fix.yml

name: Fix

on:
  pull_request_target:
    branches: [master]
  workflow_dispatch:
  workflow_run:
    workflows:
      - "Apply"
    types:
      - completed

defaults:
  run:
    shell: bash

concurrency:
  group: fix-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true # we only care about the most recent fix run for any given PR/ref

jobs:
  prepare:
    # not starting for PRs if repo is private because we cannot write to private forks
    if: github.event_name == 'workflow_dispatch' ||
        (github.event_name == 'pull_request_target' &&
        github.event.pull_request.head.repo.private == false) ||
        (github.event_name == 'workflow_run' &&
        github.event.workflow_run.conclusion == 'success')
    permissions:
      contents: read
      pull-requests: read
    name: Prepare
    runs-on: ubuntu-latest
    outputs:
      workspaces: ${{ steps.workspaces.outputs.this }}
      skip-fix: ${{ steps.skip-fix.outputs.this }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - if: github.event_name == 'pull_request_target'
        env:
          NUMBER: ${{ github.event.pull_request.number }}
          SHA: ${{ github.event.pull_request.head.sha }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git fetch origin "pull/${NUMBER}/head"
          rm -rf github && git checkout "${SHA}" -- github
      - name: Discover workspaces
        id: workspaces
        run: echo "this=$(ls github | jq --raw-input '[.[0:-4]]' | jq -sc add)" >> $GITHUB_OUTPUT
      - name: Check last commit
        id: skip-fix
        env:
          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          # this workflow doesn't continue if the last commit has [skip fix] suffix or there are no user defined fix rules
          if [[ "$(git log --format=%B -n 1 "${SHA}" | head -n 1)" == *"[skip fix]" ]] || ! test -f scripts/src/actions/fix-yaml-config.ts 2> /dev/null; then
            echo "this=true" >> $GITHUB_OUTPUT
          else
            echo "this=false" >> $GITHUB_OUTPUT
          fi
  fix:
    needs: [prepare]
    if: needs.prepare.outputs.skip-fix == 'false'
    permissions:
      contents: read
      pull-requests: write
    strategy:
      fail-fast: false
      matrix:
        workspace: ${{ fromJson(needs.prepare.outputs.workspaces || '[]') }}
    name: Fix
    runs-on: ubuntu-latest
    env:
      TF_IN_AUTOMATION: 1
      TF_INPUT: 0
      TF_WORKSPACE: ${{ matrix.workspace }}
      AWS_ACCESS_KEY_ID: ${{ secrets.RO_AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.RO_AWS_SECRET_ACCESS_KEY }}
      GITHUB_APP_ID: ${{ secrets.RO_GITHUB_APP_ID }}
      GITHUB_APP_INSTALLATION_ID: ${{ secrets[format('RO_GITHUB_APP_INSTALLATION_ID_{0}', matrix.workspace)] || secrets.RO_GITHUB_APP_INSTALLATION_ID }}
      GITHUB_APP_PEM_FILE: ${{ secrets.RO_GITHUB_APP_PEM_FILE }}
      TF_VAR_write_delay_ms: 300
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - if: github.event_name == 'pull_request_target'
        env:
          NUMBER: ${{ github.event.pull_request.number }}
          SHA: ${{ github.event.pull_request.head.sha }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # only checking out github directory from the PR
          git fetch origin "pull/${NUMBER}/head"
          rm -rf github && git checkout "${SHA}" -- github
      - name: Setup terraform
        uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1 # v2.0.3
        with:
          terraform_version: 1.2.9
          terraform_wrapper: false
      - name: Initialize terraform
        run: terraform init
        working-directory: terraform
      - name: Initialize scripts
        run: npm ci && npm run build
        working-directory: scripts
      - name: Fix
        id: fix
        run: node lib/actions/fix-yaml-config.js
        working-directory: scripts
      - name: Upload YAML config
        uses: actions/upload-artifact@v3
        with:
          name: ${{ env.TF_WORKSPACE }}.yml
          path: github/${{ env.TF_WORKSPACE }}.yml
          if-no-files-found: error
          retention-days: 1
      # NOTE(galargh, 2024-02-15): This will only work if GitHub as Code is used for a single organization
      - name: Comment on pull request
        if: github.event_name == 'pull_request_target' && steps.fix.outputs.comment
        uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
        with:
          header: fix
          number: ${{ github.event.pull_request.number }}
          message: ${{ steps.fix.outputs.comment }}

  push:
    needs: [prepare, fix]
    permissions:
      contents: read
    name: Push
    runs-on: ubuntu-latest
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.RO_AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.RO_AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Generate app token
        id: token
        uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92 # v1.8.0
        with:
          app_id: ${{ secrets.RW_GITHUB_APP_ID }}
          installation_id: ${{ secrets[format('RW_GITHUB_APP_INSTALLATION_ID_{0}', github.repository_owner)] || secrets.RW_GITHUB_APP_INSTALLATION_ID }}
          private_key: ${{ secrets.RW_GITHUB_APP_PEM_FILE }}
      - name: Checkout
        uses: actions/checkout@v4
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          token: ${{ steps.token.outputs.token }}
          path: head
      - name: Checkout
        uses: actions/checkout@v4
        with:
          path: base
      - name: Download YAML configs
        uses: actions/download-artifact@v3
        with:
          path: artifacts
      - name: Copy YAML configs
        run: cp artifacts/**/*.yml head/github
      - name: Check if github was modified
        id: github-modified
        run: |
          if [ -z "$(git status --porcelain -- github)" ]; then
            echo "this=false" >> $GITHUB_OUTPUT
          else
            echo "this=true" >> $GITHUB_OUTPUT
          fi
        working-directory: head
      - uses: ./base/.github/actions/git-config-user
        if: steps.github-modified.outputs.this == 'true'
      - if: steps.github-modified.outputs.this == 'true'
        run: |
          git add --all -- github
          git commit -m "fix@${GITHUB_RUN_ID} [skip fix]"
        working-directory: head
      - if: steps.github-modified.outputs.this == 'true' && github.event_name == 'pull_request_target'
        env:
          REF: ${{ github.event.pull_request.head.ref }}
        run: |
          git checkout -B "${REF}"
          git push origin "${REF}"
        working-directory: head
      - if: steps.github-modified.outputs.this == 'true' && github.event_name != 'pull_request_target'
        uses: ./base/.github/actions/git-push
        env:
          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
        with:
          suffix: fix
          working-directory: head