Add github webhook and deploy on call

adb-sh · adb-sh · commit 1b0a0de9b184 · 2024-11-05T22:26:13.000+01:00
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -17,6 +17,7 @@
     "@deploy-cat/heroicons-solid": "^2.1.1",
     "@kubernetes/client-node": "^0.18.1",
     "@octokit/rest": "^21.0.2",
+    "@octokit/webhooks": "^13.3.0",
     "@prisma/client": "^5.19.1",
     "@solid-mediakit/auth": "^2.1.3",
     "@solidjs/router": "^0.13.1",
diff --git a/src/components/cloud/CreateServiceForm.tsx b/src/components/cloud/CreateServiceForm.tsx
@@ -9,6 +9,9 @@ import type { Service } from "~/lib/knative";
 import { toNumber } from "~/lib/knative";
 import { SourceInput } from "./service/SourceInput";
 import { k8sCore } from "~/lib/k8s";
+import { Octokit } from "@octokit/rest";
+import * as crypto from "crypto";
+import { config } from "~/lib/config";
 
 const ensureGithubPullSecret = async (namespace: string) => {
   "use server";
@@ -51,6 +54,25 @@ const ensureGithubPullSecret = async (namespace: string) => {
   }
 };
 
+const createGithubWebhook = async (namespace: string, service) => {
+  "use server";
+  const account = await getAccount();
+  const ok = new Octokit({
+    auth: account.access_token,
+  });
+  ok.repos.createWebhook({
+    owner: service.ghPackageOwner,
+    repo: service.ghPackageRepo,
+    config: {
+      url: `${config?.publicurl}/api/webhooks/github/apps/${namespace}/${service.name}/package`,
+      content_type: "json",
+      secret: service.webhookSecret,
+    },
+    events: ["package"],
+    active: true,
+  });
+};
+
 const createServiceFromForm = async (form: FormData) => {
   "use server";
   const service = {
@@ -61,6 +83,7 @@ const createServiceFromForm = async (form: FormData) => {
     ghPackageTag: form.get("ghPackageTag") as string,
     ghPackageName: form.get("ghPackageName") as string,
     ghPackageOwner: form.get("ghPackageOwner") as string,
+    ghPackageRepo: form.get("ghPackageRepo") as string,
     port: Number(form.get("port")) as number,
     resources: {
       cpuLimit: toNumber(form.get("cpuLimit")),
@@ -72,18 +95,21 @@ const createServiceFromForm = async (form: FormData) => {
     },
     envVars: JSON.parse(form.get("env") as string) as { [key: string]: string },
   } as Service;
+
   const user = await getUser();
   if (service?.source === "ghcr") {
     try {
+      service.webhookSecret = crypto.randomBytes(16).toString("hex");
       await ensureGithubPullSecret(user.name);
+      await createGithubWebhook(user.name, service);
     } catch (e) {
       console.error(e);
     }
     service.image = `ghcr.io/${service.ghPackageOwner}/${service.ghPackageName}:${service.ghPackageTag}`;
     service.pullSecret = "pull-secret-ghcr";
   }
   try {
-    await knative.createService(service, user.name);
+    await knative.createService(service, user.name, service.source);
   } catch (e) {
     console.error(e);
   }
diff --git a/src/components/cloud/service/SourceInput.tsx b/src/components/cloud/service/SourceInput.tsx
@@ -1,4 +1,4 @@
-import { createSignal, Show, For } from "solid-js";
+import { createSignal, Show, For, createEffect, Accessor } from "solid-js";
 import { cache, createAsync } from "@solidjs/router";
 import { getAccount } from "~/lib/auth";
 import { Octokit } from "@octokit/rest";
@@ -14,7 +14,7 @@ const getPackages = cache(async () => {
       await ok.packages.listPackagesForAuthenticatedUser({
         package_type: "container",
       });
-    const packagesWithVersions = Promise.all(
+    const packagesWithVersions = await Promise.all(
       packages.map(async (pkg) => {
         const { data: versions } =
           await ok.packages.getAllPackageVersionsForPackageOwnedByAuthenticatedUser(
@@ -48,7 +48,14 @@ const sourceOptions = [
 export const SourceInput = ({ data }) => {
   const [source, setSource] = createSignal("manual" as Source);
   const packages = createAsync(() => getPackages());
-  const [pkg, setPkg] = createSignal(null as null | number);
+  type Package = typeof packages extends Accessor<(infer U)[] | undefined>
+    ? U
+    : never;
+  const [pkg, setPkg] = createSignal(undefined as Package | undefined);
+
+  createEffect(() => {
+    setPkg(packages()?.[0]);
+  });
 
   return (
     <>
@@ -87,39 +94,55 @@ export const SourceInput = ({ data }) => {
         </label>
       </Show>
       <Show when={source() === "ghcr"}>
-        <label class="form-control w-full">
-          <div class="label">
-            <span class="label-text">Container Image</span>
-          </div>
-          <select
-            name="ghPackage"
-            class="select select-bordered w-full"
-            onchange={(e) => setPkg(Number(e.target.value))}
-          >
-            <For each={packages()}>
-              {(p) => (
-                <option value={p.id}>
-                  {p.name} ({p.repository?.full_name})
-                </option>
-              )}
-            </For>
-          </select>
-          <input
-            type="hidden"
-            name="ghPackageName"
-            value={packages()?.find((p) => p.id === pkg())?.name}
-          />
-          <input
-            type="hidden"
-            name="ghPackageOwner"
-            value={packages()?.find((p) => p.id === pkg())?.owner?.login}
-          />
-          <select name="ghPackageTag" class="select select-bordered w-full">
-            <For each={packages()?.find((p) => p.id === pkg())?.tags}>
-              {(t) => <option value={t}>{t}</option>}
-            </For>
-          </select>
-        </label>
+        <Show when={packages()}>
+          {(pkgs) => (
+            <>
+              <label class="form-control w-full">
+                <div class="label">
+                  <span class="label-text">Container Image</span>
+                </div>
+                <div class="join">
+                  <select
+                    name="ghPackage"
+                    class="select select-bordered w-full join-item"
+                    onInput={(e) =>
+                      setPkg(
+                        pkgs().find((p) => p.id === Number(e.target.value))
+                      )
+                    }
+                  >
+                    <For each={pkgs()}>
+                      {(p) => (
+                        <option value={p.id}>
+                          {p.name} ({p.repository?.full_name})
+                        </option>
+                      )}
+                    </For>
+                  </select>
+                  <select
+                    name="ghPackageTag"
+                    class="select select-bordered join-item"
+                  >
+                    <For each={pkg()?.tags}>
+                      {(t) => <option value={t}>{t}</option>}
+                    </For>
+                  </select>
+                </div>
+              </label>
+              <input type="hidden" name="ghPackageName" value={pkg()?.name} />
+              <input
+                type="hidden"
+                name="ghPackageOwner"
+                value={pkg()?.owner?.login}
+              />
+              <input
+                type="hidden"
+                name="ghPackageRepo"
+                value={pkg()?.repository?.name}
+              />
+            </>
+          )}
+        </Show>
       </Show>
     </>
   );
diff --git a/src/lib/config.ts b/src/lib/config.ts
@@ -6,6 +6,7 @@ import { isServer } from "solid-js/web";
 const configPath = process.cwd?.() && `${process.cwd()}/config.json`;
 
 const schemaConfig = z.object({
+  publicurl: z.string(),
   database: z.object({
     url: z.string(),
   }),
diff --git a/src/lib/knative.ts b/src/lib/knative.ts
@@ -25,13 +25,13 @@ const toKnService = (service: any) =>
     port: service.spec.template.spec.containers[0].ports[0].containerPort,
     resources: {
       cpuLimit: toNumber(
-        service.spec.template.spec.containers[0].resources.limits?.cpu.replace(
+        service.spec.template.spec.containers[0].resources.limits?.cpu?.replace(
           "m",
           ""
         )
       ),
       memoryLimit: toNumber(
-        service.spec.template.spec.containers[0].resources.limits?.memory.replace(
+        service.spec.template.spec.containers[0].resources.limits?.memory?.replace(
           "Mi",
           ""
         )
@@ -106,7 +106,12 @@ export class Knative {
     return body.items;
   }
 
-  async createService(service: Service, namespace: string) {
+  async createService(
+    service: Service,
+    namespace: string,
+    source: string = "manual",
+    revisionSource: string = "manual"
+  ) {
     const { body } = await this.customObjectsApi.createNamespacedCustomObject(
       "serving.knative.dev",
       "v1",
@@ -120,6 +125,10 @@ export class Knative {
           labels: {
             "app.kubernetes.io/managed-by": "deploycat",
           },
+          annotations: {
+            "apps.deploycat.io/webhook-secret": service.webhookSecret,
+            "apps.deploycat.io/source": source,
+          },
         },
         spec: {
           template: {
@@ -133,9 +142,7 @@ export class Knative {
                   service.scaling.maxRequests &&
                   service.scaling.maxRequests.toString(),
                 "autoscaling.knative.dev/metric": "rps",
-              },
-              labels: {
-                "apps.deploycat.io/source": "manual",
+                "apps.deploycat.io/source": revisionSource,
               },
             },
             spec: {
@@ -189,7 +196,12 @@ export class Knative {
     return body;
   }
 
-  async updateService(name: string, service: Service, namespace: string) {
+  async updateService(
+    name: string,
+    service: Service,
+    namespace: string,
+    revisionSource: string = "manual"
+  ) {
     const currentService = await this.getService(name, namespace);
 
     const { body } = await this.customObjectsApi.replaceNamespacedCustomObject(
@@ -224,12 +236,13 @@ export class Knative {
                   service.scaling.maxRequests &&
                   service.scaling.maxRequests.toString(),
                 "autoscaling.knative.dev/metric": "rps",
-              },
-              labels: {
-                "apps.deploycat.io/source": "manual",
+                "apps.deploycat.io/updated-at": new Date().toISOString(), // force new revision
+                "apps.deploycat.io/source": revisionSource,
               },
             },
             spec: {
+              imagePullSecrets:
+                currentService.raw.spec.template.spec.imagePullSecrets,
               containerConcurrency: 0,
               containers: [
                 {
diff --git a/src/routes/api/webhooks/github/apps/[namespace]/[app]/package.ts b/src/routes/api/webhooks/github/apps/[namespace]/[app]/package.ts
@@ -0,0 +1,28 @@
+import type { APIEvent } from "@solidjs/start/server";
+import { knative } from "~/lib/k8s";
+import { Webhooks } from "@octokit/webhooks";
+
+export async function POST({ params, request }: APIEvent) {
+  const { namespace, app } = params;
+  const body = await request.text();
+
+  const currentService = await knative.getService(app, namespace);
+  const secret =
+    currentService.raw.metadata.annotations["apps.deploycat.io/webhook-secret"];
+
+  const wh = new Webhooks({ secret });
+  const signature = request.headers.get("x-hub-signature-256");
+  if (!secret || !signature || !(await wh.verify(body, signature))) {
+    return new Response("Not Authorized", { status: 403 });
+  }
+
+  const data = JSON.parse(body);
+  if (
+    data.action === "published" &&
+    data.package?.package_version?.package_url === currentService.image
+  ) {
+    await knative.updateService(app, currentService, namespace, "ghcr");
+    return new Response("Updated", { status: 200 });
+  }
+  return new Response("Not Found", { status: 404 });
+}
diff --git a/src/routes/cloud/apps/[app]/index.tsx b/src/routes/cloud/apps/[app]/index.tsx
@@ -108,8 +108,9 @@ export default () => {
                         %
                       </td>
                       <td class="hidden sm:table-cell">
-                        {revision.metadata.labels["apps.deploycat.io/source"] ??
-                          "unknown"}
+                        {revision.metadata.annotations[
+                          "apps.deploycat.io/source"
+                        ] ?? "unknown"}
                       </td>
                     </tr>
                   )}
