generate_prs.yml

---
name: Generate Downstream PRs

run-name: "Generate Downstream PRs (dry-run: ${{ inputs.dry-run }})"

on:
  workflow_dispatch:
    inputs:
      message:
        description: "Message to include in the generated commits:"
        required: true
      custom-pr-title:
        description: "Optionally a custom PR title. If unset, default will be used"
      dry-run:
        description: "Dry Run (PRs are not generated)"
        type: boolean
        default: true
      fail-fast:
        description: "Fail fast (if one job fails, all other are cancelled)"
        type: boolean
        default: false

permissions: {}

jobs:
  create-prs:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: ${{ inputs.fail-fast }}
      matrix:
        # This should be the list of repository names from config/repositories.yaml:
        # yq '.repositories | map(.name)' config/repositories.yaml
        repository:
          - airflow-operator
          - commons-operator
          - druid-operator
          - hbase-operator
          - hdfs-operator
          - hive-operator
          - kafka-operator
          - nifi-operator
          - listener-operator
          - opa-operator
          - opensearch-operator
          - secret-operator
          - spark-k8s-operator
          - superset-operator
          - trino-operator
          - zookeeper-operator
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
      - name: Install Ansible
        env:
          DEBIAN_FRONTEND: noninteractive
        run: |
          sudo apt update &&  \
          sudo apt install -y software-properties-common && \
          sudo apt-add-repository ppa:ansible/ansible -y && \
          sudo apt install -y ansible

      # NOTE (@NickLarsenNZ): This could be removed in favor of nix-shell and rrbutani/use-nix-shell-action
      - name: Install deps for operators
        run: |
          sudo apt-get install \
          protobuf-compiler \
          krb5-user \
          libclang-dev \
          libkrb5-dev \
          liblzma-dev \
          libssl-dev \
          pkg-config

      - name: Install jinja2
        run: pip install -r requirements.txt

      # Create commit message depending on whether this is run manually or due to a scheduled run
      - name: Run playbook
        env:
          CUSTOM_PR_TITLE: ${{ inputs.custom-pr-title }}
          GH_ACCESS_TOKEN: ${{ secrets.gh_access_token }}
          REPOSITORY: ${{ matrix.repository }}
          DRY_RUN_FLAGS: ${{ inputs.dry-run && '--tags=local' || '' }}
          INPUT_MESSAGE: ${{ inputs.message }}
          SENDER_LOGIN: ${{ github.event.sender.login }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [ "$EVENT_NAME" = "schedule" ]; then
            AUTHOR="stackabletech/developers"
            REASON="Weekly run triggered"
          else
            AUTHOR="$SENDER_LOGIN"
            REASON="$INPUT_MESSAGE"
          fi

          # Encode parameters using jq, without serializing the GH_ACCESS_TOKEN
          jq -n \
            --arg commit_hash "$GITHUB_SHA" \
            --arg author "$AUTHOR" \
            --arg reason "$REASON" \
            --arg custom_pr_title "$CUSTOM_PR_TITLE" \
            --arg base_dir "$(pwd)" \
            --arg repository "$REPOSITORY" \
            '{commit_hash: $commit_hash, author: $author, reason: $reason, custom_pr_title: $custom_pr_title, base_dir: $base_dir, shard_repositories: [$repository]} | with_entries(select(.value != null and .value != ""))' > vars.json

          # Run the Ansible playbook. The token is read directly from the GH_ACCESS_TOKEN environment variable.
          # $DRY_RUN_FLAGS is intentionally unquoted (empty or one fixed flag)
          # shellcheck disable=SC2086
          ansible-playbook playbook/playbook.yaml --extra-vars "@vars.json" $DRY_RUN_FLAGS