flux-diff.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: flux diff

on:
  workflow_call:
    inputs:
      runner:
        description: runner name
        type: string
        required: true
      path:
        description: path to flux
        required: true
        type: string
      resources:
        description: type of resources to diff
        required: false
        type: string
        default: '["helmrelease", "kustomization"]'
      sources:
        description: starting point of flux source path (f.e. flux-system=./oci)
        required: false
        type: string
      cluster-repo-owner:
        description: production cluster repo owner
        required: false
        type: string
      cluster-repo:
        description: production cluster repo name
        required: false
        type: string

    secrets:
      github-app-id:
        description: github app id
        required: false
      github-app-key:
        description: github app private key
        required: false

jobs:
  diff:
    runs-on: ${{ inputs.runner }}
    permissions:
      contents: read
      pull-requests: write
    strategy:
      matrix:
        resource: ${{ fromJSON(inputs.resources) }}
      fail-fast: false
    steps:
      # https://github.com/marketplace/actions/create-github-app-token
      - name: generate token
        id: generate-token
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
        with:
          app-id: ${{ secrets.github-app-id }}
          private-key: ${{ secrets.github-app-key }}
          owner: ${{ github.repository_owner }}

      # https://github.com/marketplace/actions/sticky-pull-request-comment
      - name: clear comment
        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
        with:
          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
          header: ${{ github.event.pull_request.number }}/${{ matrix.resource }}
          message: |
            ### ${{ matrix.resource }} - generating diff...

      # https://github.com/marketplace/actions/checkout
      - name: checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          token: ${{ steps.generate-token.outputs.token }}
          path: pull

      # https://github.com/marketplace/actions/checkout
      - name: checkout cluster repo
        if: ${{ inputs.cluster-repo }}
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          token: ${{ steps.generate-token.outputs.token }}
          repository: ${{ inputs.cluster-repo-owner }}/${{ inputs.cluster-repo }}
          path: pull/${{ inputs.path }}/${{ inputs.cluster-repo }}

      # https://github.com/marketplace/actions/checkout
      - name: checkout default branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          token: ${{ steps.generate-token.outputs.token }}
          ref: ${{ github.event.repository.default_branch }}
          path: default

      # https://github.com/marketplace/actions/checkout
      - name: checkout cluster default branch
        if: ${{ inputs.cluster-repo }}
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          token: ${{ steps.generate-token.outputs.token }}
          repository: ${{ inputs.cluster-repo-owner }}/${{ inputs.cluster-repo }}
          path: default/${{ inputs.path }}/${{ inputs.cluster-repo }}

      # https://github.com/alexellis/arkade-get
      - name: install flux
        if: ${{ inputs.cluster-repo }}
        uses: alexellis/arkade-get@9e54a21834fc66091cc396d72688266af305591d
        with:
          print-summary: false
          flux: latest

      - name: run docker and push artifact
        if: ${{ inputs.cluster-repo }}
        run: |
          docker run -d --rm --name kind-registry -p 5050:5000 registry:2.8.1
          flux push artifact oci://localhost:5050/${{ github.event.repository.name }}:local \
            --path="pull/${{ inputs.path }}" \
            --source="local" \
            --revision="latest"

      # https://github.com/allenporter/flux-local
      - name: run flux-local diff
        uses: docker://ghcr.io/allenporter/flux-local:v8.1.0@sha256:37c3c4309a351830b04f93c323adfcb0e28c368001818cd819cbce3e08828261
        with:
          args: >-
            diff ${{ matrix.resource }}
            --all-namespaces
            --path /github/workspace/pull/${{ inputs.path }}/flux
            --path-orig /github/workspace/default/${{ inputs.path }}/flux
            ${{ inputs.sources && format('--sources {0}', inputs.sources) || '' }}
            --strip-attrs "helm.sh/chart,checksum/config,app.kubernetes.io/version,chart"
            --unified 6
            --limit-bytes 9940
            --output-file diff.patch

      - name: generate diff
        id: diff
        run: |
          if [ -f diff.patch ] && [ -s diff.patch ]; then
            echo 'diff<<EOF' >> "$GITHUB_OUTPUT"
            cat diff.patch >> "$GITHUB_OUTPUT"
            echo 'EOF' >> "$GITHUB_OUTPUT"
            {
              echo "### flux diff (${{ matrix.resource }})"
              echo '```diff'
              cat diff.patch
              echo '```'
            } >> "$GITHUB_STEP_SUMMARY"
          else
            echo 'diff<<EOF' >> "$GITHUB_OUTPUT"
            echo 'no changes found' >> "$GITHUB_OUTPUT"
            echo 'EOF' >> "$GITHUB_OUTPUT"
          fi

      # https://github.com/marketplace/actions/sticky-pull-request-comment
      - name: add comment
        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
        with:
          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
          header: ${{ github.event.pull_request.number }}/${{ matrix.resource }}
          message: |
            ### ${{ matrix.resource }}
            ```diff
            ${{ steps.diff.outputs.diff }}
            ```