api-platform/.github/workflows/platform-api-cloud-release.yml at main · wso2/api-platform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
name: Platform API Cloud Release

# The cloud image is built and pushed to ACR by an Azure DevOps pipeline. This
# workflow no longer builds anything: on a push to a release branch (main or
# platform-api/v0.10.x) — which a merge produces — it just calls the Azure
# pipeline's incoming webhook, passing the repo + branch to build. The payload
# is authenticated with an HMAC-SHA1 signature.
#
# Using `push` (not `pull_request: closed`) means the run has access to secrets
# even when merging a PR opened from a fork, and the workflow that runs is the
# version on the pushed branch.
#
# Required GitHub secrets:
#   AZURE_WEBHOOK_URL    - https://dev.azure.com/<org>/_apis/public/distributedtask/webhooks/PlatformApiCloudReleaseWebhook?api-version=6.0-preview
#   AZURE_WEBHOOK_SECRET - the shared secret configured on the Incoming WebHook service connection

on:
  # Fire on a push to a release branch (merging a PR produces such a push)...
  push:
    branches:
      # main is temporarily disabled while Platform API v1 is in progress.
      - platform-api/v0.10.x
    paths:
      - 'platform-api/**'
      - 'common/**'
      - 'httpkit/**'
      - '.github/workflows/platform-api-cloud-release.yml'
  # ...and allow manual triggering against the current branch.
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: platform-api-cloud-release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  trigger-azure-build:
    runs-on: ubuntu-latest
    steps:
      - name: Trigger Azure DevOps pipeline webhook
        env:
          AZURE_WEBHOOK_URL: ${{ secrets.AZURE_WEBHOOK_URL }}
          AZURE_WEBHOOK_SECRET: ${{ secrets.AZURE_WEBHOOK_SECRET }}
          REPO_URL: ${{ github.server_url }}/${{ github.repository }}
          # push and workflow_dispatch both expose the branch as ref_name and
          # its HEAD (the merge commit, for a PR merge) as sha.
          BRANCH: ${{ github.ref_name }}
          COMMIT: ${{ github.sha }}
        run: |
          set -euo pipefail
          if [ -z "${AZURE_WEBHOOK_URL:-}" ] || [ -z "${AZURE_WEBHOOK_SECRET:-}" ]; then
            echo "::error::AZURE_WEBHOOK_URL and AZURE_WEBHOOK_SECRET secrets must be set."
            exit 1
          fi

          # Build the payload as a file so the signed bytes are exactly what we send.
          # Azure builds the branch HEAD; commit is included only for traceability.
          jq -n \
            --arg repositoryUrl "$REPO_URL" \
            --arg branch "$BRANCH" \
            --arg commit "$COMMIT" \
            '{repositoryUrl: $repositoryUrl, branch: $branch, triggeredByCommit: $commit}' \
            > payload.json

          echo "Payload:"; cat payload.json

          # Azure verifies HMAC-SHA1(secret, body) against the x-webhook-checksum
          # header. The value is the bare hex digest (no "sha1=" prefix).
          CHECKSUM="$(openssl dgst -sha1 -hmac "$AZURE_WEBHOOK_SECRET" payload.json | awk '{print $NF}')"

          HTTP_CODE=$(curl -sS --connect-timeout 10 --max-time 60 -o response.txt -w '%{http_code}' -X POST "$AZURE_WEBHOOK_URL" \
            -H "Content-Type: application/json" \
            -H "x-webhook-checksum: $CHECKSUM" \
            --data-binary @payload.json)

          echo "Azure webhook responded with HTTP ${HTTP_CODE}"
          cat response.txt || true
          echo
          if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
            echo "::error::Failed to trigger Azure pipeline (HTTP ${HTTP_CODE})."
            exit 1
          fi
          echo "Triggered Azure build for ${BRANCH}@${COMMIT}"