verify-release.yaml

# THIS CODE WAS AUTOGENERATED. DO NOT MODIFY THIS FILE DIRECTLY
# THE SOURCE CODE LIVES IN A DIFFERENT REPOSITORY:
#   - centralized-templates
# FILE STEWARD: @pleo-io/devx

name: Verify Release
# This verifies that a given PR has the required labels before merge into the default branch.
on:
  pull_request:
    types:
      - opened
      - edited
      - labeled
      - unlabeled
      - synchronize
      - ready_for_review

jobs:
  auto-version-pr:
    name: Detect OpenAPI changes
    if: ${{ (github.event.repository.language == 'Kotlin' || github.event.repository.language == 'Java') && github.event.pull_request.draft == false && false && github.event.action != 'unlabeled' }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    concurrency: ci-${{ github.workflow }}-${{ github.ref }}
    steps:
      # Caches openapi docs
      - name: Caches generated openapi docs
        id: cache-docs
        uses: actions/cache@v3
        with:
          path: |
            generated.yaml
            existing.yaml
          key: OpenApiDocs-${{ github.workflow }}-${{ github.sha }}

      # Checkout the default branch
      - name: Checkout '${{ github.event.repository.default_branch }}'
        if: steps.cache-docs.outputs.cache-hit != 'true'
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.repository.default_branch }}

      # Set up a JDK environment for building, testing and releasing.
      - name: Setup JDK 17
        if: steps.cache-docs.outputs.cache-hit != 'true'
        uses: actions/setup-java@v3.12.0
        with:
          java-version: 17
          distribution: temurin

      # Allow caching Gradle executions to further speed up CI/CD steps invoking Gradle.
      - name: Setup Gradle
        if: steps.cache-docs.outputs.cache-hit != 'true'
        uses: gradle/gradle-build-action@v2.7.0
        with:
          gradle-executable: ./gradlew
          gradle-version: wrapper
          gradle-home-cache-cleanup: true
          cache-read-only: true

      # Generate the '${{ github.event.repository.default_branch }}' OpenAPI definition.
      - name: Generate '${{ github.event.repository.default_branch }}' OpenAPI spec
        if: steps.cache-docs.outputs.cache-hit != 'true'
        run: |
          ./gradlew pleo-"$REPOSITORY_NAME"-rest:resolve --stacktrace
        env:
          GITHUB_TOKEN: ${{ secrets.GH_REGISTRY_GRADLE_TOKEN }}
          GRADLE_READ_KEY: ${{ secrets.GH_REGISTRY_GRADLE_TOKEN }}
          REPOSITORY_NAME: ${{ github.event.repository.name }}

      - name: Move OpenAPI schema
        if: steps.cache-docs.outputs.cache-hit != 'true'
        run: |
          echo "Using OpenAPI spec path: 'pleo-$REPOSITORY_NAME-rest'"
          FILE_PATH="$(find "pleo-$REPOSITORY_NAME-rest" -type f -name "$REPOSITORY_NAME-openapi.yaml" -not -path "pleo-$REPOSITORY_NAME-rest/build/*")"
          mv "$FILE_PATH" "$NEW_PATH"
        env:
          REPOSITORY_NAME: ${{ github.event.repository.name }}
          NEW_PATH: existing.yaml

      - name: Checkout HEAD
        if: steps.cache-docs.outputs.cache-hit != 'true'
        uses: actions/checkout@v3
        with:
          ref: ${{ env.GITHUB_SHA }}
          clean: false

      # Generate modified OpenAPI definition from changes.
      - name: Generate 'HEAD' OpenAPI spec
        if: steps.cache-docs.outputs.cache-hit != 'true'
        run: |
          ./gradlew pleo-"$REPOSITORY_NAME"-rest:resolve --stacktrace
        env:
          GITHUB_TOKEN: ${{ secrets.GH_REGISTRY_GRADLE_TOKEN }}
          GRADLE_READ_KEY: ${{ secrets.GH_REGISTRY_GRADLE_TOKEN }}
          REPOSITORY_NAME: ${{ github.event.repository.name }}

      - name: Move OpenAPI schema
        if: steps.cache-docs.outputs.cache-hit != 'true'
        run: |
          echo "Using OpenAPI spec path: 'pleo-$REPOSITORY_NAME-rest'"
          FILE_PATH="$(find "pleo-$REPOSITORY_NAME-rest" -type f -name "$REPOSITORY_NAME-openapi.yaml" -not -path "pleo-$REPOSITORY_NAME-rest/build/*")"
          mv "$FILE_PATH" "$NEW_PATH"
        env:
          REPOSITORY_NAME: ${{ github.event.repository.name }}
          NEW_PATH: generated.yaml

      - name: Show spec contents
        run: |
          echo "::group::existing.yaml"
          cat existing.yaml
          echo "::group::generated.yaml"
          cat generated.yaml

      # Install OpenAPI diff tools.
      - name: Install 'openapi-diff'
        run: |
          npm install openapi-diff yaml

      # Diff OpenAPI specs.
      - name: Diff OpenAPI specs
        id: openapi-diff
        uses: actions/github-script@v6
        continue-on-error: true
        with:
          result-encoding: string
          script: |
            const fs = require('fs/promises')
            const yaml = require('yaml')
            const openapiDiff = require('openapi-diff')
            const [existingContents, generatedContents] = await Promise.all([fs.readFile('existing.yaml', 'utf-8'), fs.readFile('generated.yaml', 'utf-8')])
            const [existing, generated] = [yaml.parse(existingContents), yaml.parse(generatedContents)]
            const {breakingDifferencesFound, nonBreakingDifferences} = await openapiDiff.diffSpecs({
              sourceSpec: { content: JSON.stringify(existing), location: 'existing.yaml', format: 'openapi3' },
              destinationSpec: { content: JSON.stringify(generated), location: 'generated.yaml', format: 'openapi3' }
            })
            core.info(`Saw breaking differences: ${breakingDifferencesFound}`)
            core.info(`Saw non-breaking differences: ${JSON.stringify(nonBreakingDifferences)}`)
            if (breakingDifferencesFound) {
              core.info('Detected breaking changes (major).')
              return 'major'
            }
            if (nonBreakingDifferences.length > 0) {
              core.info('Detected non-breaking changes (minor).')
              return 'minor'
            }
            core.info('Detected no changes (unknown).')
            return 'unknown'

      - name: Get all PR labels
        id: pr-labels
        uses: joerick/pr-labels-action@v1.0.9

      - name: Add labels for unlabelled PRs
        if: ${{ steps.pr-labels.outputs.labels == '' && (steps.openapi-diff.outputs.result != 'unknown' || steps.openapi-diff.outputs.result != '') }}
        uses: actions-ecosystem/action-add-labels@v1
        with:
          labels: ${{ steps.openapi-diff.outputs.result }}

      - name: Add 'minor' label for non-breaking changes
        if: contains(steps.pr-labels.outputs.labels, 'minor') != true && steps.openapi-diff.outputs.result == 'minor'
        uses: actions-ecosystem/action-add-labels@v1
        with:
          labels: ${{ steps.openapi-diff.outputs.result }}

      - name: Add 'major' label for breaking changes
        if: contains(steps.pr-labels.outputs.labels, 'major') != true && steps.openapi-diff.outputs.result == 'major'
        uses: actions-ecosystem/action-add-labels@v1
        with:
          labels: ${{ steps.openapi-diff.outputs.result }}

  verify-release:
    name: Verify Release
    runs-on: ubuntu-latest
    needs: auto-version-pr
    timeout-minutes: 10
    if: always()
    steps:
      - name: Checkout code
        uses: actions/checkout@v3.5.3

      # Allow Renovate to pass this check on checks on branches where a PR isn't present yet.
      - name: Determine author
        id: determine_author
        run: |
          AUTHOR="$(git log -1 --pretty=format:'%an' | xargs -0)"
          echo "$AUTHOR"
          echo "author=$AUTHOR" >> "$GITHUB_OUTPUT"

      - name: Verify PR labels
        id: verify_pr_labels
        if: steps.determine_author.outputs.author != 'Renovate (Pleo)'
        uses: docker://agilepathway/pull-request-label-checker:latest
        with:
          any_of: major,minor,patch,internal
          repo_token: ${{ secrets.GITHUB_TOKEN }}