty`);
            }
            if (typeof builtImages !== 'object') {
              throw new Error(`"built-images" input is not an object`);
            }

            const chartValuesInput = process.env.CHART_VALUES;
            let chartValues = null;
            try {
              chartValues = JSON.parse(chartValuesInput);
            } catch (error) {
              throw new Error(`"chart-values" input is not a valid JSON: ${error}`);
            }

            if (!Array.isArray(chartValues)) {
              throw new Error(`"chart-values" input is not an array`);
            }

            function injectChartValue(chartValue, key) {
              if (typeof chartValue !== 'object') {
                throw new Error(`"chart-values[${key}]" input is not an object`);
              }

              // Check mandatory properties
              for (const property of ['path']) {
                if (!chartValue.hasOwnProperty(property)) {
                  throw new Error(`"chart-values[${key}].${property}" input is missing`);
                }
              }

              if (chartValue.image !== undefined) {
                const builtImage = builtImages[chartValue.image];
                if (!builtImage) {
                  throw new Error(`Image "${chartValue.image}" not found in "built-images" input`);
                }
                return [
                  { ...chartValue, path: `${chartValue.path}.registry`, value: builtImage.registry },
                  { ...chartValue, path: `${chartValue.path}.repository`, value: builtImage.repository },
                  { ...chartValue, path: `${chartValue.path}.tag`, value: builtImage.tags[0] },
                  { ...chartValue, path: `${chartValue.path}.digest`, value: builtImage.digest },
                ];
              }
              else if (chartValue.value !== undefined) {
                // Handle placeholders
                const placeholders = [
                  { match: /{{\s*tag\s*}}/g, value: tag }
                ];

                for (const placeholder of placeholders) {
                  chartValue.value = chartValue.value.replace(placeholder.match, placeholder.value);
                }
              }

              return chartValue;
            }

            const values = chartValues.map(injectChartValue).flat();

            // Separate value that start with "deploy"
            core.setOutput('chart-values', JSON.stringify(values.filter((value) => !value.path.startsWith('deploy.'))));

            const deployValues = values.filter((value) => value.path.startsWith('deploy.')).map((value) => {
              // Remove the "deploy." prefix
              value.path = value.path.replace(/^deploy\./, '.');
              return value;
            });

            core.setOutput('deploy-values', JSON.stringify(deployValues));

      - id: release
        uses: hoverkraft-tech/ci-github-container/actions/helm/release-chart@e4bf7a12228a2a4b5993d2d36b99b4dd0ec80bf5 # 0.32.1
        with:
          chart: ${{ inputs.chart-name }}
          path: ${{ inputs.chart-path }}
          tag: ${{ needs.prepare-deploy.outputs.tag }}
          values: ${{ steps.set-chart-values.outputs.chart-values }}
          oci-registry: ${{ inputs.oci-registry }}
          oci-registry-password: ${{ secrets.oci-registry-password }}

  deploy-chart:
    name: Deploy chart
    runs-on: ${{ fromJson(inputs.runs-on) }}
    needs: [deploy-start, prepare-deploy, release-chart]
    permissions:
      id-token: write # Needed for getting local workflow actions
    steps:
      - id: prepare-deployment
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          REPOSITORY: ${{ fromJSON(inputs.deploy-parameters).repository }}
          ENVIRONMENT: ${{ needs.deploy-start.outputs.environment }}
          URL: ${{ inputs.url }}
          DEPLOY_VALUES: ${{ needs.release-chart.outputs.deploy-values }}
        with:
          script: |
            // Repository
            const repository = process.env.REPOSITORY.trim();

            if (repository) {
              core.setOutput("repository", repository);

              const [ownerName, repoName] = repository.split('/');
              core.setOutput("owner", ownerName);
            }

            const environment = process.env.ENVIRONMENT.trim();
            if (!environment) {
              core.setFailed("Environment is not defined");
              return;
            }

            const environmentParts = environment.split(':');
            const environmentName = environmentParts[0];
            const environmentIdentifier = environmentParts[1];

            // URL
            let url = process.env.URL.trim();
            if (!url) {
              // Try to get it from the env vars
              const allowedEnvVars = [
                `${environmentName}_URL`.toUpperCase().replace(/-/g, '_'),
                `URL`,
              ];

              for (const envVar of allowedEnvVars) {
                const envVarValue = process.env[envVar];
                if (envVarValue) {
                  url = envVarValue;
                  break;
                }
              }
            }

            if (!url) {
              core.setFailed("URL is not defined");
              return;
            }

            // Handle placeholders
            const placeholders = [
              { match: /{{\s*identifier\s*}}/g, value: environmentIdentifier },
            ];

            for (const placeholder of placeholders) {
              url = url.replace(placeholder.match, placeholder.value);
            }

            core.setOutput("url", url);

            let deployValues = JSON.parse(process.env.DEPLOY_VALUES);

            if (deployValues) {
              // Handle placeholders
              const placeholders = [
                { match: /{{\s*url\s*}}/g, value: url },
              ];

              for (const placeholder of placeholders) {
                deployValues.forEach((value) => {
                  if (value.value) {
                    value.value = value.value.replace(placeholder.match, placeholder.value);
                  }
                });
              }
            }
            core.setOutput("deploy-values", JSON.stringify(deployValues));

      # jscpd:ignore-start
      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        if: inputs.github-app-client-id
        id: generate-token
        with:
          client-id: ${{ inputs.github-app-client-id }}
          private-key: ${{ secrets.github-app-key }}
          owner: ${{ steps.prepare-deployment.outputs.owner }}
      # jscpd:ignore-end

      - id: local-workflow-actions
        uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@71b85947453f32b5d147ff3ab37351439a92d840 # 0.34.2
        with:
          actions-path: actions

      - if: inputs.deploy-type == 'helm-repository-dispatch'
        uses: ./self-workflow/actions/deploy/helm-repository-dispatch
        with:
          deployment-id: ${{ needs.deploy-start.outputs.deployment-id }}
          chart: ${{ needs.release-chart.outputs.chart }}
          chart-values: ${{ steps.prepare-deployment.outputs.deploy-values }}
          environment: ${{ needs.deploy-start.outputs.environment }}
          url: ${{ steps.prepare-deployment.outputs.url }}
          repository: ${{ steps.prepare-deployment.outputs.repository }}
          github-token: ${{ steps.generate-token.outputs.token || secrets.github-token || github.token }}
          initiated-by: ${{ github.actor }}

      # jscpd:ignore-start
      - uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@71b85947453f32b5d147ff3ab37351439a92d840 # 0.34.2
        if: always() && steps.local-workflow-actions.outputs.repository
        with:
          actions-path: actions
          repository: ${{ steps.local-workflow-actions.outputs.repository }}
          ref: ${{ steps.local-workflow-actions.outputs.ref }}
      # jscpd:ignore-end

  deploy-finish:
    name: Finish deploy
    if: ${{ always() && needs.deploy-start.outputs.trigger }}
    needs: [deploy-start, deploy-chart]
    uses: ./.github/workflows/deploy-finish.yml
    permissions:
      actions: read
      contents: read
      deployments: write
      id-token: write
      issues: write
      pull-requests: write
    with:
      runs-on: ${{ inputs.runs-on }}
      deployment-id: ${{ needs.deploy-start.outputs.deployment-id }}
      extra: ${{ toJSON(needs.deploy-chart.outputs) }}