flux-diff.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: Flux Diff

on:
  pull_request:
    branches:
      - main
    paths:
      - kubernetes/**.yaml

permissions:
  contents: read

jobs:
  flux-diff:
    name: Flux Diff
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    strategy:
      matrix:
        path:
          - kubernetes/talos-flux
          - kubernetes/kube-nas
        resource:
          - helmrelease
          - kustomization
    steps:
      # https://github.com/marketplace/actions/harden-runner
      - name: Harden Runner
        uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
        with:
          egress-policy: audit

      # https://github.com/marketplace/actions/create-github-app-token
      - name: Generate Token
        uses: actions/create-github-app-token@7bfa3a4717ef143a604ee0a99d859b8886a96d00 # v1.9.3
        id: app-token
        with:
          app-id: "${{ secrets.BOT_APP_ID }}"
          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"

      # https://github.com/fluxcd/flux2
      - name: Setup Flux CLI
        uses: fluxcd/flux2/action@534684601ec8888beb0cc4f51117b59e97606c4d # v2.2.3

      # https://github.com/allenporter/flux-local
      - name: Diff Resources
        uses: allenporter/flux-local/action/diff@e630daec1a1bcd24dc80f5100c6e1c7b6a091153 # 4.3.1
        id: diff
        with:
          sources: home-ops
          path: "${{ matrix.path }}"
          resource: "${{ matrix.resource }}"

      # https://github.com/marketplace/actions/add-pr-comment
      - if: ${{ steps.diff.outputs.diff != '' }}
        name: Add comment
        uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
        with:
          repo-token: "${{ steps.app-token.outputs.token }}"
          message-id: "${{ github.event.pull_request.number }}/${{ matrix.path }}/${{ matrix.resource }}"
          message-failure: Diff was not successful
          message: |
            ```diff
            ${{ steps.diff.outputs.diff }}
            ```