pin_downstream.yml

name: "Pin: Downstream: 2nd party"

# TODO 3rd party will be based off ActivityPub
# - References
#   - RFCv5.1: IETF SCITT: Use Case: Attestations of alignment to S2C2F and org Overlays: https://github.com/ietf-scitt/use-cases/blob/a832905e3c428fd54b1c08d4851801383eac91a6/openssf_metrics.md#use-case-attestations-of-alignment-to-s2c2f-and-org-overlays

on:
  pull_request_target:
    types:
      - opened
      - synchronize
      - reopened
    branches:
      - main
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  manifest:
    runs-on: ubuntu-latest
    # Disabled currently
    if: false
    outputs:
      length: ${{ steps.create-manifest-instance.outputs.length }}
      manifest: ${{ steps.create-manifest-instance.outputs.github_actions_manifest }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          egress-policy: audit

      - name: Set up Python
        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
        with:
          python-version: "3.11"
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Build manifest from plugins.json from pull request
        id: create-manifest-instance
        env:
          PLUGINS_JSON: "dffml/plugins.json"
          SCHEMA: "TODO-dffml-2ndparty-pin"
          JSON_INDENT: "    "
        shell: python -u {0}
        run: |
          import os
          import json
          import pathlib

          plugins = json.loads(pathlib.Path(os.environ["PLUGINS_JSON"]).read_text())
          manifest = plugins["plugins"]["parties"]["2nd"]
          
          # SECURITY Allowlist of 2nd party orgs to pin
          for downstream in manifest:
              if not downstream["source_url"].startswith("https://github.com/dffml/"):
                  raise ValueError(f"source_url not in allowed org: {downstream!r}")

          github_actions_manifest = {
              "include": manifest,
          }
          json_ld_manifest = {
              "@context": {
                  "@vocab": os.environ["SCHEMA"],
              },
              **github_actions_manifest,
          }
          print(json.dumps(json_ld_manifest, sort_keys=True, indent=os.environ.get("JSON_INDENT", None)))

          if "GITHUB_OUTPUT" in os.environ:
              with open(os.environ["GITHUB_OUTPUT"], "a") as fileobj:
                  fileobj.write(f'length={len(manifest)}\n')
                  fileobj.write(f"manifest={json.dumps(manifest, sort_keys=True)}\n")
                  fileobj.write(f'github_actions_manifest={json.dumps(github_actions_manifest, sort_keys=True)}\n')
                  fileobj.write(f'json_ld_manifest={json.dumps(json_ld_manifest, sort_keys=True)}\n')

  
  pin_downstream_pep_440:
    permissions:
      contents: write  # for Git to git push
    name: "Pin downstream to latest commit"
    runs-on: ubuntu-latest
    # Disabled currently
    if: false
    env:
      PIN_PULL_REQUEST_EMAIL: 'alice.omega.alpha@outlook.com'
      PIN_PULL_REQUEST_NAME: 'Alice Alchemy'
      GH_ACCESS_TOKEN: ${{ secrets.PIN_DOWNSTREAM_2ND_PARTY_GH_ACCESS_TOKEN }}
      PIN_TO_COMMIT: ${{ github.event.after || github.event.pull_request.head.sha }}
      UPSTREAM_PACKAGE_NAME: 'dffml'
      BUMP_DEP: "dffml @ https://github.com/intel/dffml/archive/"
    needs:
    - manifest
    strategy:
      fail-fast: false
      max-parallel: 100
      matrix: ${{ fromJSON(needs.manifest.outputs.manifest) }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          egress-policy: audit

      - name: Checkout downstream
        env:
          # TODO Pull requests on pull requests, probably from renovate/dependabot
          # https://github.com/intel/dffml/pull/1061#pullrequestreview-1281885921
          TARGET_REPO_URL: ${{ matrix.source_url }}
          TARGET_BRANCH: ${{ matrix.branch }}
          TARGET_COMMIT: ${{ matrix.branch }}
        run: |
          set -x
          git init
          git remote add origin "${TARGET_REPO_URL}"
          git fetch origin "${TARGET_BRANCH}" --depth 1
          git fetch origin "${TARGET_COMMIT}" --depth 1
          git reset --hard "origin/${TARGET_COMMIT}"
      - name: Find repo local dependent files
        id: repo-local-downstream
        run: |
          set -x
          get_files() {
            git grep "${BUMP_DEP}" | sed -e 's/:.*//g' | sort | uniq
          }
          echo files_length=$(get_files | wc -l) >> $GITHUB_OUTPUT
      - name: Update pinning of upstream within downstream
        if: ${{ fromJSON(steps.repo-local-downstream.outputs.files_length) > 0 }}
        id: create-pull-request
        env:
          NEW_HASH: ${{ env.PIN_TO_COMMIT }}
          COMMIT_MESSAGE: "setup: Pin ${{ env.UPSTREAM_PACKAGE_NAME }} to ${{ env.PIN_TO_COMMIT }}\n${{ github.event.pull_request.html_url }}\n${{ github.server_url }}/${{ github.repository }}/commit/${{ env.PIN_TO_COMMIT }}\n${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          NEW_BRANCH_WITH_PIN: "pin/pep_440/${{ github.repository }}/${{ env.PIN_TO_COMMIT }}"
          FILES: ${{ toJSON(steps.repo-local-downstream.outputs.files) }}
          BASE: ${{ matrix.branch }}
        run: |
          set -x
          get_files() {
            git grep "${BUMP_DEP}" | sed -e 's/:.*//g' | sort | uniq
          }
          # https://github.com/dffml/dffml-model-transformers/blob/898af4a51d9b5d70d58ce80ba2c508f3afa82400/setup.cfg#L6
          sed -i -r -e "s#${BUMP_DEP}[A-Fa-f0-9]{40}#${BUMP_DEP}${NEW_HASH}#g" $(get_files)
          git checkout -b "${NEW_BRANCH_WITH_PIN}"
          git config user.email "${PIN_PULL_REQUEST_EMAIL}"
          git config user.name "${PIN_PULL_REQUEST_NAME}"
          git commit -sam "${COMMIT_MESSAGE}"
          git log -n 1 -p

          mkdir -p ~/.config/gh/
          echo "github.com:" > ~/.config/gh/hosts.yml
          echo "    oauth_token: ${GH_ACCESS_TOKEN}" >> ~/.config/gh/hosts.yml
          echo "    user: token" >> ~/.config/gh/hosts.yml
          echo "    git_protocol: https" >> ~/.config/gh/hosts.yml
          gh auth setup-git

          git push -u origin -f "${NEW_BRANCH_WITH_PIN}"
          gh pr create --base "${BASE}" --head "${NEW_BRANCH_WITH_PIN}" --title "${COMMIT_MESSAGE}" --body "" | tee pull-request-url
          PULL_REQUEST_URL="$(cat pull-request-url)"
          if [[ "x${PULL_REQUEST_URL}" == "x" ]]; then
            echo "No pull request URL" 1>&2
            exit 1
          fi
          echo "url=${PULL_REQUEST_URL}" | tee -a $GITHUB_OUTPUT