action.yml

name: 'Deploy ArgoCD'
description: 'Deploy on Kubernetes with ArgoCD'
author: hello@cloudposse.com
branding:
  icon: 'cpu'
  color: 'white'
inputs:
  cluster:
    description: Cluster name
    required: true
  aws-region:
    description: AWS region
    required: false
    default: us-east-1
  path:
    description: The path where lives the helmfile or helm chart.
    required: true
  toolchain:
    description: Toolchain ('helm', 'helmfile')
    required: false
    default: helmfile
  ssm-path:
    required: false
    default: ''
    description: SSM path to read environment secrets
  operation:
    description: Operation with helmfiles. (valid options - `deploy`, `destroy`)
    required: true
    default: deploy
  environment:
    description: Helmfile environment
    required: false
    default: preview
  repository:
    description: Application GitHub repository full name
    required: true
  ref:
    description: Git ref
    required: true
  gitref-sha:
    description: Git SHA (Depricated. Use `ref` instead)
    required: false
    default: ''
  namespace:
    description: Kubernetes namespace
    required: true
  application:
    description: Application name
    required: true
  image:
    description: Docker image
    required: true
  image-tag:
    description: Docker image tag
    required: true
  debug:
    description: Debug mode
    default: 'false'
    required: false
  values_file:
    description: Helm values file, this can be a single file or a comma separated list of files
    default: ""
    required: false
  release_label_name:
    description: The name of the label used to describe the helm release
    default: "release"
    required: false
  github-pat:
    description: Github PAT to access argocd configuration repository
    required: true
  commit-status-github-token:
    description: Github token to access the app repository. Defaults to github-pat if not set.
    required: false
  synchronously:
    description: "Wait until ArgoCD successfully apply the changes"
    default: 'false'
  check-retry-count:
    description: 'Check retry count (for synchronously mode)'
    required: false
    default: "5"
  check-retry-interval:
    description: 'Check retry interval (in seconds) (for synchronously mode)'
    required: false
    default: "10"
  commit-retry-count:
    description: 'Commit retry count'
    required: false
    default: "4"
  commit-retry-interval:
    description: 'Commit retry interval (in seconds)'
    required: false
    default: "10"
  commit-timeout:
    description: 'Commit timeout (in seconds)'
    required: false
    default: "60"
  helm-dependency-build:
    description: 'Run helm dependency build, only for helm toolchain, `true` or `false`'
    required: false
    default: "false"
  helm-args:
    description: 'Additional helm arguments'
    required: false
    default: ""
  helmfile-args:
    description: 'Additional helmfile arguments'
    required: false
    default: ""
  helm-version:
    description: "Helm version"
    required: false
    default: "v3.20.1"
  helmfile-version:
    description: "Helmfile version"
    required: false
    default: "v1.4.3"    
  kube-version:
    description: "Kubernetes version for helm/helmfile rendering (e.g. `1.28`). When provided, skips SSM metadata lookup via chamber."
    required: false
    default: ""
  deployment-id:
    description: "Unique identifier for this deploy attempt (for example, the GitHub run ID joined with the run attempt). When set, it is written to `config.yaml` as `deployment_id`, which lets ArgoCD dedupe notifications per deploy attempt instead of per commit. Left unset, the key is omitted from `config.yaml`."
    required: false
    default: ""
outputs:
  webapp-url:
    description: "Web Application url"
    value: ${{ steps.result.outputs.webapp_url }}
  sha:
    description: "Git commit SHA into argocd repo"
    value: ${{ steps.git.outputs.sha }}
runs:
  using: "composite"
  steps:
    - name: Setup yq
      uses: dcarbone/install-yq-action@v1.3.1
      with:
        version: v4.28.1
        download-compressed: true
        force: true

    - name: Setup helmfile
      uses: mamezou-tech/setup-helmfile@v2.2.0
      if: ${{ inputs.operation == 'deploy' }}
      with:
        helmfile-version: "${{ inputs.helmfile-version }}"
        helm-version: "${{ inputs.helm-version }}"
        install-kubectl: false

    - name: Setup node
      uses: actions/setup-node@v6
      with:
        node-version: 24

    - name: Install git-url-parse
      shell: bash
      run: |
        mkdir -p ${{ runner.temp }}/action-deps
        cd ${{ runner.temp }}/action-deps
        npm install git-url-parse@14.0.0 --no-save
      env:
        NPM_CONFIG_USERCONFIG: /dev/null

    - name: Parse git URL for destination
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0, node 20
      id: destination
      env:
        NODE_PATH: ${{ runner.temp }}/action-deps/node_modules
      with:
        script: |
          const GitUrlParse = require("git-url-parse");
          function run(url) {
            try { 
              console.log("url: %s", url)
              const urlObj = GitUrlParse(url);
              core.setOutput('result', JSON.stringify(urlObj));
              const keys = Object.keys(urlObj);
              keys.forEach(key=>{
                if(typeof urlObj[key] === 'string' || urlObj[key] === null){
                  core.setOutput(key, urlObj[key]);
                }
              })
            } 
            catch (error) {
              core.setFailed(error.message);
            }
          }
          run("${{ inputs.cluster }}")

    - id: destination_dir
      shell: bash
      run: |-
        echo "name=$(echo $RANDOM | md5sum | head -c 20)" >> $GITHUB_OUTPUT

    - name: Config
      id: config
      uses: cloudposse/github-action-yaml-config-query@v1.0.1
      with:
        config: |-
          tmp: ./tmp/${{ steps.destination.outputs.filepath }}/${{ inputs.namespace }}/${{ inputs.application }}
          path: ${{ steps.destination.outputs.filepath }}/${{ inputs.namespace }}/${{ inputs.application }}

    - name: Checkout Argo Configuration
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        repository: ${{ steps.destination.outputs.owner }}/${{ steps.destination.outputs.name }}
        ref: ${{ steps.destination.outputs.ref }}
        token: ${{ inputs.github-pat }}
        path: ${{ steps.destination_dir.outputs.name }}

    - name: Setup chamber
      if: ${{ inputs.operation == 'deploy' && inputs.ssm-path != '' }}
      shell: bash
      env:
        version: v2.14.1
      run: |
        set -x
        os=$(uname -s | tr '[:upper:]' '[:lower:]')
        arch=""
        case $(uname -m) in
          x86_64)
            arch="amd64"
            ;;
          aarch64)
            arch="arm64"
            ;;
          arch64)
            arch="arm64"
            ;;
          *)
            echo "Unsupported architecture $(uname -m)"
            exit 1
            ;;
        esac
        curl -LOs https://github.com/segmentio/chamber/releases/download/${version}/chamber-${version}-${os}-${arch}
        sudo install chamber-${version}-${os}-${arch} /usr/local/bin/chamber

    - name: Read platform context
      if: ${{ inputs.operation == 'deploy' && inputs.ssm-path != '' }}
      shell: bash
      run: |
        chamber --verbose export ${{ inputs.ssm-path }}/${{ inputs.environment }} --format yaml --output-file ./platform.yaml

    - name: YQ Platform settings
      if: ${{ inputs.operation == 'deploy' && inputs.ssm-path != '' }}
      shell: bash
      run: |
        sudo chmod 777 ./platform.yaml 
        yq --exit-status --no-colors --inplace eval '{"platform": .}' ./platform.yaml

    - name: Create empty platform context
      if: ${{ inputs.operation == 'deploy' && inputs.ssm-path == '' }}
      shell: bash
      run: |
        echo 'platform: {}' > ./platform.yaml

    - name: Read platform metadata
      if: ${{ inputs.operation == 'deploy' && inputs.ssm-path != '' }}
      shell: bash
      run: |
        chamber --verbose export ${{ inputs.ssm-path }}/_metadata --format yaml --output-file ./_metadata.yaml

    - name: YQ Platform settings
      if: ${{ inputs.operation == 'deploy' && inputs.ssm-path != '' }}
      shell: bash
      id: metadata
      run: |
        for output in $(yq --exit-status --no-colors eval-all '. | to_entries | map( .key + "=" + .value ) | join("\n")' ./_metadata.yaml); do
          echo "${output}" >> $GITHUB_OUTPUT ;
        done

    - name: Resolve kube version
      id: resolved_kube_version
      if: ${{ inputs.operation == 'deploy' }}
      shell: bash
      run: |
        kube_version="${{ inputs.kube-version }}"
        if [ -z "$kube_version" ] && [ -n "${{ inputs.ssm-path }}" ]; then
          kube_version="${{ steps.metadata.outputs.kube_version }}"
        fi
        echo "value=$kube_version" >> $GITHUB_OUTPUT

    - name: Context
      if: ${{ inputs.operation == 'deploy' }}
      id: arguments
      uses: cloudposse/github-action-yaml-config-query@v1.0.1
      with:
        query: ."${{ steps.resolved_kube_version.outputs.value == '' }}"
        config: |-
          true: 
            kube_version: ""
          false:
            kube_version: --kube-version=${{ steps.resolved_kube_version.outputs.value }}      


    - name: Ensure argocd repo structure
      if: ${{ inputs.operation == 'deploy' }}
      shell: bash
      run: |
        mkdir -p ${{ steps.config.outputs.tmp }}/manifests

    - name: Helmfile render
      if: ${{ inputs.toolchain == 'helmfile' && inputs.operation == 'deploy' }}
      shell: bash
      run: |
        helmfile --namespace ${{ inputs.namespace }} \
          --environment ${{ inputs.environment }} \
          --file ${{ inputs.path}} \
          --state-values-file $(pwd)/platform.yaml \
          template \
          --args="${{ steps.arguments.outputs.kube_version }}" \
          ${{ inputs.helmfile-args }} > ${{ steps.config.outputs.tmp }}/manifests/resources.yaml
      env:
        IMAGE_NAME: ${{ inputs.image }}
        IMAGE_TAG: ${{ inputs.image-tag }}
        
    - name: Build Helm Dependencies
      if: ${{ inputs.toolchain == 'helm' && inputs.operation == 'deploy' && inputs.helm-dependency-build == 'true'}}
      shell: bash
      run: |
        helm dependency build ${{ inputs.path }}
        
    - name: Helm raw render
      if: ${{ inputs.toolchain == 'helm' && inputs.operation == 'deploy' }}
      shell: bash
      run: |
        IFS=', ' read -r -a array <<< "${{ inputs.values_file }}"
        for element in ${array[@]}; do VALUES_STR+="--values $element "; done
        
        helm template ${{ inputs.application }} ${{ inputs.path }} \
          --set image.repository=${{ inputs.image }} \
          --set global.image.repository=${{ inputs.image }} \
          --set image.tag=${{ inputs.image-tag }} \
          --set global.image.tag=${{ inputs.image-tag }} \
          --set environment=${{ inputs.environment }} \
          --create-namespace=true \
          --namespace ${{ inputs.namespace }} \
          --set ingress.default.hosts.example=test \
          --values $(pwd)/platform.yaml \
          ${VALUES_STR} \
          ${{ inputs.helm-args }} \
          ${{ steps.arguments.outputs.kube_version }} \
        > ${{ steps.config.outputs.tmp }}/manifests/resources.yaml
      env:
        IMAGE_NAME: ${{ inputs.image }}
        IMAGE_TAG: ${{ inputs.image-tag }}

    - name: Get Webapp
      if: ${{ inputs.operation == 'deploy' }}
      id: result
      shell: bash
      run: |-
        WEBAPP_URL=$( \
          yq -N eval-all '[.metadata.annotations["outputs.platform.cloudposse.com/webapp-url"] | select(. != null)] | .[0]' \
            ${{ steps.config.outputs.tmp }}/manifests/resources.yaml \
        )
        echo "webapp_url=${WEBAPP_URL}" >> $GITHUB_OUTPUT

    - name: Deplicated Ref
      if: ${{ inputs.operation == 'deploy' }}
      id: ref
      uses: cloudposse/github-action-yaml-config-query@v1.0.1
      with:
        query: ."${{ inputs.gitref-sha == '' }}"
        config: |-
          true: 
            value: ${{ inputs.ref }}
          false:
            value: ${{ inputs.gitref-sha }}      

    - name: Config render
      if: ${{ inputs.operation == 'deploy' }}
      uses: 1arp/create-a-file-action@0.4
      with:
        path: ${{ steps.config.outputs.tmp }}
        file: config.yaml
        content: |-
          app_repository: ${{ inputs.repository }}
          app_commit: ${{ steps.ref.outputs.value }}
          app_hostname: ${{ steps.result.outputs.webapp_url }}
          name: ${{ inputs.namespace }}.${{ inputs.application }}
          namespace: ${{ inputs.namespace }}
          manifests: ${{ steps.config.outputs.path }}/manifests

    - name: Stamp deployment id
      if: ${{ inputs.operation == 'deploy' && inputs.deployment-id != '' }}
      shell: bash
      env:
        DEPLOYMENT_ID: ${{ inputs.deployment-id }}
        CONFIG_FILE: ${{ steps.config.outputs.tmp }}/config.yaml
      run: |-
        yq --exit-status --no-colors --inplace eval '.deployment_id = strenv(DEPLOYMENT_ID)' "${CONFIG_FILE}"

    - name: Push to Github
      uses: nick-fields/retry@v4
      id: git
      with:
        max_attempts: ${{ inputs.commit-retry-count }}
        timeout_seconds: ${{ inputs.commit-timeout }}
        retry_wait_seconds: ${{ inputs.commit-retry-interval }}
        shell: bash
        command: |-
          set -e
          
          git config --global user.email "bot@example.com"
          git config --global user.name "cloudpossebot"

          pushd ./${{ steps.destination_dir.outputs.name }}
          
          git reset --hard origin/${{ steps.destination.outputs.ref }}
          git pull --rebase
          
          popd
          
          case '${{ inputs.operation }}' in
        
            deploy)
              cp -r ./tmp/* ./${{ steps.destination_dir.outputs.name }}/
            ;;
          
            destroy)
              rm -rf ./${{ steps.destination_dir.outputs.name }}/${{ steps.config.outputs.path }}
            ;;
          
            *)
              echo "Operation should be `deploy` or `destroy`"
              exit 1;
            ;;
          esac          
          
          pushd ./${{ steps.destination_dir.outputs.name }}
          
          git add -A
          git status
          git diff-index --quiet HEAD || git commit -m "Deploy ${{ github.repository }} SHA ${{ github.sha }} RUN ${{ github.run_id }} ATEMPT ${{ github.run_attempt }}"
          git push origin ${{ steps.destination.outputs.ref }}

          echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
          
          popd

    - name: Select GitHub Token for Sync Mode
      id: commit_status_github_token
      if: ${{ inputs.synchronously == 'true' && inputs.operation == 'deploy' }}
      shell: bash
      run: |-
        if [ -z "${{ inputs.commit-status-github-token }}" ]; then
          echo "token=${{ inputs.github-pat }}" >> $GITHUB_OUTPUT
        else
          echo "token=${{ inputs.commit-status-github-token }}" >> $GITHUB_OUTPUT
        fi

    - uses: cloudposse/github-action-wait-commit-status@968fc17eddf4d9f4f2203edb4c72814a1d8bc650 # v0.2.2
      if: ${{ inputs.synchronously == 'true' && inputs.operation == 'deploy' }}
      with:
        repository: ${{ inputs.repository }}
        sha: ${{ inputs.ref }}
        status: "continuous-delivery/${{ inputs.namespace }}.${{ inputs.application }}"
        expected_state: "success"
        token: ${{ steps.commit_status_github_token.outputs.token }}
        check-retry-count: ${{ inputs.check-retry-count }}
        check-retry-interval: ${{ inputs.check-retry-interval }}