ci(flux-diff): adjust workflow

.github/workflows/flux-diff.yaml

@@ -1,56 +1,172 @@
 ---
-name: "Flux Diff"
+# name: "Flux Diff"
+
+# on:
+#   pull_request:
+#     branches: ["main"]
+#     paths: ["kubernetes/**.yaml"]
+
+# permissions:
+#   contents: read
+
+# jobs:
+#   flux-diff:
+#     name: Flux Diff
+#     runs-on: ubuntu-latest
+#     permissions:
+#       pull-requests: write
+#     strategy:
+#       matrix:
+#         path: ["kubernetes"]
+#         resource: ["helmrelease", "kustomization"]
+#     steps:
+#       - name: Harden Runner
+#         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+#         with:
+#           egress-policy: audit
+
+#       - name: Generate Token
+#         uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
+#         id: generate-token
+#         with:
+#           app_id: "${{ secrets.BOT_APP_ID }}"
+#           private_key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
+
+#       - name: Setup Flux CLI
+#         uses: fluxcd/flux2/[email protected]
+
+#       - name: Diff Resources
+#         uses: allenporter/flux-local/action/diff@c4c5ce19ed7aa792b4ead75776597a82242866c6 # 4.2.1
+#         id: diff
+#         with:
+#           sources: home-ops
+#           path: "${{ matrix.path }}"
+#           resource: "${{ matrix.resource }}"
+
+#       - if: ${{ steps.diff.outputs.diff != '' }}
+#         name: Add comment
+#         uses: mshick/add-pr-comment@7c0890544fb33b0bdd2e59467fbacb62e028a096 # v2.8.1
+#         with:
+#           repo-token: "${{ steps.generate-token.outputs.token }}"
+#           message-id: "${{ github.event.pull_request.number }}/${{ matrix.path }}/${{ matrix.resource }}"
+#           message-failure: Diff was not successful
+#           message: |
+#             ```diff
+#             ${{ steps.diff.outputs.diff }}
+#             ```
+
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+name: Flux Diff
 
 on:
   pull_request:
-    branches: ["main"]
-    paths: ["kubernetes/**.yaml"]
+    branches:
+      - main
 
-permissions:
-  contents: read
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
 
 jobs:
+  changed-files:
+    name: Get Changed Files
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.changed-files.outputs.all_changed_and_modified_files }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        with:
+          egress-policy: audit
+
+      - name: Generate Token
+        uses: actions/create-github-app-token@2986852ad836768dfea7781f31828eb3e17990fa # v1.6.2
+        id: app-token
+        with:
+          app-id: "${{ secrets.BOT_APP_ID }}"
+          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
+
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          token: "${{ steps.app-token.outputs.token }}"
+          fetch-depth: 0
+
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@716b1e13042866565e00e85fd4ec490e186c4a2f # v41.0.1
+        with:
+          files: kubernetes/**
+          dir_names: true
+          dir_names_max_depth: 2
+          json: true
+          quotepath: false
+          escape_json: false
+
+      - name: List all changed files
+        run: echo "${{ steps.changed-files.outputs.all_changed_and_modified_files }}"
+
   flux-diff:
     name: Flux Diff
     runs-on: ubuntu-latest
+    needs:
+      - changed-files
     permissions:
       pull-requests: write
+    if: ${{ needs.changed-files.outputs.matrix != '[]' }}
     strategy:
       matrix:
-        path: ["kubernetes"]
-        resource: ["helmrelease", "kustomization"]
+        paths: ${{ fromJSON(needs.changed-files.outputs.matrix) }}
+        resources:
+          - helmrelease
+          - kustomization
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+      - name: Generate Token
+        uses: actions/create-github-app-token@2986852ad836768dfea7781f31828eb3e17990fa # v1.6.2
+        id: app-token
         with:
-          egress-policy: audit
+          app-id: "${{ secrets.BOT_APP_ID }}"
+          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
 
-      - name: Generate Token
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
-        id: generate-token
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
-          app_id: "${{ secrets.BOT_APP_ID }}"
-          private_key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Setup Flux CLI
-        uses: fluxcd/flux2/[email protected]
+        uses: fluxcd/flux2/action@5c5c15ea212b8f029a110f9975851d25c8272695 # v2.2.2
 
       - name: Diff Resources
         uses: allenporter/flux-local/action/diff@c4c5ce19ed7aa792b4ead75776597a82242866c6 # 4.2.1
         id: diff
         with:
-          sources: home-ops
-          path: "${{ matrix.path }}"
-          resource: "${{ matrix.resource }}"
+          sources: home-ops-kubernetes
+          path: "${{ matrix.paths }}"
+          resource: "${{ matrix.resources }}"
 
       - if: ${{ steps.diff.outputs.diff != '' }}
         name: Add comment
         uses: mshick/add-pr-comment@7c0890544fb33b0bdd2e59467fbacb62e028a096 # v2.8.1
         with:
-          repo-token: "${{ steps.generate-token.outputs.token }}"
-          message-id: "${{ github.event.pull_request.number }}/${{ matrix.path }}/${{ matrix.resource }}"
+          repo-token: "${{ steps.app-token.outputs.token }}"
+          message-id: "${{ github.event.pull_request.number }}/${{ matrix.paths }}/${{ matrix.resources }}"
           message-failure: Diff was not successful
           message: |
             ```diff
             ${{ steps.diff.outputs.diff }}
             ```
+
+  flux-diff-success:
+    needs:
+      - flux-diff
+    if: ${{ always() }}
+    name: Flux Diff successful
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check matrix status
+        if: >-
+          ${{
+                contains(needs.*.result, 'failure')
+            || contains(needs.*.result, 'cancelled')
+          }}
+        run: exit 1