pr_deploy_trigger.yml

#########################################################################################################
# Triggers a deployment event for pull requests and key branches
#########################################################################################################
name: PR Deploy Trigger

env:
  NODE_VERSION: '16.13.2' # should match version in .nvmrc

# Precautionary with using pull_request_target
permissions:
  statuses: none
  actions: read # needed for /environments
  checks: none
  pull-requests: none
  contents: none
  deployments: write
  issues: none
  packages: none
  repository-projects: none
  security-events: none

on:

# The _target event is needed to allow forks to access secrets in ci with limited scope
# This is why we limit 3rd party contributors running actions
# See https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request_target
  pull_request_target:
    branches:
      - buildkite-main # to be removed
      - master
      - alpha
      - next
      - '[0-9]+.[0-9]+.[0-9]+'
      - '[0-9]+.[0-9]+.x'
      - '[0-9]+.x'

jobs:
  should-trigger:
    name: Check for e2e/groups.json
    runs-on: ubuntu-latest
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'ci:buildkite') }}
    outputs:
      check: ${{ steps.e2e.outputs.enabled == 'true' }}
    steps:
      - name: Checkout repo
        uses: actions/checkout@v2
        with:
          ref: ${{ github.event.pull_request.merge_commit_sha }}
      - name: Check is e2e setup ready
        id: has-groups
        uses: andstor/file-existence-action@v1
        with:
          files: e2e/groups.json
      - run: cat e2e/groups.json
      - name: Check e2e groups are enabled
        if: ${{ steps.has-groups.outputs.files_exists }}
        id: e2e
        shell: python
        working-directory: e2e
        run: |
          import json
          file = open('groups.json')
          data = json.load(file)
          print(f"::set-output name=enabled::{json.dumps(data['enabled'])}")
          file.close()
      - run: echo "${{ steps.e2e.outputs.enabled }}"


  trigger-deploy:
    name: Trigger deployment
    runs-on: ubuntu-latest
    needs: should-trigger
    if: ${{ needs.should-trigger.outputs.check == 'true' }}
    env:
      ENVIRONMENT_NAME: "PR #${{ github.event.pull_request.number }}"
    steps:
      - name: Checkout repo
        uses: actions/checkout@v2
        with:
          ref: ${{ github.event.pull_request.merge_commit_sha }}
      - run: ls
      - name: Print context
        shell: python
        run: |
          print("""${{ toJSON(github) }}""")

      - name: Create new PR deployment
        id: deployment
        uses: actions/github-script@v5
        with:
          # https://docs.github.com/en/rest/reference/deployments#create-or-update-an-environment
          script: | # This is javascript :)
            return await github.rest.repos.createDeployment({
              ...context.repo,
              ref: context.payload.pull_request.head.sha,
              auto_merge: false, // use branch as is without merging with base
              required_contexts: [],
              environment: "${{ env.ENVIRONMENT_NAME }}",
              transient_environment: false, // sets previous statuses to inactive
              production_environment: false,
            });
          # GITHUB_TOKEN is used here to prevent trigger deploy action
          # See https://github.com/octokit/request-action/issues/12
          github-token: ${{ secrets.GITHUB_TOKEN }}

#########################################################################################################

      - name: Check actor membership and return deploy state accordingly.
        uses: actions/github-script@v5
        id: state
        with:
          result-encoding: string
          script: | # This is javascript :)
            // whitelist dependabot and renovatebot on pull requests
            if (context.actor === 'dependabot[bot]' || context.actor === 'renovate[bot]') return 'queued' // ready to deploy!!
            // https://docs.github.com/en/rest/reference/orgs#check-organization-membership-for-a-user
            const { status } = await github.rest.orgs.checkMembershipForUser({
              org: 'elastic',
              username: context.actor, // TODO: check if this changes for diff user
            });
            if (status !== 204) { // user is not an elastic member
              // https://docs.github.com/en/rest/reference/deployments#create-or-update-an-environment
              await github.rest.repos.createOrUpdateEnvironment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                environment_name: "${{ env.ENVIRONMENT_NAME }}",
                reviewers: [{
                  type: 'Team',
                  id: 3693417, // datavis team id
                }]
              });
              return 'pending' // pending review before deployment starts
            } else {
              return 'queued' // ready to deploy!!
            }
          github-token: ${{ secrets.ADMIN_TOKEN_GH }}

      - name: Print outputs result
        if: ${{ always() }}
        shell: python
        run: |
          print("""${{ toJSON(fromJSON(steps.deployment.outputs.result)) }}""")

      - name: Update Deployment status - queued
        uses: octokit/request-action@v2.x
        with:
          # https://docs.github.com/en/rest/reference/deployments#create-a-deployment-status
          route: POST /repos/{repo}/deployments/{deployment_id}/statuses
          repo: ${{ github.repository }}
          deployment_id: "${{ fromJSON(steps.deployment.outputs.result).data.id }}"
          state: ${{ steps.state.outputs.result }}
        env:
          # Must be GITHUB_TOKEN or will trigger a deployment_status event
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

#########################################################################################################

      - name: Trigger deployment
        uses: actions/github-script@v5
        with:
          # https://docs.github.com/en/rest/reference/repos#create-a-repository-dispatch-event
          script: | # This is javascript :)
            await github.rest.repos.createDispatchEvent({
              ...context.repo,
              event_type: 'Deployment | Pull Request',
              client_payload: {
                merge_sha: "${{ github.event.pull_request.merge_commit_sha }}",
                head_sha: "${{ github.event.pull_request.head.sha }}",
                environment: "${{ env.ENVIRONMENT_NAME }}",
                deployment_id: "${{ fromJSON(steps.deployment.outputs.result).data.id }}",
                pr_number: ${{ github.event.pull_request.number }},
                is_fork: ${{ github.event.pull_request.head.repo.fork }},
              },
            });
          github-token: ${{ secrets.ADMIN_TOKEN_GH }}

#########################################################################################################

  failure-check:
    name: Print context on failure
    if: ${{ failure() }}
    needs: [should-trigger, trigger-deploy]
    runs-on: ubuntu-latest
    steps:
      - name: Print github context
        shell: python
        run: |
          print("""${{ toJSON(github) }}""")
      - name: Print needs context
        shell: python
        run: |
          print("""${{ toJSON(needs) }}""")

#########################################################################################################