certify-operator.yaml

name: Red Hat Operator Certification

on:
  # push:
  #   branches:
  #     - master
  workflow_dispatch:
    inputs:
      branch:
        description: "Branch to build and push"
        type: string
        required: false
      tag:
        description: "Override tag for image"
        type: string
        required: false
      build:
        description: "Whether or not to build the image"
        type: boolean
        default: true
      debug:
        description: "Enable debug steps"
        type: boolean
        default: false

env:
  SCAN_IMAGE: scan.connect.redhat.com/ospid-2953a149-0b38-4515-9768-dd548c234edb/sysdig-operator

jobs:
  docker:
    name: Build and push operator image
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.build_version.outputs.build_version }}
      digest: ${{ steps.image_build.outputs.digest }}

    steps:
      - name: Checkout master
        if: "${{ github.event.inputs.branch == '' }}"
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
          submodules: true

      - name: Checkout branch ${{ github.event.inputs.branch }}
        if: "${{ github.event.inputs.branch != '' }}"
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
          submodules: true
          ref: ${{ github.event.inputs.branch }}

      # workaround a bug where the digest returned by the build and push step
      # is the imageID, not the remote digest
      # https://github.com/docker/build-push-action/issues/461#issuecomment-956882637
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to Red Hat Connect Scanning
        uses: docker/login-action@v1
        with:
          registry: scan.connect.redhat.com
          username: ${{ secrets.REDHAT_SCAN_CONNECT_USERNAME }}
          password: ${{ secrets.REDHAT_SCAN_CONNECT_PASSWORD }}

      - name: Get build version
        id: build_version
        env:
          OVERRIDE_TAG: ${{ github.event.inputs.tag }}
        run: |
          BUILD_VERSION=''
          if [[ -z "$OVERRIDE_TAG" ]]; then
            BUILD_VERSION=$(grep -oP 'VERSION \?= \K[0-9]+\.[0-9]+\.[0-9]+' Makefile)
          else
            BUILD_VERSION=$OVERRIDE_TAG
          fi

          echo "::set-output name=build_version::${BUILD_VERSION}"

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
        with:
          images: |
            ${{ env.SCAN_IMAGE }}
          tags: |
            ${{ steps.build_version.outputs.build_version }}

      - name: Print meta
        if: ${{ github.event.inputs.build == true }}
        run: |
          echo "Tags: ${{ steps.meta.outputs.tags }}"
          echo "labels: ${{ steps.meta.outputs.labels }}"

      - name: Build and push Docker images
        id: image_build
        uses: docker/build-push-action@v3
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  certification:
    name: Certify container with Red Hat
    runs-on: ubuntu-latest
    needs: [docker]

    steps:
      - name: Install Preflight
        uses: redhat-actions/openshift-tools-installer@v1
        with:
          source: "github"
          github_pat: "${{ github.token }}"
          preflight: "latest"

      - name: Login to Red Hat Connect Scanning
        uses: docker/login-action@v1
        with:
          registry: scan.connect.redhat.com
          username: ${{ secrets.REDHAT_SCAN_CONNECT_USERNAME }}
          password: ${{ secrets.REDHAT_SCAN_CONNECT_PASSWORD }}

      - name: Run Preflight on sysdig-operator
        env:
          PYXIS_API_KEY: ${{ secrets.PYXIS_API_KEY }}
        run: |
          preflight check container \
            --docker-config=$HOME/.docker/config.json \
            --submit \
            --pyxis-api-token=${{ secrets.PYXIS_API_KEY }} \
            --certification-project-id=5e6260d3fe2231a0c28603f0 \
            ${{ env.SCAN_IMAGE }}:${{ needs.docker.outputs.version }}

  # for each catalog repo, this job will generate a new version bundle from
  # template and open a PR to the specified upstream. At the moment this doesn't
  # monitor that the PR gets merged
  submit-bundle:
    name: Submit operator bundles to ${{ matrix.catalog }}
    runs-on: ubuntu-latest
    needs: [docker, certification]
    timeout-minutes: 90
    strategy:
      matrix:
        # catalog: [ certified-operators, redhat-marketplace-operators ]
        catalog: [ certified-operators ]
        include:
        - catalog: certified-operators
          bundle: sysdig-certified
          project_id: 5f6385048fa4bb027675f88b
          repo: sysdiglabs/certified-operators
          upstream: redhat-openshift-ecosystem/certified-operators
        - catalog: redhat-marketplace-operators
          bundle: sysdig-certified-rhmp
          project_id: 61818d8fdd607bfc82e65df7
          repo: sysdiglabs/redhat-marketplace-operators
          upstream: redhat-openshift-ecosystem/redhat-marketplace-operators

    env:
      VERSION: ${{ needs.docker.outputs.version }}
      BRANCH_NAME: sysdig-bundle-${{ needs.docker.outputs.version }}
      IMAGE_DIGEST: ${{ needs.docker.outputs.digest }}
      STAGING_DIR: tmp/${{ matrix.catalog }}

    steps:
      - name: Checkout master
        uses: actions/checkout@v2

      - name: Check out staging repo
        uses: actions/checkout@v2
        with:
          repository: ${{ matrix.upstream }}
          fetch-depth: 0
          path: ${{ env.STAGING_DIR }}

      - name: Debug
        run: |
          echo ${{ env.VERSION }}
          echo ${{ env.BRANCH_NAME }}
          echo ${{ env.IMAGE_DIGEST }}
          echo ${{ env.STAGING_DIR }}

      - name: Generate new bundle from template
        run: |
          bash -x scripts/template_bundle.sh \
            -v ${{ env.VERSION }} \
            -i ${IMAGE_DIGEST#"sha256:"} \
            -t rh-bundles/${{ matrix.bundle }}/template \
            -d ${{ env.STAGING_DIR }}/operators/${{ matrix.bundle }}

      # Push changes to fork and automatically create PR to upstream
      - name: Create pull request
        id: create_pull_request
        uses: peter-evans/create-pull-request@v4
        with:
          token: ${{ secrets.PULL_REQUEST_GITHUB_TOKEN }}
          path: ${{ env.STAGING_DIR }}
          branch: ${{ env.BRANCH_NAME }}
          push-to-fork: ${{ matrix.repo }}
          commit-message: Update ${{ matrix.bundle }} to ${{ env.VERSION }}
          title: operator ${{ matrix.bundle }} (v${{ env.VERSION }})
          body: |
            **New operator bundle**

            Name: **${{ matrix.bundle }}**
            Version: **v${{ env.VERSION }}**

            Certification project: ${{ matrix.project_id }}

      - name: Wait for PR to merge
        run: |
          # checks the Github Pulls API for a successful merge, indicated by a
          # 204 status code returned
          # https://docs.github.com/en/rest/pulls/pulls#check-if-a-pull-request-has-been-merged
          export STAT_CODE=$(curl -I -s -o /dev/null -w "%{http_code}" \
            -H "Accept: application/vnd.github+json" \
            https://api.github.com/repos/${{ matrix.upstream }}/pulls/${{ steps.create_pull_request.outputs.pull-request-number }}/merge)

          timeout 60m bash -c 'until [[ "$STAT_CODE" == "204" ]]; do
            echo "PR unmerged, checking again in 5m"
            sleep 5m
            STAT_CODE=$(curl -I -s -o /dev/null -w "%{http_code}" \
              -H "Accept: application/vnd.github+json" \
              https://api.github.com/repos/${{ matrix.upstream }}/pulls/${{ steps.create_pull_request.outputs.pull-request-number }}/merge)
          done'

          if [[ "$?" != "0" ]]; then
            echo "PR wasn't merged before timeout."
            echo "Check for errors at ${{ steps.create_pull_request.outputs.pull_request-url }}."
          fi