From 35654fc33b3a2647b713a448cd948574f78849e0 Mon Sep 17 00:00:00 2001 From: Nathanial Acosta Date: Mon, 3 Aug 2026 14:50:53 -0400 Subject: [PATCH 1/2] Add validation step workflow, adjust diff and promotion.yml to send a base commit --- .github/scripts/diff.sh | 2 +- .github/workflows/promotion.yml | 2 + .github/workflows/validation-deploy.yml | 117 ++++++++++++++++++++++++ .github/workflows/validation.yml | 46 ++++++++++ 4 files changed, 166 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/validation-deploy.yml create mode 100644 .github/workflows/validation.yml diff --git a/.github/scripts/diff.sh b/.github/scripts/diff.sh index bd7e96a..7021e18 100755 --- a/.github/scripts/diff.sh +++ b/.github/scripts/diff.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash set -euo pipefail -BASE_SHA=$(git log --pretty=format:'%P' -n 1 HEAD | awk '{print $1}') +: "${BASE_SHA:?BASE_SHA environment variable must be set}" ASSET_DIRS="Studio Projects|Agent Projects|Automations|LCM Resource Models|Golden Configs" INTEGRATION_MODELS_DIR="OpenAPIs" diff --git a/.github/workflows/promotion.yml b/.github/workflows/promotion.yml index 5b6f0f0..3937f63 100644 --- a/.github/workflows/promotion.yml +++ b/.github/workflows/promotion.yml @@ -23,6 +23,8 @@ jobs: - name: Find changed files id: diff + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} run: bash .github/scripts/diff.sh diff --git a/.github/workflows/validation-deploy.yml b/.github/workflows/validation-deploy.yml new file mode 100644 index 0000000..da9a26c --- /dev/null +++ b/.github/workflows/validation-deploy.yml @@ -0,0 +1,117 @@ +name: Itential Asset & Integration Deploy + +on: + workflow_run: + workflows: ["Itential Asset & Integration Validation"] + types: [completed] + +jobs: + load-context: + if: github.event.workflow_run.conclusion == 'success' + runs-on: ubuntu-latest + outputs: + pr_number: ${{ steps.context.outputs.pr_number }} + has_asset_changes: ${{ steps.context.outputs.has_asset_changes }} + changed_files: ${{ steps.context.outputs.changed_files }} + has_spec_changes: ${{ steps.context.outputs.has_spec_changes }} + changed_specs: ${{ steps.context.outputs.changed_specs }} + steps: + - name: Download validation artifact + uses: actions/download-artifact@v4 + with: + name: validation-event + run-id: ${{ github.event.workflow_run.id }} + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract PR context + id: context + run: | + PR_NUMBER=$(jq -r .pr_number event.json) + + echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT" + { + echo "changed_files<> "$GITHUB_OUTPUT" + { + echo "changed_specs<> "$GITHUB_OUTPUT" + echo "has_asset_changes=$(jq -r .has_asset_changes event.json)" >> "$GITHUB_OUTPUT" + echo "has_spec_changes=$(jq -r .has_spec_changes event.json)" >> "$GITHUB_OUTPUT" + + validate-assets: + needs: [load-context] + if: needs.load-context.outputs.has_asset_changes == 'true' + runs-on: ubuntu-latest + environment: staging + + steps: + - name: Checkout trusted scripts + uses: actions/checkout@v4 + + - name: Checkout approved PR content + uses: actions/checkout@v4 + with: + ref: refs/pull/${{ needs.load-context.outputs.pr_number }}/merge + path: pr + allow-unsafe-pr-checkout: true + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: "3.11" + + - name: Install asyncplatform + run: pip install git+https://github.com/Itential/asyncplatform.git + + - name: Deploy to Staging + working-directory: pr + env: + HOST: ${{ secrets.PLATFORM_HOST }} + CLIENT_ID: ${{ secrets.PLATFORM_CLIENT_ID }} + CLIENT_SECRET: ${{ secrets.PLATFORM_CLIENT_SECRET }} + PROJECT_MEMBERS: ${{ vars.PROJECT_MEMBERS }} + CHANGED_FILES: ${{ needs.load-context.outputs.changed_files }} + run: python "$GITHUB_WORKSPACE/.github/scripts/deploy.py" Staging + + validate-integrations: + needs: [load-context] + if: needs.load-context.outputs.has_spec_changes == 'true' + runs-on: ubuntu-latest + environment: staging + + steps: + - name: Checkout trusted scripts + uses: actions/checkout@v4 + + - name: Checkout approved PR content + uses: actions/checkout@v4 + with: + ref: refs/pull/${{ needs.load-context.outputs.pr_number }}/merge + path: pr + allow-unsafe-pr-checkout: true + + - name: Install ipctl + run: | + curl -LO "https://github.com/itential/ipctl/releases/latest/download/ipctl-linux-x86_64.tar.gz" + tar -xzf ipctl-linux-x86_64.tar.gz + sudo mv ipctl /usr/local/bin/ + + - name: Configure ipctl + env: + HOST: ${{ secrets.PLATFORM_HOST }} + CLIENT_ID: ${{ secrets.PLATFORM_CLIENT_ID }} + CLIENT_SECRET: ${{ secrets.PLATFORM_CLIENT_SECRET }} + run: | + printf '[profile default]\nhost = %s\nport = 0\nuse_tls = true\nclient_id = %s\nclient_secret = %s\n' \ + "$HOST" "$CLIENT_ID" "$CLIENT_SECRET" > /tmp/ipctl.ini + + - name: Import integration models + working-directory: pr + env: + IPCTL_CONFIG_FILE: /tmp/ipctl.ini + CHANGED_SPECS: ${{ needs.load-context.outputs.changed_specs }} + run: bash "$GITHUB_WORKSPACE/.github/scripts/deploy_integrations.sh" diff --git a/.github/workflows/validation.yml b/.github/workflows/validation.yml new file mode 100644 index 0000000..9122cc0 --- /dev/null +++ b/.github/workflows/validation.yml @@ -0,0 +1,46 @@ +name: Itential Asset & Integration Validation + +on: + pull_request_review: + types: [submitted] + +jobs: + diff: + if: github.event.review.state == 'approved' && github.event.pull_request.base.ref == 'main' + runs-on: ubuntu-latest + steps: + - name: Checkout trusted scripts + uses: actions/checkout@v4 + + - name: Checkout PR content + uses: actions/checkout@v4 + with: + ref: refs/pull/${{ github.event.pull_request.number }}/merge + fetch-depth: 0 + path: pr + allow-unsafe-pr-checkout: true + + - name: Find changed files + id: diff + working-directory: pr + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + run: bash "$GITHUB_WORKSPACE/.github/scripts/diff.sh" + + - name: Save PR context for deploy + run: | + jq -n \ + --argjson pr_number ${{ github.event.pull_request.number }} \ + --arg head_sha "${{ github.event.pull_request.head.sha }}" \ + --arg has_asset_changes "${{ steps.diff.outputs.has_asset_changes }}" \ + --argjson changed_files '${{ steps.diff.outputs.changed_files }}' \ + --arg has_spec_changes "${{ steps.diff.outputs.has_spec_changes }}" \ + --argjson changed_specs '${{ steps.diff.outputs.changed_specs }}' \ + '{pr_number: $pr_number, head_sha: $head_sha, has_asset_changes: $has_asset_changes, changed_files: $changed_files, has_spec_changes: $has_spec_changes, changed_specs: $changed_specs}' \ + > event.json + + - name: Upload PR context artifact + uses: actions/upload-artifact@v4 + with: + name: validation-event + path: event.json From 54d8d3cf6a034bf988c7407becd35ffc6223feef Mon Sep 17 00:00:00 2001 From: Nathanial Acosta Date: Wed, 5 Aug 2026 09:58:53 -0400 Subject: [PATCH 2/2] Adjust Github Actions dependencies to latest version --- .github/workflows/init.yml | 6 +++--- .github/workflows/promotion.yml | 8 ++++---- .github/workflows/validation-deploy.yml | 12 ++++++------ .github/workflows/validation.yml | 6 +++--- 4 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/init.yml b/.github/workflows/init.yml index f806eb3..2178d20 100644 --- a/.github/workflows/init.yml +++ b/.github/workflows/init.yml @@ -10,12 +10,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: "3.11" @@ -37,7 +37,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 diff --git a/.github/workflows/promotion.yml b/.github/workflows/promotion.yml index 3937f63..006a6a2 100644 --- a/.github/workflows/promotion.yml +++ b/.github/workflows/promotion.yml @@ -17,7 +17,7 @@ jobs: changed_specs: ${{ steps.diff.outputs.changed_specs }} steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 @@ -36,12 +36,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: "3.11" @@ -66,7 +66,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 diff --git a/.github/workflows/validation-deploy.yml b/.github/workflows/validation-deploy.yml index da9a26c..8f1c061 100644 --- a/.github/workflows/validation-deploy.yml +++ b/.github/workflows/validation-deploy.yml @@ -17,7 +17,7 @@ jobs: changed_specs: ${{ steps.context.outputs.changed_specs }} steps: - name: Download validation artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: validation-event run-id: ${{ github.event.workflow_run.id }} @@ -50,17 +50,17 @@ jobs: steps: - name: Checkout trusted scripts - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Checkout approved PR content - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: refs/pull/${{ needs.load-context.outputs.pr_number }}/merge path: pr allow-unsafe-pr-checkout: true - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: "3.11" @@ -85,10 +85,10 @@ jobs: steps: - name: Checkout trusted scripts - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Checkout approved PR content - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: refs/pull/${{ needs.load-context.outputs.pr_number }}/merge path: pr diff --git a/.github/workflows/validation.yml b/.github/workflows/validation.yml index 9122cc0..f8fddfe 100644 --- a/.github/workflows/validation.yml +++ b/.github/workflows/validation.yml @@ -10,10 +10,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout trusted scripts - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Checkout PR content - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: refs/pull/${{ github.event.pull_request.number }}/merge fetch-depth: 0 @@ -40,7 +40,7 @@ jobs: > event.json - name: Upload PR context artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: validation-event path: event.json