flux-diff.yaml

---
  name: Flux Diff

  on:
    pull_request:
      branches: ["main"]
      paths: ["kubernetes/**"]

  concurrency:
    group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
    cancel-in-progress: true

  jobs:
    flux-diff:
      name: Flux Diff
      runs-on: ubuntu-latest
      permissions:
        pull-requests: write
      strategy:
        matrix:
          paths: ["kubernetes"]
          resources: ["helmrelease", "kustomization"]
        max-parallel: 4
        fail-fast: false
      steps:
        - name: Generate Token
          uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
          id: app-token
          with:
            app-id: "${{ secrets.BOT_APP_ID }}"
            private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"

        - name: Checkout
          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
          with:
            token: "${{ steps.app-token.outputs.token }}"
            ref: "${{ github.event.repository.default_branch }}"
            path: default

        - name: Checkout Pull Request Branch
          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
          with:
            token: "${{ steps.app-token.outputs.token }}"
            path: pull

        - name: Diff Resources
          uses: docker://ghcr.io/allenporter/flux-local:main
          with:
            args: >-
              diff ${{ matrix.resources }}
              --unified 6
              --path-orig /github/workspace/default/${{ matrix.paths }}
              --path /github/workspace/pull/${{ matrix.paths }}
              --strip-attrs "helm.sh/chart,checksum/config,app.kubernetes.io/version,chart"
              --limit-bytes 10000
              --all-namespaces
              --sources "${{ github.event.repository.name }}"
              --output-file diff.patch

        - name: Generate Diff
          id: diff
          run: |
            cat diff.patch
            echo "diff<<EOF" >> $GITHUB_OUTPUT
            cat diff.patch >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT

        - if: ${{ steps.diff.outputs.diff != '' }}
          name: Add Comment
          uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
          with:
            repo-token: "${{ steps.app-token.outputs.token }}"
            message-id: "${{ github.event.pull_request.number }}/${{ matrix.paths }}/${{ matrix.resources }}"
            message-failure: Diff was not successful
            message: |
              ```diff
              ${{ steps.diff.outputs.diff }}
              ```

    # Summarize matrix https://github.community/t/status-check-for-a-matrix-jobs/127354/7
    flux-diff-success:
      if: ${{ always() }}
      needs: ["flux-diff"]
      name: Flux Diff Successful
      runs-on: ubuntu-latest
      steps:
        - if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
          name: Check matrix status
          run: exit 1