better production deployments #20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Validation | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| types: [opened, synchronize, reopened] | |
| jobs: | |
| check-prod-workflow-restrictions: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Check PROD workflows have repository restrictions | |
| id: check_restrictions | |
| run: | | |
| echo "Checking if PROD workflows have proper repository restrictions..." | |
| ERRORS="" | |
| # Check prod-build-images.yml | |
| if ! grep -q "^[[:space:]]*if: github.repository == 'splunk/opentelemetry-demo'" .github/workflows/prod-build-images.yml; then | |
| ERRORS="${ERRORS}❌ prod-build-images.yml: Missing or commented repository check\n" | |
| echo "ERROR: prod-build-images.yml missing repository check" | |
| else | |
| echo "✓ prod-build-images.yml has repository check" | |
| fi | |
| # Check prod-build-manifest.yml | |
| if ! grep -q "^[[:space:]]*if: github.repository == 'splunk/opentelemetry-demo'" .github/workflows/prod-build-manifest.yml; then | |
| ERRORS="${ERRORS}❌ prod-build-manifest.yml: Missing or commented repository check\n" | |
| echo "ERROR: prod-build-manifest.yml missing repository check" | |
| else | |
| echo "✓ prod-build-manifest.yml has repository check" | |
| fi | |
| if [ -n "$ERRORS" ]; then | |
| echo "has_errors=true" >> $GITHUB_OUTPUT | |
| echo "errors<<EOF" >> $GITHUB_OUTPUT | |
| echo -e "$ERRORS" >> $GITHUB_OUTPUT | |
| echo "EOF" >> $GITHUB_OUTPUT | |
| else | |
| echo "has_errors=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Fail if repository checks are missing | |
| if: steps.check_restrictions.outputs.has_errors == 'true' | |
| run: | | |
| echo "❌ ERROR: PROD workflows must have repository restrictions" | |
| echo "" | |
| echo "The following issues were found:" | |
| echo "${{ steps.check_restrictions.outputs.errors }}" | |
| echo "" | |
| echo "PROD workflows must include this line (UNCOMMENTED) in the job definition:" | |
| echo " if: github.repository == 'splunk/opentelemetry-demo'" | |
| echo "" | |
| echo "Files to check:" | |
| echo " - .github/workflows/prod-build-images.yml (determine-version job)" | |
| echo " - .github/workflows/prod-build-manifest.yml (build-production-manifest job)" | |
| echo "" | |
| echo "This ensures PROD workflows only run in the main splunk/opentelemetry-demo repo." | |
| exit 1 | |
| - name: Success | |
| if: steps.check_restrictions.outputs.has_errors == 'false' | |
| run: | | |
| echo "✓ PROD workflows have proper repository restrictions" | |
| echo "### ✓ PROD Workflow Restrictions Validated" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "Both PROD workflows have proper repository restrictions." >> $GITHUB_STEP_SUMMARY | |
| - name: Add PR comment if restrictions missing | |
| if: steps.check_restrictions.outputs.has_errors == 'true' && github.event_name == 'pull_request' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const body = `## ❌ PROD Workflow Repository Restrictions Missing | |
| This PR modifies PROD workflows but the repository restrictions are commented out or missing. | |
| ### Issues Found: | |
| ${{ steps.check_restrictions.outputs.errors }} | |
| ### What needs to be fixed: | |
| Both PROD workflows must include this line (UNCOMMENTED) in their job definition: | |
| \`\`\`yaml | |
| if: github.repository == 'splunk/opentelemetry-demo' | |
| \`\`\` | |
| ### Files to fix: | |
| - \`.github/workflows/prod-build-images.yml\` (line ~33, determine-version job) | |
| - \`.github/workflows/prod-build-manifest.yml\` (line ~34, build-production-manifest job) | |
| ### Why is this required? | |
| This check ensures PROD workflows only run in the main \`splunk/opentelemetry-demo\` repository and not in forks. This prevents accidental production builds from fork repositories. | |
| ### How to fix: | |
| 1. Uncomment the \`if: github.repository == 'splunk/opentelemetry-demo'\` line in both files | |
| 2. Ensure the line is NOT preceded by \`#\` | |
| 3. Push the changes | |
| The PR validation will automatically re-run once this is fixed.`; | |
| await github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: body | |
| }); | |
| check-test-manifests: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check for TEST manifest files | |
| id: check_files | |
| run: | | |
| echo "Checking for TEST Splunk manifest files in PR (kubernetes/TEST-splunk*.yaml)..." | |
| # Get the base branch | |
| BASE_SHA=$(git merge-base origin/${{ github.base_ref }} HEAD) | |
| # Check if any TEST Splunk manifest files exist in the PR diff | |
| if git diff --name-only $BASE_SHA HEAD | grep -E '^kubernetes/TEST-splunk.*\.yaml$'; then | |
| echo "found=true" >> $GITHUB_OUTPUT | |
| echo "files<<EOF" >> $GITHUB_OUTPUT | |
| git diff --name-only $BASE_SHA HEAD | grep -E '^kubernetes/TEST-splunk.*\.yaml$' >> $GITHUB_OUTPUT | |
| echo "EOF" >> $GITHUB_OUTPUT | |
| else | |
| echo "found=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Fail if TEST files found | |
| if: steps.check_files.outputs.found == 'true' | |
| run: | | |
| echo "❌ ERROR: TEST Splunk manifest files detected in this PR" | |
| echo "" | |
| echo "The following TEST Splunk manifest files were found:" | |
| echo "${{ steps.check_files.outputs.files }}" | |
| echo "" | |
| echo "TEST Splunk manifests should not be merged to the main branch." | |
| echo "" | |
| echo "To remove these files, run the 'Remove TEST Manifests' workflow:" | |
| echo " 1. Go to: Actions → Remove TEST Manifests" | |
| echo " 2. Click 'Run workflow'" | |
| echo " 3. Select your branch: ${{ github.head_ref }}" | |
| echo " 4. Type 'CONFIRM' in the confirmation field" | |
| echo " 5. Click 'Run workflow'" | |
| echo "" | |
| echo "Or manually remove them with:" | |
| echo " git rm kubernetes/TEST-splunk*.yaml" | |
| echo " git commit -m 'chore: remove TEST Splunk manifests'" | |
| echo " git push" | |
| exit 1 | |
| - name: Success | |
| if: steps.check_files.outputs.found == 'false' | |
| run: | | |
| echo "✓ No TEST Splunk manifest files found in this PR" | |
| echo "### ✓ PR Validation Passed" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "No TEST Splunk manifest files detected." >> $GITHUB_STEP_SUMMARY | |
| - name: Add PR comment if TEST files found | |
| if: steps.check_files.outputs.found == 'true' && github.event_name == 'pull_request' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const files = `${{ steps.check_files.outputs.files }}`.split('\n').filter(f => f); | |
| const fileList = files.map(f => `- \`${f}\``).join('\n'); | |
| const branchName = context.payload.pull_request.head.ref; | |
| const body = `## ❌ TEST Splunk Manifest Files Detected | |
| This PR contains TEST Splunk manifest files that should not be merged to main: | |
| ` + fileList + ` | |
| ### How to fix this: | |
| **Option 1: Use the automated workflow** | |
| 1. Go to [Actions → Remove TEST Manifests](../actions/workflows/remove-test-manifests.yml) | |
| 2. Click "Run workflow" | |
| 3. Select branch: \`${branchName}\` | |
| 4. Type \`CONFIRM\` in the confirmation field | |
| 5. Click "Run workflow" | |
| **Option 2: Remove manually** | |
| \`\`\`bash | |
| git rm kubernetes/TEST-splunk*.yaml | |
| git commit -m "chore: remove TEST Splunk manifests" | |
| git push | |
| \`\`\` | |
| The PR validation will automatically re-run once the files are removed.`; | |
| await github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: body | |
| }); | |
| check-version-files-from-forks: | |
| runs-on: ubuntu-latest | |
| # Only run this check if PR is from a fork | |
| if: github.event.pull_request.head.repo.full_name != github.repository | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check for production version file modifications | |
| id: check_version_files | |
| run: | | |
| echo "Checking if fork modified production version files..." | |
| # Get the base branch | |
| BASE_SHA=$(git merge-base origin/${{ github.base_ref }} HEAD) | |
| ERRORS="" | |
| MODIFIED_FILES="" | |
| # Check if SPLUNK-VERSION was modified | |
| if git diff --name-only $BASE_SHA HEAD | grep -q '^SPLUNK-VERSION$'; then | |
| ERRORS="${ERRORS}❌ SPLUNK-VERSION: Production version file modified in fork\n" | |
| MODIFIED_FILES="${MODIFIED_FILES}SPLUNK-VERSION\n" | |
| echo "ERROR: SPLUNK-VERSION modified in fork" | |
| fi | |
| # Check if .service-versions.yaml was modified | |
| if git diff --name-only $BASE_SHA HEAD | grep -q '^\.service-versions\.yaml$'; then | |
| ERRORS="${ERRORS}❌ .service-versions.yaml: Test version file should not be committed\n" | |
| MODIFIED_FILES="${MODIFIED_FILES}.service-versions.yaml\n" | |
| echo "ERROR: .service-versions.yaml modified" | |
| fi | |
| if [ -n "$ERRORS" ]; then | |
| echo "has_errors=true" >> $GITHUB_OUTPUT | |
| echo "errors<<EOF" >> $GITHUB_OUTPUT | |
| echo -e "$ERRORS" >> $GITHUB_OUTPUT | |
| echo "EOF" >> $GITHUB_OUTPUT | |
| echo "files<<EOF" >> $GITHUB_OUTPUT | |
| echo -e "$MODIFIED_FILES" >> $GITHUB_OUTPUT | |
| echo "EOF" >> $GITHUB_OUTPUT | |
| else | |
| echo "has_errors=false" >> $GITHUB_OUTPUT | |
| echo "✓ No production version files modified" | |
| fi | |
| - name: Fail if version files modified | |
| if: steps.check_version_files.outputs.has_errors == 'true' | |
| run: | | |
| echo "❌ ERROR: Production version files modified in fork PR" | |
| echo "" | |
| echo "The following production version files were modified:" | |
| echo "${{ steps.check_version_files.outputs.files }}" | |
| echo "" | |
| echo "These files are managed by production workflows and should not be modified in forks." | |
| echo "" | |
| echo "### To fix this issue:" | |
| echo "" | |
| echo "1. Revert changes to these files:" | |
| echo " git checkout origin/main -- SPLUNK-VERSION .service-versions.yaml" | |
| echo " git commit -m 'chore: revert version file changes'" | |
| echo " git push" | |
| echo "" | |
| echo "2. Add these files to your local .git/info/exclude to prevent accidental commits:" | |
| echo " echo 'SPLUNK-VERSION' >> .git/info/exclude" | |
| echo " echo '.service-versions.yaml' >> .git/info/exclude" | |
| echo "" | |
| echo "### Why is this required?" | |
| echo "" | |
| echo "- SPLUNK-VERSION: Managed by PROD workflows, only updated during production releases" | |
| echo "- .service-versions.yaml: Test/dev file, automatically managed by test workflows" | |
| echo "" | |
| echo "These files should not be modified manually or from forks to prevent version conflicts." | |
| exit 1 | |
| - name: Success | |
| if: steps.check_version_files.outputs.has_errors == 'false' | |
| run: | | |
| echo "✓ No production version files modified in this fork PR" | |
| echo "### ✓ Version Files Validation Passed" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "No production version files were modified." >> $GITHUB_STEP_SUMMARY | |
| - name: Add PR comment if version files modified | |
| if: steps.check_version_files.outputs.has_errors == 'true' && github.event_name == 'pull_request' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const files = `${{ steps.check_version_files.outputs.files }}`.split('\n').filter(f => f); | |
| const fileList = files.map(f => `- \`${f}\``).join('\n'); | |
| const body = `## ❌ Production Version Files Modified in Fork | |
| This PR from a fork modifies production version files that should not be changed: | |
| ${fileList} | |
| ### Why is this an issue? | |
| - **SPLUNK-VERSION**: Managed by production workflows during releases. Should only be updated via the "Build Images - PRODUCTION" workflow in the main repository. | |
| - **.service-versions.yaml**: Test/dev version tracking file. Should not be committed to the repository (it's generated by test workflows). | |
| ### How to fix this: | |
| **Revert the changes to these files:** | |
| \`\`\`bash | |
| git checkout origin/main -- SPLUNK-VERSION .service-versions.yaml | |
| git commit -m "chore: revert version file changes" | |
| git push | |
| \`\`\` | |
| **Prevent future accidental commits** by adding to your local git exclude: | |
| \`\`\`bash | |
| echo 'SPLUNK-VERSION' >> .git/info/exclude | |
| echo '.service-versions.yaml' >> .git/info/exclude | |
| \`\`\` | |
| **Note**: The \`.git/info/exclude\` file works like \`.gitignore\` but is local to your repository and not tracked in git. | |
| The PR validation will automatically re-run once these files are reverted.`; | |
| await github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: body | |
| }); | |
| check-dev-repo-file: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check for dev-repo.yaml file | |
| id: check_dev_repo | |
| run: | | |
| echo "Checking for dev-repo.yaml in PR..." | |
| # Get the base branch | |
| BASE_SHA=$(git merge-base origin/${{ github.base_ref }} HEAD) | |
| # Check if dev-repo.yaml was added or modified | |
| if git diff --name-only $BASE_SHA HEAD | grep -q '^dev-repo\.yaml$'; then | |
| echo "has_errors=true" >> $GITHUB_OUTPUT | |
| echo "ERROR: dev-repo.yaml found in PR" | |
| else | |
| echo "has_errors=false" >> $GITHUB_OUTPUT | |
| echo "✓ No dev-repo.yaml in PR" | |
| fi | |
| - name: Fail if dev-repo.yaml found | |
| if: steps.check_dev_repo.outputs.has_errors == 'true' | |
| run: | | |
| echo "❌ ERROR: dev-repo.yaml should not be committed to the repository" | |
| echo "" | |
| echo "The dev-repo.yaml file contains fork-specific configuration and should not be in PRs." | |
| echo "" | |
| echo "### To fix this issue:" | |
| echo "" | |
| echo "1. Remove dev-repo.yaml from your PR:" | |
| echo " git rm dev-repo.yaml" | |
| echo " git commit -m 'chore: remove dev-repo.yaml'" | |
| echo " git push" | |
| echo "" | |
| echo "2. The dev-repo.yaml file is already in .gitignore to prevent future commits" | |
| echo "" | |
| echo "### Why is this required?" | |
| echo "" | |
| echo "- dev-repo.yaml contains fork-specific registry URLs" | |
| echo "- Each fork should maintain their own dev-repo.yaml locally" | |
| echo "- This prevents fork repository URLs from appearing in the main repo" | |
| echo "- Use dev-repo.yaml.example as a template for your fork" | |
| exit 1 | |
| - name: Success | |
| if: steps.check_dev_repo.outputs.has_errors == 'false' | |
| run: | | |
| echo "✓ No dev-repo.yaml file in this PR" | |
| echo "### ✓ Dev Repo File Validation Passed" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "No dev-repo.yaml file detected in PR." >> $GITHUB_STEP_SUMMARY | |
| - name: Add PR comment if dev-repo.yaml found | |
| if: steps.check_dev_repo.outputs.has_errors == 'true' && github.event_name == 'pull_request' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const body = `## ❌ dev-repo.yaml Should Not Be Committed | |
| This PR contains the \`dev-repo.yaml\` file which should not be committed to the repository. | |
| ### Why is this an issue? | |
| - **dev-repo.yaml**: Contains fork-specific development/test registry URLs | |
| - Should be maintained locally in each fork | |
| - Already included in \`.gitignore\` to prevent accidental commits | |
| - Prevents fork repository URLs from appearing in the main repository | |
| ### How to fix this: | |
| **Remove the file from your PR:** | |
| \`\`\`bash | |
| git rm dev-repo.yaml | |
| git commit -m "chore: remove dev-repo.yaml" | |
| git push | |
| \`\`\` | |
| **For your fork's local setup:** | |
| 1. Copy \`dev-repo.yaml.example\` to \`dev-repo.yaml\` | |
| 2. Update it with your fork's registry URL | |
| 3. The file will be ignored by git (it's in \`.gitignore\`) | |
| The PR validation will automatically re-run once the file is removed.`; | |
| await github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: body | |
| }); |