coder/.github/workflows/pr-deploy.yaml

# This action will trigger when a PR is commentted containing /review-pr by a member of the org.
name: Deploy PR
on:
  issue_comment:
    types: [created, edited]
  workflow_dispatch:
    inputs:
      pr_number:
        description: "PR number"
        required: true

env:
  REPO: ghcr.io/coder/coder-preview

permissions:
  contents: read
  packages: write
  pull-requests: write

concurrency:
  group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}
  cancel-in-progress: false

jobs:
  pr_commented:
    if: (github.event_name == 'issue_comment' && contains(github.event.comment.body, '/deploy-pr') && (github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'COLLABORATOR' || github.event.comment.author_association == 'OWNER')) || github.event_name == 'workflow_dispatch'
    outputs:
      PR_NUMBER: ${{ steps.pr_info.outputs.PR_NUMBER }}
      PR_TITLE: ${{ steps.pr_info.outputs.PR_TITLE }}
      PR_URL: ${{ steps.pr_info.outputs.PR_URL }}
      PR_BRANCH: ${{ steps.pr_info.outputs.PR_BRANCH }}
      CODER_BASE_IMAGE_TAG: ${{ steps.set_tags.outputs.CODER_BASE_IMAGE_TAG }}
      CODER_IMAGE_TAG: ${{ steps.set_tags.outputs.CODER_IMAGE_TAG }}

    runs-on: "ubuntu-latest"
    steps:
      - name: Get PR number, title, and branch name
        id: pr_info
        run: |
          set -euxo pipefail
          if [[ ${{ github.event_name }} == "workflow_dispatch" ]]; then
            PR_NUMBER=${{ github.event.inputs.pr_number }}
          else
            PR_NUMBER=${{ github.event.issue.number }}
          fi
          PR_TITLE=$(curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" https://api.github.com/repos/coder/coder/pulls/$PR_NUMBER | jq -r '.title')
          PR_BRANCH=$(curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" https://api.github.com/repos/coder/coder/pulls/$PR_NUMBER | jq -r '.head.ref')
          echo "PR_URL=https://github.com/coder/coder/pull/$PR_NUMBER" >> $GITHUB_OUTPUT
          echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT
          echo "PR_TITLE=$PR_TITLE" >> $GITHUB_OUTPUT
          echo "PR_BRANCH=$PR_BRANCH" >> $GITHUB_OUTPUT

      - name: Set required tags
        id: set_tags
        run: |
          set -euxo pipefail
          echo "CODER_BASE_IMAGE_TAG=$CODER_BASE_IMAGE_TAG" >> $GITHUB_OUTPUT
          echo "CODER_IMAGE_TAG=$CODER_IMAGE_TAG" >> $GITHUB_OUTPUT
        env:
          CODER_BASE_IMAGE_TAG: ghcr.io/coder/coder-preview-base:pr${{ steps.pr_info.outputs.PR_NUMBER }}
          CODER_IMAGE_TAG: ghcr.io/coder/coder-preview:pr${{ steps.pr_info.outputs.PR_NUMBER }}

      - name: Comment on PR
        id: comment_id
        uses: peter-evans/create-or-update-comment@v3
        with:
          issue-number: ${{ steps.pr_info.outputs.PR_NUMBER }}
          body: |
            :rocket: Deploying PR ${{ steps.pr_info.outputs.PR_NUMBER }} ...
            :warning: This deployment will be deleted when the PR is closed.
          reactions: "+1"

  build:
    needs: pr_commented
    runs-on: ${{ github.repository_owner == 'coder' && 'buildjet-8vcpu-ubuntu-2204' || 'ubuntu-latest' }}
    env:
      DOCKER_CLI_EXPERIMENTAL: "enabled"
      CODER_IMAGE_TAG: ${{ needs.pr_commented.outputs.CODER_IMAGE_TAG }}
      PR_NUMBER: ${{ needs.pr_commented.outputs.PR_NUMBER }}
      PR_BRANCH: ${{ needs.pr_commented.outputs.PR_BRANCH }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          ref: ${{ env.PR_BRANCH }}
          fetch-depth: 0

      - name: Setup Node
        uses: ./.github/actions/setup-node

      - name: Setup Go
        uses: ./.github/actions/setup-go

      - name: Setup sqlc
        uses: ./.github/actions/setup-sqlc

      - name: GHCR Login
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Linux amd64 Docker image
        run: |
          set -euxo pipefail
          go mod download
          make gen/mark-fresh
          export DOCKER_IMAGE_NO_PREREQUISITES=true
          version="$(./scripts/version.sh)"
          export CODER_IMAGE_BUILD_BASE_TAG="$(CODER_IMAGE_BASE=coder-base ./scripts/image_tag.sh --version "$version")"
          make -j build/coder_linux_amd64
          ./scripts/build_docker.sh \
            --arch amd64 \
            --target ${{ env.CODER_IMAGE_TAG }} \
            --version $version \
            --push \
            build/coder_linux_amd64

  deploy:
    needs: [build, pr_commented]
    if: needs.build.result == 'success'
    runs-on: "ubuntu-latest"
    env:
      CODER_IMAGE_TAG: ${{ needs.pr_commented.outputs.CODER_IMAGE_TAG }}
      PR_NUMBER: ${{ needs.pr_commented.outputs.PR_NUMBER }}
      PR_TITLE: ${{ needs.pr_commented.outputs.PR_TITLE }}
      PR_URL: ${{ needs.pr_commented.outputs.PR_URL }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set up kubeconfig
        run: |
          set -euxo pipefail
          mkdir -p ~/.kube
          echo "${{ secrets.PR_DEPLOYMENTS_KUBECONFIG }}" > ~/.kube/config
          export KUBECONFIG=~/.kube/config

      - name: Create PR namespace
        run: |
          set -euxo pipefail
          # try to delete the namespace, but don't fail if it doesn't exist
          kubectl delete namespace "pr${{ env.PR_NUMBER }}" || true
          kubectl create namespace "pr${{ env.PR_NUMBER }}"

      - name: Setup ingress
        run: |
          cat <<EOF > ingress.yaml
          apiVersion: networking.k8s.io/v1
          kind: Ingress
          metadata:
            name: pr${{ env.PR_NUMBER }}
            namespace: pr${{ env.PR_NUMBER }}
            annotations:
              cert-manager.io/cluster-issuer: letsencrypt
          spec:
            tls:
            - hosts:
              - "*.${{ secrets.PR_DEPLOYMENTS_DOMAIN }}"
              secretName: pr${{ env.PR_NUMBER }}-tls
            rules:
            - host: "pr${{ env.PR_NUMBER }}.${{ secrets.PR_DEPLOYMENTS_DOMAIN }}"
              http:
                paths:
                - pathType: Prefix
                  path: "/"
                  backend:
                    service:
                      name: coder
                      port:
                        number: 80
          EOF
          kubectl apply -f ingress.yaml

      - name: Install Helm chart
        run: |
          helm upgrade --install pr${{ env.PR_NUMBER }}  ./helm \
          --namespace "pr${{ env.PR_NUMBER }}" \
          --set coder.image.repo=${{ env.REPO }} \
          --set coder.image.tag=pr${{ env.PR_NUMBER }} \
          --set coder.service.type=ClusterIP \
          --set coder.serviceAccount.enableDeployments=true \
          --set coder.env[0].name=CODER_ACCESS_URL \
          --set coder.env[0].value="https://pr${{ env.PR_NUMBER }}.${{ secrets.PR_DEPLOYMENTS_DOMAIN }}" \
          --set coder.env[1].name=CODER_WILDCARD_ACCESS_URL \
          --set coder.env[1].value="*--pr${{ env.PR_NUMBER }}.${{ secrets.PR_DEPLOYMENTS_DOMAIN }}" \
          --set coder.env[2].name=CODER_EXPERIMENTS \
          --set coder.env[2].value="*" \
          --force
          # Uncomment this when https://github.com/coder/coder/issues/8714 is resolved
          # --set coder.env[3].name=CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS \
          # --set coder.env[3].value=true \
          # --set coder.env[4].name=CODER_OAUTH2_GITHUB_CLIENT_ID \
          # --set coder.env[4].value=${{ secrets.PR_DEPLOYMENTS_GITHUB_OAUTH_CLIENT_ID }} \
          # --set coder.env[5].name=CODER_OAUTH2_GITHUB_CLIENT_SECRET \
          # --set coder.env[5].value=${{ secrets.PR_DEPLOYMENTS_GITHUB_OAUTH_CLIENT_SECRET }} \
          # --set coder.env[6].name=CODER_OAUTH2_GITHUB_ALLOWED_ORGS \
          # --set coder.env[6].value=coder \
          # --set coder.env[7].name=CODER_OAUTH2_GITHUB_REDIRECT_URI \
          # --set coder.env[7].value="https://pr${{ env.PR_NUMBER }}.${{ secrets.PR_DEPLOYMENTS_DOMAIN }}/gitauth/github/callback

      - name: Install coder-logstream-kube
        run: |
          helm repo add coder-logstream-kube https://helm.coder.com/logstream-kube
          helm upgrade --install coder-logstream-kube coder-logstream-kube/coder-logstream-kube \
            --namespace "pr${{ env.PR_NUMBER }}" \
            --set url="https://pr${{ env.PR_NUMBER }}.${{ secrets.PR_DEPLOYMENTS_DOMAIN }}"

      - name: Send Slack notification
        run: |
          curl -s -o /dev/null -X POST -H 'Content-type: application/json' \
          -d '{
            "pr_number": "'"${{ env.PR_NUMBER }}"'",
            "pr_url": "'"${{ env.PR_URL }}"'",
            "pr_title": "'"${{ env.PR_TITLE }}"'",
            "pr_access_url": "'"${{ env.PR_DEPLOYMENT_ACCESS_URL }}"'" }' ${{ secrets.PR_DEPLOYMENTS_SLACK_WEBHOOK }}
          echo "Slack notification sent"
        env:
          PR_DEPLOYMENT_ACCESS_URL: "https://pr${{ env.PR_NUMBER }}.${{ secrets.PR_DEPLOYMENTS_DOMAIN }}"

      - name: Find Comment
        uses: peter-evans/find-comment@v2
        id: fc
        with:
          issue-number: ${{ env.PR_NUMBER }}
          comment-author: "github-actions[bot]"
          body-includes: This deployment will be deleted when the PR is closed

      - name: Comment on PR
        uses: peter-evans/create-or-update-comment@v3
        with:
          issue-number: ${{ env.PR_NUMBER }}
          edit-mode: replace
          comment-id: ${{ steps.fc.outputs.comment-id }}
          body: |
            :heavy_check_mark: Deployed PR ${{ env.PR_NUMBER }} successfully.
            :rocket: Access the deployment link [here](${{ env.PR_DEPLOYMENT_ACCESS_URL }}).
            :warning: This deployment will be deleted when the PR is closed.
          reactions: rocket

        env:
          PR_DEPLOYMENT_ACCESS_URL: "https://pr${{ env.PR_NUMBER }}.${{ secrets.PR_DEPLOYMENTS_DOMAIN }}"