validate.yml

name: Validate Otterdog Configuration

on:
  workflow_dispatch:
  pull_request_target:
    branches: [ main ]

permissions:
  contents: read
  pull-requests: write

jobs:
  validate:
    # do not run the workflow in the template repo itself
    if: ${{ !contains (github.repository, '/.eclipsefdn-template') }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout OtterDog
        run: git clone https://gitlab.eclipse.org/eclipsefdn/security/otterdog.git

      - name: Checkout EclipseFdn/otterdog-configs
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          repository: EclipseFdn/otterdog-configs
          path: otterdog-configs

      # checkout the head ref of the PR
      # NOTE: in general it is bad practice to check out the pull request HEAD for PRs originating from forked repos,
      #       however, this validation workflow produces a diff between the changes in the PR with the base ref, thus
      #       doing this is acceptable, see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
      - name: Checkout HEAD ref of the PR
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          path: ${{ github.repository_owner }}

      # checkout the base ref of the PR
      - name: Checkout BASE ref of the PR (target branch)
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          ref: ${{ github.base_ref }}
          path: ${{ github.repository_owner }}-base

      - name: Install jsonnet-bundler
        run: |
          go install -a github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb@v0.5.1
          echo $(go env GOPATH)/bin >> $GITHUB_PATH

      - name: Install poetry
        run: pipx install poetry

      - name: Setup Python
        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
        with:
          python-version: '3.10'
          cache: 'poetry'

      - name: Install dependencies with poetry
        run: |
          poetry install --only=main
        working-directory: otterdog

      - name: Copy configuration from HEAD and BASE ref
        run: |
          mkdir -p orgs/${{ github.repository_owner }}
          cp -r ../${{ github.repository_owner }}/otterdog/* orgs/${{ github.repository_owner }}
          cp ../${{ github.repository_owner }}-base/otterdog/${{ github.repository_owner }}.jsonnet orgs/${{ github.repository_owner }}/${{ github.repository_owner }}.jsonnet-BASE 
        working-directory: otterdog-configs

      - name: Validate Otterdog Configuration and diff HEAD <-> BASE
        id: validate
        run: |
          # use script to enable ansi color output
          script -e -q /dev/null --command "../otterdog/otterdog.sh local-plan ${{ github.repository_owner }} -c otterdog.json --suffix=-BASE" | tee "$GITHUB_WORKSPACE/diff-ansi.txt"
          echo "VALIDATION_STATUS=${PIPESTATUS[0]}" >> $GITHUB_OUTPUT
          # filter out ansi escape sequences again, use sed as ansi2txt is not available
          cat "$GITHUB_WORKSPACE/diff-ansi.txt" | sed -e 's/\x1b\[[0-9;]*m//g' | sed -E 's/^([[:space:]]+)([-+!])/\2\1/g' | sed -E 's/^([[:space:]]+)([~])/!\1/g' > "$GITHUB_WORKSPACE/diff.txt"
        working-directory: otterdog-configs

      - name: Generate canonical diff
        run: |
          ../otterdog/otterdog.sh canonical-diff ${{ github.repository_owner }} -c otterdog.json | tee "$GITHUB_WORKSPACE/canonical-diff-ansi.txt"
          # filter out ansi escape sequences
          cat "$GITHUB_WORKSPACE/canonical-diff-ansi.txt" | sed -e 's/\x1b\[[0-9;]*m//g' | sed -E 's/^([[:space:]]+)([-+!])/\2\1/g' | sed -E 's/^([[:space:]]+)([~])/!\1/g' > "$GITHUB_WORKSPACE/canonical-diff.txt"
        working-directory: otterdog-configs

      # Add a comment to the pull request with the diff

      - name: Generate comment
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            const commentText = 'Diff for ' + process.env.GITHUB_SHA + ':';
            const canonicalCommentText = 'Canonical Diff for ' + process.env.GITHUB_SHA + ':';

            const fs = require('fs');
            const diff = fs.readFileSync(process.env.GITHUB_WORKSPACE + '/diff.txt').toString().trimEnd();
            const canonicalDiff = fs.readFileSync(process.env.GITHUB_WORKSPACE + '/canonical-diff.txt').toString().trimEnd();

            var body = "<details>\n<summary>" + commentText + "</summary>\n\n```diff\n" + diff + "\n```\n\n</details>\n" +
                       "<details>\n<summary>" + canonicalCommentText + "</summary>\n\n```diff\n" + canonicalDiff + "\n```\n\n</details>";

            fs.writeFileSync(process.env.GITHUB_STEP_SUMMARY, body);
            fs.writeFileSync(process.env.GITHUB_WORKSPACE + '/comment.txt', body);

      - name: Attach comment to PR
        uses: marocchino/sticky-pull-request-comment@efaaab3fd41a9c3de579aba759d2552635e590fd # v2.8.0
        with:
          hide_and_recreate: true
          hide_classify: "OUTDATED"
          path: ${{ github.workspace }}/comment.txt

      - name: Propagate validation exit status
        run: |
          exit ${{ steps.validate.outputs.VALIDATION_STATUS }}