|
| 1 | +{{- if .Values.github.prComment.prNumber }} |
| 2 | +--- |
| 3 | +# PostSync Job that posts deployment details as a GitHub PR comment. |
| 4 | +# Only rendered for PR environments (prNumber is set by the platform chart). |
| 5 | +# Best-effort: the script exits 0 even if the GitHub API call fails, |
| 6 | +# so a comment failure does not mark the sync as failed. |
| 7 | +apiVersion: batch/v1 |
| 8 | +kind: Job |
| 9 | +metadata: |
| 10 | + name: "{{ .Release.Name }}-pr-comment" |
| 11 | + labels: |
| 12 | + {{- include "drupal.release_labels" . | nindent 4 }} |
| 13 | + annotations: |
| 14 | + argocd.argoproj.io/hook: PostSync |
| 15 | + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation |
| 16 | +spec: |
| 17 | + activeDeadlineSeconds: 120 |
| 18 | + backoffLimit: 0 |
| 19 | + ttlSecondsAfterFinished: 300 |
| 20 | + template: |
| 21 | + metadata: |
| 22 | + labels: |
| 23 | + {{- include "drupal.release_labels" . | nindent 8 }} |
| 24 | + spec: |
| 25 | + restartPolicy: Never |
| 26 | + enableServiceLinks: false |
| 27 | + containers: |
| 28 | + - name: pr-comment |
| 29 | + image: alpine:3.20 |
| 30 | + command: ["/bin/sh", "-c"] |
| 31 | + args: |
| 32 | + - | |
| 33 | + set -e |
| 34 | + apk add --no-cache curl openssl jq >/dev/null 2>&1 |
| 35 | +
|
| 36 | + # --- GitHub App authentication --- |
| 37 | + PRIVATE_KEY_FILE="/github-app/githubAppPrivateKey" |
| 38 | +
|
| 39 | + # Build JWT (RS256, valid 5 minutes) |
| 40 | + NOW=$(date +%s) |
| 41 | + IAT=$((NOW - 60)) |
| 42 | + EXP=$((NOW + 300)) |
| 43 | + HEADER=$(printf '{"alg":"RS256","typ":"JWT"}' | openssl base64 -e -A | tr '+/' '-_' | tr -d '=') |
| 44 | + PAYLOAD=$(printf '{"iat":%d,"exp":%d,"iss":"%s"}' "$IAT" "$EXP" "$GITHUB_APP_ID" | openssl base64 -e -A | tr '+/' '-_' | tr -d '=') |
| 45 | + SIGNATURE=$(printf '%s.%s' "$HEADER" "$PAYLOAD" | openssl dgst -sha256 -sign "$PRIVATE_KEY_FILE" | openssl base64 -e -A | tr '+/' '-_' | tr -d '=') |
| 46 | + JWT="${HEADER}.${PAYLOAD}.${SIGNATURE}" |
| 47 | +
|
| 48 | + # Exchange JWT for installation access token |
| 49 | + TOKEN=$(curl -sf -X POST \ |
| 50 | + -H "Authorization: Bearer ${JWT}" \ |
| 51 | + -H "Accept: application/vnd.github+json" \ |
| 52 | + "https://api.github.com/app/installations/${GITHUB_APP_INSTALLATION_ID}/access_tokens" \ |
| 53 | + | jq -r '.token') || { |
| 54 | + echo "WARNING: Failed to get GitHub installation token. Skipping PR comment." |
| 55 | + exit 0 |
| 56 | + } |
| 57 | +
|
| 58 | + if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then |
| 59 | + echo "WARNING: GitHub token is empty. Skipping PR comment." |
| 60 | + exit 0 |
| 61 | + fi |
| 62 | +
|
| 63 | + # --- Post or update PR comment --- |
| 64 | + REPO="{{ .Values.github.prComment.repository }}" |
| 65 | + PR_NUMBER="{{ .Values.github.prComment.prNumber }}" |
| 66 | + COMMENT_TAG="{{ .Values.github.prComment.commentTag }}-{{ .Release.Name }}" |
| 67 | + MARKER="<!-- ${COMMENT_TAG} -->" |
| 68 | +
|
| 69 | + # Find existing comment by marker |
| 70 | + EXISTING_ID=$(curl -sf \ |
| 71 | + -H "Authorization: token ${TOKEN}" \ |
| 72 | + -H "Accept: application/vnd.github+json" \ |
| 73 | + "https://api.github.com/repos/${REPO}/issues/${PR_NUMBER}/comments?per_page=100" \ |
| 74 | + | jq -r ".[] | select(.body | contains(\"${MARKER}\")) | .id" \ |
| 75 | + | head -1) || true |
| 76 | +
|
| 77 | + if [ -n "$EXISTING_ID" ] && [ "$EXISTING_ID" != "null" ]; then |
| 78 | + curl -sf -X PATCH \ |
| 79 | + -H "Authorization: token ${TOKEN}" \ |
| 80 | + -H "Accept: application/vnd.github+json" \ |
| 81 | + -d "$(jq -n --rawfile body /comment/comment-body.txt '{body: $body}')" \ |
| 82 | + "https://api.github.com/repos/${REPO}/issues/${PR_NUMBER}/comments/${EXISTING_ID}" \ |
| 83 | + >/dev/null && echo "Updated existing PR comment." || echo "WARNING: Failed to update PR comment." |
| 84 | + else |
| 85 | + curl -sf -X POST \ |
| 86 | + -H "Authorization: token ${TOKEN}" \ |
| 87 | + -H "Accept: application/vnd.github+json" \ |
| 88 | + -d "$(jq -n --rawfile body /comment/comment-body.txt '{body: $body}')" \ |
| 89 | + "https://api.github.com/repos/${REPO}/issues/${PR_NUMBER}/comments" \ |
| 90 | + >/dev/null && echo "Posted new PR comment." || echo "WARNING: Failed to post PR comment." |
| 91 | + fi |
| 92 | + exit 0 |
| 93 | + env: |
| 94 | + - name: GITHUB_APP_ID |
| 95 | + valueFrom: |
| 96 | + secretKeyRef: |
| 97 | + name: {{ .Values.github.prComment.secretName }} |
| 98 | + key: githubAppID |
| 99 | + - name: GITHUB_APP_INSTALLATION_ID |
| 100 | + valueFrom: |
| 101 | + secretKeyRef: |
| 102 | + name: {{ .Values.github.prComment.secretName }} |
| 103 | + key: githubAppInstallationID |
| 104 | + volumeMounts: |
| 105 | + - name: github-app-key |
| 106 | + mountPath: /github-app |
| 107 | + readOnly: true |
| 108 | + - name: comment-body |
| 109 | + mountPath: /comment |
| 110 | + readOnly: true |
| 111 | + resources: |
| 112 | + requests: |
| 113 | + cpu: 50m |
| 114 | + memory: 32Mi |
| 115 | + limits: |
| 116 | + memory: 64Mi |
| 117 | + volumes: |
| 118 | + - name: github-app-key |
| 119 | + secret: |
| 120 | + secretName: {{ .Values.github.prComment.secretName }} |
| 121 | + items: |
| 122 | + - key: githubAppPrivateKey |
| 123 | + path: githubAppPrivateKey |
| 124 | + - name: comment-body |
| 125 | + configMap: |
| 126 | + name: {{ .Release.Name }}-pr-comment-body |
| 127 | +--- |
| 128 | +# ConfigMap holding the Helm-rendered comment body. |
| 129 | +# Separating it from the Job args avoids shell escaping issues with |
| 130 | +# the rendered Markdown content. |
| 131 | +apiVersion: v1 |
| 132 | +kind: ConfigMap |
| 133 | +metadata: |
| 134 | + name: {{ .Release.Name }}-pr-comment-body |
| 135 | + labels: |
| 136 | + {{- include "drupal.release_labels" . | nindent 4 }} |
| 137 | + annotations: |
| 138 | + argocd.argoproj.io/hook: PostSync |
| 139 | + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation |
| 140 | +data: |
| 141 | + comment-body.txt: | |
| 142 | + ### :rocket: Deployment — `{{ .Release.Name }}` |
| 143 | + {{ include "drupal.deployment-notes" . | nindent 4 }} |
| 144 | + <!-- {{ .Values.github.prComment.commentTag }}-{{ .Release.Name }} --> |
| 145 | +{{- end }} |
0 commit comments