flux-diff.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: Flux Diff

on:
  pull_request:
    branches:
      - main
    paths:
      - kubernetes/**

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: true

jobs:
  changed-clusters:
    name: Changed Clusters
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.changed-clusters.outputs.all_changed_and_modified_files }}
    steps:
      # https://github.com/marketplace/actions/harden-runner
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          egress-policy: audit

      # https://github.com/marketplace/actions/checkout
      - name: Checkout Default Branch
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          repository: ${{ github.event.pull_request.head.repo.full_name }}

      # https://github.com/marketplace/actions/changed-files
      - name: Get Changed Clusters
        id: changed-clusters
        uses: tj-actions/changed-files@4edd678ac3f81e2dc578756871e4d00c19191daf # v45.0.4
        with:
          files: |
            kubernetes/talos-flux/**
            kubernetes/kube-nas/**
          dir_names: true
          dir_names_max_depth: 2
          json: true
          escape_json: false

      - name: List All Changed Clusters
        run: echo "${{ steps.changed-clusters.outputs.all_changed_and_modified_files }}"

  flux-diff:
    name: Flux Diff
    runs-on: ubuntu-latest
    needs:
      - changed-clusters
    permissions:
      pull-requests: write
    strategy:
      matrix:
        paths: ${{ fromJSON(needs.changed-clusters.outputs.matrix) }}
        resources:
          - helmrelease
          - kustomization
      max-parallel: 4
      fail-fast: false
    steps:
      # https://github.com/marketplace/actions/create-github-app-token
      - name: Generate Token
        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
        id: app-token
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      # https://github.com/marketplace/actions/checkout
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          token: "${{ steps.app-token.outputs.token }}"
          path: pull

      # https://github.com/marketplace/actions/checkout
      - name: Checkout Default Branch
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          token: "${{ steps.app-token.outputs.token }}"
          ref: "${{ github.event.repository.default_branch }}"
          path: default

      - name: Diff Resources
        uses: docker://ghcr.io/allenporter/flux-local:v6.0.2@sha256:75724e414519d955027a7b2b9eb0c64aa7d41dc2b5cfd2607d46cdeff79f713c
        with:
          args: >-
            diff ${{ matrix.resources }}
            --unified 6
            --path /github/workspace/pull/${{ matrix.paths }}/flux
            --path-orig /github/workspace/default/${{ matrix.paths }}/flux
            --strip-attrs "helm.sh/chart,checksum/config,app.kubernetes.io/version,chart"
            --limit-bytes 10000
            --all-namespaces
            --sources "home-ops"
            --output-file diff.patch

      - name: Generate Diff
        id: diff
        run: |
          cat diff.patch;
          {
            echo 'diff<<EOF'
            cat diff.patch
            echo EOF
          } >> "$GITHUB_OUTPUT";
          {
            echo "### Diff"
            echo '```diff'
            cat diff.patch
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      # https://github.com/marketplace/actions/add-pr-comment
      - if: ${{ steps.diff.outputs.diff != '' }}
        name: Add comment
        uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
        with:
          repo-token: "${{ steps.app-token.outputs.token }}"
          message-id: "${{ github.event.pull_request.number }}/${{ matrix.paths }}/${{ matrix.resources }}"
          message-failure: Diff was not successful
          message: |
            ```diff
            ${{ steps.diff.outputs.diff }}

  flux-diff-success:
    needs:
      - flux-diff
    if: ${{ always() }}
    name: Flux Diff successful
    runs-on: ubuntu-latest
    steps:
      - name: Check matrix status
        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
        run: exit 1