ci(github): update flux-diff use implementation from bjw-s

.github/workflows/flux-diff.yaml

@@ -7,62 +7,135 @@ on:
     branches:
       - main
     paths:
-      - kubernetes/**.yaml
+      - kubernetes/**
 
-permissions:
-  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
+  changed-clusters:
+    name: Changed Clusters
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.changed-clusters.outputs.all_changed_and_modified_files }}
+    steps:
+      # https://github.com/marketplace/actions/harden-runner
+      - name: Harden Runner
+        uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
+        with:
+          egress-policy: audit
+
+      # https://github.com/marketplace/actions/checkout
+      - name: Checkout Default Branch
+        uses: actions/[email protected]
+        with:
+          fetch-depth: 0
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+
+      # https://github.com/marketplace/actions/changed-files
+      - name: Get Changed Clusters
+        id: changed-clusters
+        uses: tj-actions/[email protected]
+        with:
+          files: kubernetes/**
+          dir_names: true
+          dir_names_max_depth: 2
+          json: true
+          escape_json: false
+
+      - name: List All Changed Clusters
+        run: echo "${{ steps.changed-clusters.outputs.all_changed_and_modified_files }}"
+
   flux-diff:
     name: Flux Diff
     runs-on: ubuntu-latest
+    needs:
+      - changed-clusters
     permissions:
       pull-requests: write
     strategy:
       matrix:
-        path:
-          - kubernetes/talos-flux
-          - kubernetes/kube-nas
-        resource:
+        paths: ${{ fromJSON(needs.changed-clusters.outputs.matrix) }}
+        resources:
           - helmrelease
           - kustomization
+      max-parallel: 4
+      fail-fast: false
     steps:
-      # https://github.com/marketplace/actions/harden-runner
-      - name: Harden Runner
-        uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
-        with:
-          egress-policy: audit
-
       # https://github.com/marketplace/actions/create-github-app-token
       - name: Generate Token
         uses: actions/create-github-app-token@7bfa3a4717ef143a604ee0a99d859b8886a96d00 # v1.9.3
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
         id: app-token
         with:
-          app-id: "${{ secrets.BOT_APP_ID }}"
-          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+
+      # https://github.com/marketplace/actions/checkout
+      - name: Checkout
+        uses: actions/[email protected]
+        with:
+          token: "${{ steps.app-token.outputs.token }}"
+          path: pull
 
-      # https://github.com/fluxcd/flux2
-      - name: Setup Flux CLI
-        uses: fluxcd/flux2/action@534684601ec8888beb0cc4f51117b59e97606c4d # v2.2.3
+      # https://github.com/marketplace/actions/checkout
+      - name: Checkout Default Branch
+        uses: actions/[email protected]
+        with:
+          token: "${{ steps.app-token.outputs.token }}"
+          ref: "${{ github.event.repository.default_branch }}"
+          path: default
 
-      # https://github.com/allenporter/flux-local
       - name: Diff Resources
-        uses: allenporter/flux-local/action/diff@e630daec1a1bcd24dc80f5100c6e1c7b6a091153 # 4.3.1
-        id: diff
+        uses: docker://ghcr.io/allenporter/flux-local:v5.1.0
         with:
-          sources: home-ops
-          path: "${{ matrix.path }}"
-          resource: "${{ matrix.resource }}"
+          args: >-
+            diff ${{ matrix.resources }}
+            --unified 6
+            --path /github/workspace/pull/${{ matrix.paths }}/flux
+            --path-orig /github/workspace/default/${{ matrix.paths }}/flux
+            --strip-attrs "helm.sh/chart,checksum/config,app.kubernetes.io/version,chart"
+            --limit-bytes 10000
+            --all-namespaces
+            --sources "home-ops-kubernetes"
+            --output-file diff.patch
+
+      - name: Generate Diff
+        id: diff
+        run: |
+          cat diff.patch;
+          {
+            echo 'diff<<EOF'
+            cat diff.patch
+            echo EOF
+          } >> "$GITHUB_OUTPUT";
+          {
+            echo "### Diff"
+            echo '```diff'
+            cat diff.patch
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
 
       # https://github.com/marketplace/actions/add-pr-comment
       - if: ${{ steps.diff.outputs.diff != '' }}
         name: Add comment
         uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
         with:
           repo-token: "${{ steps.app-token.outputs.token }}"
-          message-id: "${{ github.event.pull_request.number }}/${{ matrix.path }}/${{ matrix.resource }}"
+          message-id: "${{ github.event.pull_request.number }}/${{ matrix.paths }}/${{ matrix.resources }}"
           message-failure: Diff was not successful
           message: |
             ```diff
             ${{ steps.diff.outputs.diff }}
-            ```
+
+  flux-diff-success:
+    needs:
+      - flux-diff
+    if: ${{ always() }}
+    name: Flux Diff successful
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check matrix status
+        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+        run: exit 1