create_test_env.yml

name: "Create test environment"

on:
  workflow_call:
    inputs:
      commit_sha:
        description: "Commit SHA to build the test environment from"
        required: true
        type: string
      env_name:
        description: "Environment name. Resulting URL will be <env_name>.product-development.test.k8s.ritense.com"
        required: true
        type: string

permissions:
  actions: read
  contents: read
  packages: write

# Assigns the same concurrency group to `delete_test_env` and `create_test_env`.
# This prevents creating and deleting from running simultaneously, which could cause race conditions.
concurrency:
  group: setup-test-env-${{ inputs.env_name }}
  cancel-in-progress: false

jobs:
  detect_changes:
    runs-on: ubuntu-latest
    outputs:
      frontend_changed: ${{ steps.frontend.outputs.any_changed }}
      backend_changed: ${{ steps.backend.outputs.any_changed }}

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # lets the action diff against the merge-base
          ref: ${{ inputs.commit_sha }}

      - name: Detect changes in frontend
        id: frontend
        uses: tj-actions/changed-files@v47
        with:
          files: |
            frontend/**

      - name: Detect changes in backend
        id: backend
        uses: tj-actions/changed-files@v47
        with:
          files: |
            backend/**

  determine_test_env:
    uses: ./.github/workflows/determine_test_env.yml
    with:
      envName: ${{ inputs.env_name }}
      source_sha: ${{ inputs.commit_sha }}

  comment_on_pr:
    runs-on: ubuntu-latest
    needs:
      - detect_changes
    outputs:
      comment_id: ${{ steps.comment.outputs.comment-id }}
      gha_comment_token: ${{ steps.generate_token.outputs.token }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Prepare initial comment body
        id: comment_body
        env:
          ENV_NAME: ${{ inputs.env_name }}
        run: |
          set -euo pipefail
          template_file=".github/test_env_comments/initial.md"
          export TEST_ENV_NAME="${ENV_NAME}"
          export FRONTEND_CONTENTS_SHA="pending"
          export BACKEND_CONTENTS_SHA="pending"
          export COMMENT_TIME="$(date +"%Y-%m-%d %H:%M:%S %Z")"
          message_body=$(cat "$template_file" | envsubst)
          {
            echo 'body<<EOF'
            printf '%s\n' "$message_body"
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"

      - name: Generate token as GitHub App
        id: generate_token
        uses: tibdex/github-app-token@v2
        with:
          app_id: ${{ secrets.VALTIMO_PLATFORM_APP_APPID }}
          private_key: ${{ secrets.VALTIMO_PLATFORM_APP_PRIVATE_KEY }}
      - name: Comment on PR
        id: comment
        uses: peter-evans/create-or-update-comment@v4
        with:
          issue-number: ${{ github.event.pull_request.number }}
          token: ${{ steps.generate_token.outputs.token }}
          body: ${{ steps.comment_body.outputs.body }}

  create_test_environment:
    needs:
      - detect_changes
      - comment_on_pr
    runs-on: ubuntu-latest
    steps:
      - name: Create or update test environment
        env:
          ENV_NAME: ${{ inputs.env_name }}
          COMMENT_ID: ${{ needs.comment_on_pr.outputs.comment_id }}
          TOKEN: ${{ secrets.VALTIMO_PRODUCT_DEVELOPMENT_INFRA_GITHUB_TOKEN }}
          DISPATCH_URL: ${{ secrets.VALTIMO_PRODUCT_DEVELOPMENT_WORKFLOW_DISPATCH_URL }}
        run: |
          set -euo pipefail
          curl --fail-with-body -sS -L \
            -X POST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${TOKEN}" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            "${DISPATCH_URL}" \
            -d "{\"ref\":\"main\",\"inputs\":{\"envName\":\"${ENV_NAME}\",\"githubCommentId\":\"${COMMENT_ID}\"}}"

  retag_existing_backend_image:
    needs:
      - detect_changes
      - create_test_environment
    if: ${{ needs.detect_changes.outputs.backend_changed != 'true' }}
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.backend_hash.outputs.image_tag }}
      contents_sha: ${{ steps.backend_hash.outputs.hash }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Compute backend contents hash
        id: backend_hash
        run: |
          HASH=$(git rev-parse HEAD:backend)
          echo "hash=${HASH}" >> "$GITHUB_OUTPUT"
          echo "image_tag=contents-test-${HASH}" >> "$GITHUB_OUTPUT"

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Find backend image to re-use it in the test environment
        env:
          IMAGE: ghcr.io/${{ github.repository }}/gzac-backend
          IMAGE_TAG: ${{ steps.backend_hash.outputs.image_tag }}
          CONTENTS_HASH: ${{ steps.backend_hash.outputs.hash }}
          BASE_COMMIT_SHA: ${{ github.event.pull_request.base.sha }}
          BASE_BRANCH_NAME: ${{ github.event.pull_request.base.ref }}
        run: |
          if docker manifest inspect "${IMAGE}:${IMAGE_TAG}" > /dev/null 2>&1; then
            echo "Found ${IMAGE}:${IMAGE_TAG}"
          else
            echo "Backend was unchanged in this PR, so an attempt was made to re-use a backend image tagged with its Git tree hash (${CONTENTS_HASH})." >&2
            echo "But no image tagged with ${IMAGE_TAG} was found in ${IMAGE}." >&2
            echo "The test environment will not work until an image with tag ${IMAGE}:${IMAGE_TAG} exists" >&2
            echo "To fix this:" >&2
            echo "  1. If commit ${BASE_COMMIT_SHA} of branch ${BASE_BRANCH_NAME} already has a built backend image, manually tag it for the test environment." >&2
            echo "  2. If commit ${BASE_COMMIT_SHA} of branch ${BASE_BRANCH_NAME} does not have a backend image yet, build and push the image" >&2
            echo "Then close and re-open this PR to retrigger the workflow."
            exit 1
          fi

  tag_backend_test_env_image:
    needs:
      - retag_existing_backend_image
    uses: ./.github/workflows/tag_test_env_image.yml
    secrets: inherit
    with:
      target: gzac-backend
      env_name: ${{ inputs.env_name }}
      contents_sha: ${{ needs.retag_existing_backend_image.outputs.contents_sha }}
      image_to_tag: ${{ needs.retag_existing_backend_image.outputs.image_tag }}
      source_sha: ${{ github.event.pull_request.base.sha || inputs.commit_sha }}

  retag_existing_frontend_image:
    needs:
      - detect_changes
      - create_test_environment
    if: ${{ needs.detect_changes.outputs.frontend_changed != 'true' }}
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.frontend_hash.outputs.image_tag }}
      contents_sha: ${{ steps.frontend_hash.outputs.hash }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Compute frontend contents hash
        id: frontend_hash
        run: |
          HASH=$(git rev-parse HEAD:frontend)
          echo "hash=${HASH}" >> "$GITHUB_OUTPUT"
          echo "image_tag=contents-test-${HASH}" >> "$GITHUB_OUTPUT"

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Re-tag a frontend image to re-use it in the test environment
        env:
          IMAGE: ghcr.io/${{ github.repository }}/gzac-frontend
          IMAGE_TAG: ${{ steps.frontend_hash.outputs.image_tag }}
          CONTENTS_HASH: ${{ steps.frontend_hash.outputs.hash }}
          BASE_COMMIT_SHA: ${{ github.event.pull_request.base.sha }}
          BASE_BRANCH_NAME: ${{ github.event.pull_request.base.ref }}
        run: |
          if docker manifest inspect "${IMAGE}:${IMAGE_TAG}" > /dev/null 2>&1; then
            echo "Found ${IMAGE}:${IMAGE_TAG}"
          else
            echo "Frontend was unchanged in this PR, so an attempt was made to re-use a frontend image tagged with its Git tree hash (${CONTENTS_HASH})." >&2            echo "But no image tagged with ${IMAGE_TAG} was found in ${IMAGE}." >&2
            echo "The test environment will not work until an image with tag ${IMAGE}:${IMAGE_TAG} exists" >&2
            echo "To fix this:" >&2
            echo "  1. If commit ${BASE_COMMIT_SHA} of branch ${BASE_BRANCH_NAME} already has a built frontend image, manually tag it for the test environment." >&2
            echo "  2. If commit ${BASE_COMMIT_SHA} of branch ${BASE_BRANCH_NAME} does not have a frontend image yet, build and push the image" >&2
            echo "Then close and re-open this PR to retrigger the workflow."
            exit 1
          fi

  tag_frontend_test_env_image:
    needs:
      - retag_existing_frontend_image
      - determine_test_env
    uses: ./.github/workflows/tag_test_env_image.yml
    secrets: inherit
    with:
      target: gzac-frontend
      env_name: ${{ inputs.env_name }}
      contents_sha: ${{ needs.retag_existing_frontend_image.outputs.contents_sha }}
      image_to_tag: ${{ needs.retag_existing_frontend_image.outputs.image_tag }}
      source_sha: ${{ github.event.pull_request.base.sha || inputs.commit_sha }}