release-to-prod.yml

name: Check for release to Prod

on:
#  schedule:
#    - cron: '0 * * * *'  # Runs at the start of every hour
  workflow_dispatch:

env:
  # kosli commands picks up org, flow, trail and api-token from these environment variables
  KOSLI_ORG: "${{ vars.KOSLI_ORG }}"
  KOSLI_API_TOKEN: "${{ secrets.KOSLI_PUBLIC_API_TOKEN }}"
  KOSLI_CLI_VERSION: "${{ vars.KOSLI_CLI_VERSION }}"
  KOSLI_FLOW_RELEASE: "jira-example-release"
  KOSLI_FLOW_BACKEND: "jira-example-backend"
  KOSLI_FLOW_FRONTEND: "jira-example-frontend"
  KOSLI_ENV_STAGING:  "${{ vars.KOSLI_ENV_STAGING }}"
  KOSLI_ENV_PROD:  "${{ vars.KOSLI_ENV_PROD }}"
  # KOSLI_DRY_RUN: true
  JIRA_BASE_URL: "${{ vars.JIRA_BASE_URL }}"
  JIRA_USERNAME: ${{ vars.KOSLI_JIRA_USERNAME }}
  JIRA_API_TOKEN: ${{ secrets.KOSLI_JIRA_API_TOKEN }}
  JIRA_PROJECT_ID: "${{ vars.JIRA_PROJECT_ID }}"

jobs:
  check-approved-release:
    name: Check if we have a release candidate that has been approved
    runs-on: ubuntu-latest
    continue-on-error: true  # This prevents the job from marking the workflow as failed. Since we run on a timer it will happen often
    outputs:
      new_approved_sw: ${{ steps.check-jira.outputs.new_approved_sw }}
      release_id: ${{ steps.check-jira.outputs.release_id }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Check for approved release
        id: check-jira
        run: |          
          echo "new_approved_sw=false" >> $GITHUB_OUTPUT
          source scripts/lib-jira.sh
          
          CURRENT_REL_JSON=$(get_current_release_candidate ${{ env.JIRA_PROJECT_ID }})
          REL_VALUES_JSON=$(echo "${CURRENT_REL_JSON}" | jq .values)
          if [ "${REL_VALUES_JSON}" == "[]" ]; then
            echo "No release candidate exist" >> $GITHUB_STEP_SUMMARY
            exit 11
          fi
          RELEASE_ID=$(echo "${REL_VALUES_JSON}" |  jq -r '.[0].id')
          echo "release_id=${RELEASE_ID}" >> $GITHUB_OUTPUT
          APPROVERS_JSON=$(get_approvers_in_release ${RELEASE_ID})
          
          if echo "$APPROVERS_JSON" | jq -e 'length == 0'; then
            echo "No approvers in release" >> $GITHUB_STEP_SUMMARY
            exit 12
          fi
          
          if echo "$APPROVERS_JSON" | jq -e 'all(.status == "APPROVED")'; then
            echo "APPROVED by all" >> $GITHUB_STEP_SUMMARY
            echo "$APPROVERS_JSON" | jq >> $GITHUB_STEP_SUMMARY
            echo "new_approved_sw=true" >> $GITHUB_OUTPUT
            exit 0
          else
            echo "Not all statuses are APPROVED" >> $GITHUB_STEP_SUMMARY
            echo "$APPROVERS_JSON" | jq >> $GITHUB_STEP_SUMMARY
            exit 13
          fi

  attest-approval:
    name: Attest approval
    needs: [check-approved-release]
    if: needs.check-approved-release.outputs.new_approved_sw == 'true'
    runs-on: ubuntu-latest
    env:
      RELEASE_ID: ${{ needs.check-approved-release.outputs.release_id }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Kosli cli
        uses: kosli-dev/setup-cli-action@v2
        with:
          version:
            ${{ vars.KOSLI_CLI_VERSION }}

      - name: Report approval to release flow
        run: |
          source scripts/lib-jira.sh

          get_release ${{ env.RELEASE_ID }} > /tmp/jira-release.json
          add_approver_name_and_email /tmp/jira-release.json
          APPROVER_NAME=$(jq -r '.approvers[].displayName' /tmp/jira-release.json)
          
          PROJECT_KEY=$(echo "${{ vars.JIRA_PROJECT_KEY }}" | cut -d',' -f1)
          REL_LINK="${JIRA_BASE_URL}/projects/${PROJECT_KEY}/versions/${{ env.RELEASE_ID }}"
          
          kosli attest custom \
            --type=approval-jira \
            --name release-approval \
            --flow ${{ env.KOSLI_FLOW_RELEASE }} \
            --trail ${{ env.RELEASE_ID }} \
            --attestation-data /tmp/jira-release.json \
            --annotate Approver="${APPROVER_NAME}" \
            --annotate JiraRelease=${REL_LINK}

      - name: Get what SW is running in staging
        run: |
          source scripts/lib-kosli.sh
          get_current_running_env_json ${{ env.KOSLI_ENV_STAGING }} > /tmp/staging-env.json
          create_running_sw_short_list_json /tmp/staging-env.json > /tmp/staging-sw.json


      - name: Attest backend approval
        run: |
          COMMIT_SHA_BACKEND=$(jq -r '.[] | select(.name == "backend") | .git_commit' /tmp/staging-sw.json)
          FINGERPRINT_BACKEND=$(jq -r '.[] | select(.name == "backend") | .fingerprint' /tmp/staging-sw.json)
          APPROVER_NAME=$(jq -r '.approvers[].displayName' /tmp/jira-release.json)
          kosli attest custom \
            --type=approval-jira \
            --name release-approval \
            --flow ${{ env.KOSLI_FLOW_BACKEND }} \
            --trail ${COMMIT_SHA_BACKEND} \
            --fingerprint ${FINGERPRINT_BACKEND} \
            --attestation-data /tmp/jira-release.json \
            --annotate Approver="${APPROVER_NAME}"

      - name: Attest frontend approval
        run: |
          COMMIT_SHA_FRONTEND=$(jq -r '.[] | select(.name == "frontend") | .git_commit' /tmp/staging-sw.json)
          FINGERPRINT_FRONTEND=$(jq -r '.[] | select(.name == "frontend") | .fingerprint' /tmp/staging-sw.json)
          APPROVER_NAME=$(jq -r '.approvers[].displayName' /tmp/jira-release.json)
          kosli attest custom \
            --type=approval-jira \
            --name release-approval \
            --flow ${{ env.KOSLI_FLOW_FRONTEND }} \
            --trail ${COMMIT_SHA_FRONTEND} \
            --fingerprint ${FINGERPRINT_FRONTEND} \
            --attestation-data /tmp/jira-release.json \
            --annotate Approver="${APPROVER_NAME}"


  deploy-to-prod:
    name: Deploy to prod
    needs: [check-approved-release, attest-approval]
    if: needs.check-approved-release.outputs.new_approved_sw == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Kosli cli
        uses: kosli-dev/setup-cli-action@v2
        with:
          version:
            ${{ vars.KOSLI_CLI_VERSION }}

      - name: Get what SW is running in staging
        run: |
          source scripts/lib-kosli.sh
          get_current_running_env_json ${{ env.KOSLI_ENV_STAGING }} > /tmp/staging-env.json
          create_running_sw_short_list_json /tmp/staging-env.json > /tmp/staging-sw.json

      - name: Get frontend tag
        run: |
          COMMIT_SHA=$(jq -r '.[] | select(.name == "frontend") | .git_commit' /tmp/staging-sw.json)
          echo "COMMIT_SHA_FRONTEND=$COMMIT_SHA" >> "$GITHUB_ENV"
          FINGERPRINT=$(jq -r '.[] | select(.name == "frontend") | .fingerprint' /tmp/staging-env.json)
          echo "FINGERPRINT_FRONTEND=$FINGERPRINT" >> "$GITHUB_ENV"

      - name: Get backend tag
        run: |
          COMMIT_SHA=$(jq -r '.[] | select(.name == "backend") | .git_commit' /tmp/staging-sw.json)
          echo "COMMIT_SHA_BACKEND=$COMMIT_SHA" >> "$GITHUB_ENV"
          FINGERPRINT=$(jq -r '.[] | select(.name == "backend") | .fingerprint' /tmp/staging-env.json)
          echo "FINGERPRINT_BACKEND=$FINGERPRINT" >> "$GITHUB_ENV"

      - name: Assert Artifacts
        if: ${{ github.ref == 'refs/heads/main' }}
        uses: ./.github/actions/kosli-assert-artifacts
        with:
          kosli-environment: ${{ vars.KOSLI_ENV_PROD }}
          fingerprints: |
            ${{ env.FINGERPRINT_FRONTEND }},
            ${{ env.FINGERPRINT_BACKEND }}

      - name: Deploy frontend
        # We do not have a real repo so we just tag the git repo and then the
        # simulate-environment-reporting-prod.yml will start reporting that
        # this environment is now running.
        env:
          GH_TOKEN: ${{ secrets.GH_UPDATE_TAG_TOKEN }}
          OWNER: "kosli-dev"
          REPO: "jira-integration-example"
          TAG: "running-prod-frontend"
          COMMIT_SHA: ${{ env.COMMIT_SHA_FRONTEND }}
        run: |
          API_URL="https://api.github.com/repos/${OWNER}/${REPO}/git/refs/tags/${TAG}"
          
          # Check if the tag exists
          STATUS_CODE=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer ${GH_TOKEN}" -H "Accept: application/vnd.github.v3+json" "${API_URL}")

          if [[ "$STATUS_CODE" == "200" ]]; then
            echo "Tag ${TAG} exists, updating..." >> $GITHUB_STEP_SUMMARY
            curl -X PATCH -H "Authorization: Bearer ${GH_TOKEN}" -H "Accept: application/vnd.github.v3+json" \
              -d "{\"sha\": \"${COMMIT_SHA}\", \"force\": true}" "${API_URL}"
          else
            echo "Tag ${TAG} does not exist, creating..." >> $GITHUB_STEP_SUMMARY
            curl -X POST -H "Authorization: Bearer ${GH_TOKEN}" -H "Accept: application/vnd.github.v3+json" \
              -d "{\"ref\": \"refs/tags/${TAG}\", \"sha\": \"${COMMIT_SHA}\"}" "https://api.github.com/repos/${OWNER}/${REPO}/git/refs"
          fi
          echo "Deployed frontend commit ${COMMIT_SHA}" >> $GITHUB_STEP_SUMMARY

      - name: Deploy backend
        # We do not have a real repo so we just tag the git repo and then the
        # simulate-environment-reporting-prod.yml will start reporting that
        # this environment is now running.
        env:
          GH_TOKEN: ${{ secrets.GH_UPDATE_TAG_TOKEN }}
          OWNER: "kosli-dev"
          REPO: "jira-integration-example"
          TAG: "running-prod-backend"
          COMMIT_SHA: ${{ env.COMMIT_SHA_BACKEND }}
        run: |
          API_URL="https://api.github.com/repos/${OWNER}/${REPO}/git/refs/tags/${TAG}"
          
          # Check if the tag exists
          STATUS_CODE=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer ${GH_TOKEN}" -H "Accept: application/vnd.github.v3+json" "${API_URL}")

          if [[ "$STATUS_CODE" == "200" ]]; then
            echo "Tag ${TAG} exists, updating..." >> $GITHUB_STEP_SUMMARY
            curl -X PATCH -H "Authorization: Bearer ${GH_TOKEN}" -H "Accept: application/vnd.github.v3+json" \
              -d "{\"sha\": \"${COMMIT_SHA}\", \"force\": true}" "${API_URL}"
          else
            echo "Tag ${TAG} does not exist, creating..." >> $GITHUB_STEP_SUMMARY
            curl -X POST -H "Authorization: Bearer ${GH_TOKEN}" -H "Accept: application/vnd.github.v3+json" \
              -d "{\"ref\": \"refs/tags/${TAG}\", \"sha\": \"${COMMIT_SHA}\"}" "https://api.github.com/repos/${OWNER}/${REPO}/git/refs"
          fi
          echo "Deployed backend commit ${COMMIT_SHA}" >> $GITHUB_STEP_SUMMARY

  set-to-released:
    name: Set to released in Jira
    needs: [check-approved-release, attest-approval, deploy-to-prod]
    if: needs.check-approved-release.outputs.new_approved_sw == 'true'
    runs-on: ubuntu-latest
    env:
      RELEASE_ID: ${{ needs.check-approved-release.outputs.release_id }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set to released
        run: |
          source scripts/lib-jira.sh
          set_release_to_released ${RELEASE_ID}