chore: Update action dependencies

.github/scripts/diff.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-BASE_SHA=$(git log --pretty=format:'%P' -n 1 HEAD | awk '{print $1}')
+: "${BASE_SHA:?BASE_SHA environment variable must be set}"
 ASSET_DIRS="Studio Projects|Agent Projects|Automations|LCM Resource Models|Golden Configs"
 INTEGRATION_MODELS_DIR="OpenAPIs"
 

.github/workflows/init.yml

@@ -10,12 +10,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/promotion.yml

@@ -17,12 +17,14 @@ jobs:
       changed_specs: ${{ steps.diff.outputs.changed_specs }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Find changed files
         id: diff
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: bash .github/scripts/diff.sh
 
 
@@ -34,12 +36,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -64,7 +66,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/validation-deploy.yml

@@ -0,0 +1,117 @@
+name: Itential Asset & Integration Deploy
+
+on:
+  workflow_run:
+    workflows: ["Itential Asset & Integration Validation"]
+    types: [completed]
+
+jobs:
+  load-context:
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    outputs:
+      pr_number: ${{ steps.context.outputs.pr_number }}
+      has_asset_changes: ${{ steps.context.outputs.has_asset_changes }}
+      changed_files: ${{ steps.context.outputs.changed_files }}
+      has_spec_changes: ${{ steps.context.outputs.has_spec_changes }}
+      changed_specs: ${{ steps.context.outputs.changed_specs }}
+    steps:
+      - name: Download validation artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: validation-event
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract PR context
+        id: context
+        run: |
+          PR_NUMBER=$(jq -r .pr_number event.json)
+
+          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
+          {
+            echo "changed_files<<EOF"
+            jq -c .changed_files event.json
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+          {
+            echo "changed_specs<<EOF"
+            jq -c .changed_specs event.json
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+          echo "has_asset_changes=$(jq -r .has_asset_changes event.json)" >> "$GITHUB_OUTPUT"
+          echo "has_spec_changes=$(jq -r .has_spec_changes event.json)" >> "$GITHUB_OUTPUT"
+
+  validate-assets:
+    needs: [load-context]
+    if: needs.load-context.outputs.has_asset_changes == 'true'
+    runs-on: ubuntu-latest
+    environment: staging
+
+    steps:
+      - name: Checkout trusted scripts
+        uses: actions/checkout@v7
+
+      - name: Checkout approved PR content
+        uses: actions/checkout@v7
+        with:
+          ref: refs/pull/${{ needs.load-context.outputs.pr_number }}/merge
+          path: pr
+          allow-unsafe-pr-checkout: true
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+
+      - name: Install asyncplatform
+        run: pip install git+https://github.com/Itential/asyncplatform.git
+
+      - name: Deploy to Staging
+        working-directory: pr
+        env:
+          HOST: ${{ secrets.PLATFORM_HOST }}
+          CLIENT_ID: ${{ secrets.PLATFORM_CLIENT_ID }}
+          CLIENT_SECRET: ${{ secrets.PLATFORM_CLIENT_SECRET }}
+          PROJECT_MEMBERS: ${{ vars.PROJECT_MEMBERS }}
+          CHANGED_FILES: ${{ needs.load-context.outputs.changed_files }}
+        run: python "$GITHUB_WORKSPACE/.github/scripts/deploy.py" Staging
+
+  validate-integrations:
+    needs: [load-context]
+    if: needs.load-context.outputs.has_spec_changes == 'true'
+    runs-on: ubuntu-latest
+    environment: staging
+
+    steps:
+      - name: Checkout trusted scripts
+        uses: actions/checkout@v7
+
+      - name: Checkout approved PR content
+        uses: actions/checkout@v7
+        with:
+          ref: refs/pull/${{ needs.load-context.outputs.pr_number }}/merge
+          path: pr
+          allow-unsafe-pr-checkout: true
+
+      - name: Install ipctl
+        run: |
+          curl -LO "https://github.com/itential/ipctl/releases/latest/download/ipctl-linux-x86_64.tar.gz"
+          tar -xzf ipctl-linux-x86_64.tar.gz
+          sudo mv ipctl /usr/local/bin/
+
+      - name: Configure ipctl
+        env:
+          HOST: ${{ secrets.PLATFORM_HOST }}
+          CLIENT_ID: ${{ secrets.PLATFORM_CLIENT_ID }}
+          CLIENT_SECRET: ${{ secrets.PLATFORM_CLIENT_SECRET }}
+        run: |
+          printf '[profile default]\nhost = %s\nport = 0\nuse_tls = true\nclient_id = %s\nclient_secret = %s\n' \
+            "$HOST" "$CLIENT_ID" "$CLIENT_SECRET" > /tmp/ipctl.ini
+
+      - name: Import integration models
+        working-directory: pr
+        env:
+          IPCTL_CONFIG_FILE: /tmp/ipctl.ini
+          CHANGED_SPECS: ${{ needs.load-context.outputs.changed_specs }}
+        run: bash "$GITHUB_WORKSPACE/.github/scripts/deploy_integrations.sh"

.github/workflows/validation.yml

@@ -0,0 +1,46 @@
+name: Itential Asset & Integration Validation
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+    diff:
+        if: github.event.review.state == 'approved' && github.event.pull_request.base.ref == 'main'
+        runs-on: ubuntu-latest
+        steps:
+          - name: Checkout trusted scripts
+            uses: actions/checkout@v7
+
+          - name: Checkout PR content
+            uses: actions/checkout@v7
+            with:
+              ref: refs/pull/${{ github.event.pull_request.number }}/merge
+              fetch-depth: 0
+              path: pr
+              allow-unsafe-pr-checkout: true
+
+          - name: Find changed files
+            id: diff
+            working-directory: pr
+            env:
+              BASE_SHA: ${{ github.event.pull_request.base.sha }}
+            run: bash "$GITHUB_WORKSPACE/.github/scripts/diff.sh"
+
+          - name: Save PR context for deploy
+            run: |
+              jq -n \
+                --argjson pr_number ${{ github.event.pull_request.number }} \
+                --arg head_sha "${{ github.event.pull_request.head.sha }}" \
+                --arg has_asset_changes "${{ steps.diff.outputs.has_asset_changes }}" \
+                --argjson changed_files '${{ steps.diff.outputs.changed_files }}' \
+                --arg has_spec_changes "${{ steps.diff.outputs.has_spec_changes }}" \
+                --argjson changed_specs '${{ steps.diff.outputs.changed_specs }}' \
+                '{pr_number: $pr_number, head_sha: $head_sha, has_asset_changes: $has_asset_changes, changed_files: $changed_files, has_spec_changes: $has_spec_changes, changed_specs: $changed_specs}' \
+                > event.json
+
+          - name: Upload PR context artifact
+            uses: actions/upload-artifact@v7
+            with:
+              name: validation-event
+              path: event.json