handle.yml

# Copyright 2023 The Authors (see AUTHORS file)

# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at

#      http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: 'aod-handle'
# Current workflow requires the triggering event must be pull_request_review as
# it relies on this event to get the approval submit time as IAM permission
# expiration start time.
on:
  workflow_call:
    inputs:
      workload_identity_provider:
        description: 'The full identifier of the Workload Identity Provider, including the project number, pool name, and provider name.'
        type: 'string'
        required: true
      service_account:
        description: 'Email address or unique identifier of the Google Cloud service account for which to generate credentials.'
        type: 'string'
        required: true
      aod_cli_version:
        description: 'The version of AOD CLI, without the "v" prefix, e.g. "0.1.2".'
        type: 'string'
        required: true
      go_version:
        description: 'The version of Golang.'
        type: 'string'
        default: '1.21'
        required: false

env:
  DEFAULT_DURATION: '2h'
  IAM_ERROR_FILENAME: '/tmp/iam_error.txt'
  IAM_OUT_FILENAME: '/tmp/iam_output.txt'
  TOOL_ERROR_FILENAME: '/tmp/tool_error.txt'
  TOOL_OUT_FILENAME: '/tmp/tool_output.txt'

jobs:
  review_status:
    runs-on: 'ubuntu-latest'
    permissions:
      pull-requests: 'read'
    outputs:
      REVIEW_DECISION: '${{ steps.get_breakglass_decision.outputs.REVIEW_DECISION || steps.get_review_decision.outputs.REVIEW_DECISION }}'
    steps:
      - id: 'get_breakglass_decision'
        if: |-
          contains(github.event.pull_request.labels.*.name, 'aod-breakglass')
        run: |
          echo REVIEW_DECISION=BREAKGLASS >> $GITHUB_OUTPUT

      - id: 'get_review_decision'
        if: |-
          !contains(github.event.pull_request.labels.*.name, 'aod-breakglass')
        env:
          # Set the GH_TOKEN environment variable to use GitHub CLI in a GitHub Actions workflow.
          # See ref: https://docs.github.com/en/actions/using-workflows/using-github-cli-in-workflows
          GH_TOKEN: '${{ github.token }}'
        run: |
          repo=${{ github.repository }}
          reviewDecision="$(gh api graphql -F owner=${{ github.repository_owner }} -F name=${repo##*/} -F pr_number=${{ github.event.pull_request.number }} -f query='
            query($name: String!, $owner: String!, $pr_number: Int!) {
              repository(owner: $owner, name: $name) {
                pullRequest(number: $pr_number) {
                  reviewDecision
                }
              }
            }
          ' --jq '.data.repository.pullRequest.reviewDecision')"

          echo REVIEW_DECISION=$reviewDecision >> $GITHUB_OUTPUT

  handle:
    # Only handle the request when the PR is already approved by qualified approvers.
    needs: 'review_status'
    if: |-
      ${{
        needs.review_status.outputs.REVIEW_DECISION == 'BREAKGLASS' ||
        (needs.review_status.outputs.REVIEW_DECISION == 'APPROVED' && github.event.review.state == 'approved')
      }}
    runs-on: 'ubuntu-latest'
    permissions:
      contents: 'read'
      id-token: 'write'
      pull-requests: 'write'
    name: 'Handle Request'
    steps:
      - name: 'Checkout Triggering Branch'
        uses: 'actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11' # ratchet:actions/checkout@v4
        with:
          ref: '${{ github.event.pull_request.head.ref }}'
      # Steps will be skipped starting from here when iam.yaml file does not
      # exist in the case of a pull_request_review event.
      - name: 'Setup Go'
        if: |-
          ${{ hashFiles('iam.yaml', 'tool.yaml') != '' }}
        uses: 'actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491' # ratchet:actions/setup-go@v5
        with:
          go-version: '${{ inputs.go_version }}'
      - name: 'Authenticate to Google Cloud'
        if: |-
          ${{ hashFiles('iam.yaml', 'tool.yaml') != '' }}
        uses: 'google-github-actions/auth@55bd3a7c6e2ae7cf1877fd1ccb9d54c0503c457c' # ratchet:google-github-actions/auth@v2
        with:
          workload_identity_provider: '${{ inputs.workload_identity_provider }}'
          service_account: '${{ inputs.service_account }}'
          token_format: 'access_token'
      # Install gcloud, `setup-gcloud` automatically picks up authentication from `auth`.
      - name: 'Set up Cloud SDK'
        if: |-
          ${{ hashFiles('tool.yaml') != '' }}
        uses: 'google-github-actions/setup-gcloud@98ddc00a17442e89a24bbf282954a3b65ce6d200' # ratchet:google-github-actions/setup-gcloud@v2
      - name: 'Setup AOD'
        if: |-
          ${{ hashFiles('iam.yaml', 'tool.yaml') != '' }}
        uses: 'abcxyz/pkg/.github/actions/setup-binary@e8ce6e3f1af546bb30008af2322b1fd6dd62c1e2' # ratchet:abcxyz/pkg/.github/actions/setup-binary@v1.0.4
        with:
          download_url: 'https://github.com/abcxyz/access-on-demand/releases/download/v${{ inputs.aod_cli_version }}/aod_${{ inputs.aod_cli_version }}_linux_amd64.tar.gz'
          install_path: '${{ runner.temp }}/.aod'
          cache_key: '${{ runner.os }}_${{ runner.arch }}_aod_${{ inputs.aod_cli_version }}'
          add_to_path: true
          binary_subpath: 'aod'
      # Duration labels need to be prefixed with "duration-", an example is "duration-2h".
      - name: 'Get Duration From Label'
        if: |-
          ${{ hashFiles('iam.yaml') != '' }}
        run: |
          names='${{ toJson(github.event.pull_request.labels.*.name) }}'
          for name in $(echo "$names" | jq -r '.[]'); do
            if [[ $name == duration-* ]]; then
              IFS='-' read -r part1 part2 <<< "$name"
              echo "LABELED_DURATION=$part2" >> $GITHUB_ENV
              break
            fi
          done
      # Request will not be handled when iam.yaml file is not found.
      - name: 'Handle IAM Request'
        if: |-
          ${{ hashFiles('iam.yaml') != '' }}
        id: 'handle_iam'
        env:
          DURATION: '${{ env.LABELED_DURATION || env.DEFAULT_DURATION }}'
          IAM_FILE_PATH: '${{ github.workspace }}/iam.yaml'
          START_TIME: '${{ github.event.review.submitted_at || github.event.pull_request.updated_at }}'
        run: |
          touch ${{ env.IAM_ERROR_FILENAME }} ${{ env.IAM_OUT_FILENAME }}
          aod iam handle \
          -path ${{ env.IAM_FILE_PATH }} \
          -duration ${{ env.DURATION }} \
          -start-time ${{ env.START_TIME }} \
          2> >(tee ${{ env.IAM_ERROR_FILENAME }} >&2) \
          1> >(tee ${{ env.IAM_OUT_FILENAME }})
      # Request will not be handled when tool.yaml file does not exist in the
      # case of a pull_request_review event, instead it prints out a notice.
      - name: 'Handle Tool Request'
        if: |-
          ${{ hashFiles('tool.yaml') != '' }}
        id: 'handle_tool'
        env:
          TOOL_FILE_PATH: '${{ github.workspace }}/tool.yaml'
        run: |
          touch ${{ env.TOOL_ERROR_FILENAME }} ${{ env.TOOL_OUT_FILENAME }}
          aod tool do -path ${{ env.TOOL_FILE_PATH }} \
          2> >(tee ${{ env.TOOL_ERROR_FILENAME }} >&2) \
          1> >(tee ${{ env.TOOL_OUT_FILENAME }})

      - name: 'IAM Request Comment'
        if: |-
          ${{ always() && hashFiles('iam.yaml') != '' }}
        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7
        with:
          github-token: '${{ github.token }}'
          retries: '3'
          script: |+
            var body, req;
            const fs = require("fs");
            const outcome = '${{ steps.handle_iam.outcome }}';
            switch (outcome) {
              case 'success':
                req = fs.readFileSync(
                  `${{ env.IAM_OUT_FILENAME }}`,
                  { encoding: "utf8" }
                );

              body = `**\`Access on Demand\`** - 🟩 **\`IAM\`** request succeeded.

            <details>
            <summary>Details</summary>
            Added below IAM permissions, and they will be expired in ${{ env.LABELED_DURATION || env.DEFAULT_DURATION }}.

            \`\`\`
            ${req}
            \`\`\`
            </details>`;
                break;
              case 'failure':
                req = fs.readFileSync(
                  `${{ env.IAM_OUT_FILENAME }}`,
                  { encoding: "utf8" }
                );
                const error = fs.readFileSync(
                  `${{ env.IAM_ERROR_FILENAME }}`,
                  { encoding: "utf8" }
                );
                body = `**\`Access on Demand\`** - 🟥 **\`IAM\`** request failed.

            <details>
            <summary>Details</summary>
            Failed to added below IAM permissions.

            \`\`\`
            ${req}
            \`\`\`

            Error:
            \`\`\`
            ${error}
            \`\`\`
            </details>`;
                break;
              // step cancelled.
              default:
                // Do nothing.
                break;
            }

            if (typeof body !== "undefined") {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: ${{ github.event.pull_request.number }},
                body: body,
              });
            }

      - name: 'Tool Request Comment'
        if: |-
          ${{ always() && hashFiles('tool.yaml') != '' }}
        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7
        with:
          github-token: '${{ github.token }}'
          retries: '3'
          script: |+
            var body, req;
            const fs = require("fs");
            const outcome = '${{ steps.handle_tool.outcome }}';
            switch (outcome) {
              case 'success':
                req = fs.readFileSync(
                  `${{ env.TOOL_OUT_FILENAME }}`,
                  { encoding: "utf8" }
                );

              body = `**\`Access on Demand\`** - 🟩 **\`Tool\`** request succeeded.

            <details>
            <summary>Details</summary>
            Executed "do" commands in the request below.

            \`\`\`
            ${req}
            \`\`\`
            </details>`;
                break;
              case 'failure':
                req = fs.readFileSync(
                  `${{ env.TOOL_OUT_FILENAME }}`,
                  { encoding: "utf8" }
                );
                const error = fs.readFileSync(
                  `${{ env.TOOL_ERROR_FILENAME }}`,
                  { encoding: "utf8" }
                );
                body = `**\`Access on Demand\`** - 🟥 **\`Tool\`** request failed.

            <details>
            <summary>Details</summary>
            Failed to execute "do" commands in the request below.

            \`\`\`
            ${req}
            \`\`\`

            Error:
            \`\`\`
            ${error}
            \`\`\`
            </details>`;
                break;
              // step cancelled.
              default:
                // Do nothing.
                break;
            }

            if (typeof body !== "undefined") {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: ${{ github.event.pull_request.number }},
                body: body,
              });
            }

      - name: 'Request Not Found Comment'
        if: |-
          ${{ always() && hashFiles('iam.yaml', 'tool.yaml') == '' }}
        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7
        with:
          github-token: '${{ github.token }}'
          retries: '3'
          script: |
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: ${{ github.event.pull_request.number }},
              body: `**\`Access on Demand\`** - 🟦 request not found.
            - To require IAM permission on demand, add an **\`iam.yaml\`** file at repo root.
            - To run tool commands on demand, add an **\`tool.yaml\`** file at repo root.`,
            });