create-tag.yml

# Copyright 2023 The Authors (see AUTHORS file)
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Steps:
#   - Parallel task 1:
#
#     - In your own repo, create a minty config in `./.github/minty.yaml`.
#       Configure your repo access follow this link:
#       https://github.com/abcxyz/github-token-minter?tab=readme-ov-file#configuring-repository-access.
#     - Send this PR for approval and merge it when approved. You can continue
#       with the next step while you wait for approval.
#
#   - Parallel task 2:
#
#     - In your own repo, create a new workflow by copying an create-tag.yaml
#       file from another repo (e.g. pmap). Run this command in the root of the
#       repo:
#
#       $ wget -O .github/workflows/create-tag.yml https://raw.githubusercontent.com/abcxyz/pmap/main/.github/workflows/create-tag.yml
#
#       Note: for this step you use the .yml file extension, which is different
#       than the .yaml file extension in the previous step.
#     - Send this PR for approval and merge it when approved.
#
#   - Parallel task 3: in your repo, create a new environment named "tag", where
#       - the required reviewers are "abcxyz/infrastructure-team"
#       - "Allow administrators to bypass configured protection rules" is
#         checked
#       - "Deployment branches and tags" is "Protected branches only"
#
#   - After all of the above parallel tasks are complete, you can now run the
#     create-tag workflow in your github repo, and a tag will be created. The
#     assumption is that there will be another workflow that is waiting to be
#     triggered by a tag creation event.

name: 'create-tag'
on:
  workflow_call:
    inputs:
      runs-on:
        description: |-
          The GitHub runner on which to execute. This must be a valid JSON but
          can represent a string, array of strings, or object.
        type: 'string'
        default: '"ubuntu-latest"'
      tag:
        description: |-
          The name of the tag to be created.
        type: 'string'
        required: true
      # Could be GitHub's limitation, it seems impossible to create annotated
      # tags via GitHub API, see similar issue here: https://github.com/orgs/community/discussions/4924
      annotated_tag:
        description: |-
          Whether it will be an annotated tag in Git.
        type: 'boolean'
        default: true
        required: false
      # Set the branch and message defaults when declaring environment variables
      # as the default values in here may not be considered when the calling
      # workflow provided a none input, likely a bug: https://github.com/actions/runner/issues/2907.
      branch:
        description: |-
          The branch of the head commit to create tag on. Default is the default
          branch of the calling repository.
        type: 'string'
        required: false
      message:
        description: |-
          Message for the tag. Default is the tag name.
        type: 'string'
        required: false
      deployment_environment:
        description: |-
          The environment with protection rules, see reference
          https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment.
        type: 'string'
        required: true
      token_minter_wif_provider:
        description: |-
          The full identifier of the Workload Identity Provider, including the
          project number, pool name, and provider name.
        type: 'string'
        required: true
      token_minter_wif_service_account:
        description: |-
          Email address or unique identifier of the Google Cloud service account
          for which to generate credentials.
        type: 'string'
        required: true
      token_minter_service_audience:
        description: |-
          Cloud Run audience for the production github-token-minter service.
        type: 'string'
        required: true
      token_minter_service_url:
        description: |-
          URL for the production github-token-minter service.
        type: 'string'
        required: true

env:
  TAG: '${{ inputs.tag }}'
  BRANCH: '${{ inputs.branch || github.event.repository.default_branch }}'
  ANNOTATED_TAG: '${{ inputs.annotated_tag }}'
  MESSAGE: '${{ inputs.message || inputs.tag }}'

jobs:
  print-inputs:
    runs-on: ${{ fromJSON(inputs.runs-on) }} # yamllint disable-line
    steps:
      - name: 'job summary'
        run: |
          {
            echo "### Inputs"
            echo "- tag: ${TAG}"
            echo "- branch: ${BRANCH}"
            echo "- annotated tag: ${ANNOTATED_TAG}"
            echo "- message: ${MESSAGE}"
          } >> "${GITHUB_STEP_SUMMARY}"

  create-tag:
    runs-on: ${{ fromJSON(inputs.runs-on) }} # yamllint disable-line
    needs: 'print-inputs'
    # Only running the job when the triggering branch is the default branch.
    if: '${{ github.ref_name == github.event.repository.default_branch }}'
    # Use environment here since calling workflow does not support it, see ref:
    # https://docs.github.com/en/actions/using-workflows/reusing-workflows#supported-keywords-for-jobs-that-call-a-reusable-workflow.
    environment: '${{ inputs.deployment_environment }}'
    outputs:
      result: '${{ steps.create-tag.outputs.result }}'
    steps:
      - id: 'minty-auth'
        uses: 'google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f' # ratchet:google-github-actions/auth@v2
        with:
          create_credentials_file: false
          export_environment_variables: false
          workload_identity_provider: '${{ vars.TOKEN_MINTER_WIF_PROVIDER }}'
          service_account: '${{ vars.TOKEN_MINTER_WIF_SERVICE_ACCOUNT }}'
          token_format: 'id_token'
          id_token_audience: '${{ vars.TOKEN_MINTER_SERVICE_AUDIENCE }}'
          id_token_include_email: true

      - id: 'mint-token'
        uses: 'abcxyz/github-token-minter/.github/actions/minty@main' # ratchet:exclude
        with:
          id_token: '${{ steps.minty-auth.outputs.id_token }}'
          service_url: '${{ vars.TOKEN_MINTER_SERVICE_URL }}'
          requested_permissions: |-
            {
              "scope": "create-tag",
              "repositories": ["${{ github.event.repository.name }}"],
              "permissions": {
                "contents": "write"
              }
            }
      - id: 'create-tag'
        name: 'Create Tag'
        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7
        with:
          github-token: '${{ steps.mint-token.outputs.token }}'
          retries: '3'
          result-encoding: 'string'
          script: |+
            const branch = process.env.BRANCH
            const tag = process.env.TAG
            const annotatedTag = process.env.ANNOTATED_TAG
            const message = process.env.MESSAGE

            if (branch != '${{ github.event.repository.default_branch }}') {
              core.warning(`branch (${branch}) is not the repository default ` +
              `branch (${{ github.event.repository.default_branch }}).`)
            }

            let sha = '${{ github.sha }}'
            // If the input branch is not the branch of the calling workflow,
            // get the sha of input branch instead.
            if (branch !== '${{ github.ref_name }}') {
              // Get branch.
              const branchToTag = await github.rest.repos.getBranch({
                owner: context.repo.owner,
                repo: context.repo.repo,
                branch: branch,
              })
              // Branch returns the latest commit info. See schema:
              // https://docs.github.com/en/rest/branches/branches?apiVersion=2022-11-28#get-a-branch
              sha = branchToTag['data']['commit']['sha']
            }

            if (annotatedTag === 'true') {
              // Create a tag object before creating a reference for annotated tag.
              // See reference: https://docs.github.com/en/rest/git/tags?apiVersion=2022-11-28#create-a-tag-object
              await github.rest.git.createTag({
                owner: context.repo.owner,
                repo: context.repo.repo,
                tag: tag,
                object: sha,
                type: 'commit',
                message: message,
              });
            }

            await github.rest.git.createRef({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: `refs/tags/${tag}`,
              sha: sha,
            })
            if (annotatedTag === 'true') {
              return `Created annotated tag (${tag}), branch (${branch}), commit (${sha}), message(${message}).`
            }
            return `Created lightweight tag (${tag}), branch (${branch}), commit (${sha}), message(${message}).`

  print-outputs:
    runs-on: ${{ fromJSON(inputs.runs-on) }} # yamllint disable-line
    needs: 'create-tag'
    steps:
      - name: 'job summary'
        run: |
          echo "### Outputs" >> "${GITHUB_STEP_SUMMARY}"
          echo "${{ needs.create-tag.outputs.result }}" >> "${GITHUB_STEP_SUMMARY}"