templates-dyff.yml

# Copyright 2025 New Vector Ltd
#
# SPDX-License-Identifier: AGPL-3.0-only

name: dyff of rendered templates
on:
  pull_request:

permissions:
  contents: read

jobs:
  generate-dyff:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout PR
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4
      with:
        fetch-depth: 0

    # helm template doesn't reliably order manifests within the same kind, so use yq to do it for us
    - name: Generate manifests for PR
      id: generate-manifests
      run: |
        mkdir -p "$RUNNER_TEMP/new"
        for values in charts/matrix-stack/ci/*values.yaml; do
          echo "Generating new templates with $values";
          mkdir -p "$RUNNER_TEMP/new/$(basename "$values" ".yaml")"
          helm template \
              -n ess-ci \
              -a monitoring.coreos.com/v1/ServiceMonitor \
              -f "$values" charts/matrix-stack | \
          yq ea '[.] | .[] | splitDoc' | \
          yq -s "\"$RUNNER_TEMP/new/$(basename "$values" ".yaml")/\""' + ([.kind, .metadata.name] | join("-") | downcase) + ".yaml"'
        done
        echo "output_dir=$RUNNER_TEMP/new" | tee -a "$GITHUB_OUTPUT"

    # We want the most recent common ancestor between the target & PR branches rather than the target branch itself
    # There could have been more commits to the target branch since the PR branch was created and we don't want to see
    # those changes in the dyff, only what this branch is doing.
    - name: Determine most recent common ancestor of target and PR branches
      id: merge-base
      run: |
        echo "merge-base=$(git merge-base ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }})" | tee -a "$GITHUB_OUTPUT"

    - name: Checkout target
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4
      with:
        ref: ${{ steps.merge-base.outputs.merge-base }}

    - name: Generate manifests for base
      run: |
        mkdir -p "$RUNNER_TEMP/old"
        for values in charts/matrix-stack/ci/*values.yaml; do
          echo "Generating old templates with $values";
          mkdir -p "$RUNNER_TEMP/old/$(basename "$values" ".yaml")"
          helm template \
              -n ess-ci \
              -a monitoring.coreos.com/v1/ServiceMonitor \
              -f "$values" charts/matrix-stack | \
          yq ea '[.] | .[] | splitDoc' | \
          yq -s "\"$RUNNER_TEMP/old/$(basename "$values" ".yaml")/\""' + ([.kind, .metadata.name] | join("-") | downcase) + ".yaml"'
        done

    - name: Install dyff with asdf
      uses: asdf-vm/actions/install@1902764435ca0dd2f3388eea723a4f92a4eb8302  # v4
      with:
        tool_versions: |
          dyff 1.10.1

    - name: Upload new manifests
      id: upload-new
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
      with:
        name: new-manifests
        path: ${{ steps.generate-manifests.outputs.output_dir }}
        retention-days: 1

    - name: dyff old and new manifests
      id: dyff
      shell: bash
      env:
        ARTIFACT_URL: ${{ steps.upload-new.outputs.artifact-url }}
        PR_NUMBER: ${{ github.event.pull_request.number }}
      run: |
        echo "output_dir=$RUNNER_TEMP" | tee -a "$GITHUB_OUTPUT"
        values_directories=$(find "$RUNNER_TEMP/old" "$RUNNER_TEMP/new" -maxdepth 1 -type d | sed -E 's|'"$RUNNER_TEMP"'/(old\|new)||' | sed -E 's|^/||' | sort | uniq)
        header="# dyff of changes in rendered templates of CI manifests\n\n"
        comment_body=""
        while read -r values_dir; do
          if [ -z "$values_dir" ]; then
            continue
          fi

          templates_files=$(find "$RUNNER_TEMP/old" "$RUNNER_TEMP/new" -maxdepth 2 -name '*.yaml' | grep "$values_dir" | sed -E 's|'"$RUNNER_TEMP"'/(old\|new)/||' | sort | uniq)
          comment_templates_body=""

          while read -r templates_file; do
            current_file="$(basename "$templates_file")"
            if [[ "$current_file" == ".yaml" ]] && [ ! -s "$template_file" ]; then
              continue
            fi

            if [ ! -f "$RUNNER_TEMP/old/$templates_file" ]; then
              api_version=$(yq '.apiVersion' "$RUNNER_TEMP/new/$templates_file")
              kind=$(yq '.kind' "$RUNNER_TEMP/new/$templates_file")
              name=$(yq '.metadata.name' "$RUNNER_TEMP/new/$templates_file")
              namespace=$(yq '.metadata.namespace' "$RUNNER_TEMP/new/$templates_file")
              metadata=$(yq '.metadata' "$RUNNER_TEMP/new/$templates_file")
              comment_templates_body+="@@ $current_file @@\n"
              comment_templates_body+="# $api_version/$kind/$namespace/$name\n"
              comment_templates_body+="! + one file added - the full content of the file is available in ${ARTIFACT_URL}\n"
              comment_templates_body+="+ apiVersion: $api_version\n"
              comment_templates_body+="+ kind: $kind\n"
              comment_templates_body+="+ metadata:\n"
              while IFS= read -r line; do
                comment_templates_body+="+   $line\n"
              done <<< "$metadata"
              comment_templates_body+="\n\n"
              continue
            fi

            if [ ! -f "$RUNNER_TEMP/new/$templates_file" ]; then
              api_version=$(yq '.apiVersion' "$RUNNER_TEMP/old/$templates_file" )
              kind=$(yq '.kind' "$RUNNER_TEMP/old/$templates_file")
              name=$(yq '.metadata.name' "$RUNNER_TEMP/old/$templates_file")
              namespace=$(yq '.metadata.namespace' "$RUNNER_TEMP/old/$templates_file")
              metadata=$(yq '.metadata' "$RUNNER_TEMP/old/$templates_file")
              comment_templates_body+="@@ $current_file @@\n"
              comment_templates_body+="# $api_version/$kind/$namespace/$name\n"
              comment_templates_body+="! - one file removed\n"
              comment_templates_body+="- apiVersion: $api_version\n"
              comment_templates_body+="- kind: $kind\n"
              comment_templates_body+="- metadata:\n"
              while IFS= read -r line; do
                comment_templates_body+="-   $line\n"
              done <<< "$metadata"
              comment_templates_body+="\n\n"
              continue
            fi

            exit_code=0
            dyff_detail=$(dyff between --set-exit-code --omit-header --output=github "$RUNNER_TEMP/old/$templates_file" "$RUNNER_TEMP/new/$templates_file" 2>&1) || exit_code=$?
            if [ $exit_code -ne 0 ]; then
              if [[ "$dyff_detail" == *"failed to compare input files"* ]]; then
                echo "failed with file $templates_file"
                exit 1
              fi

              api_version=$(yq '.apiVersion' "$RUNNER_TEMP/new/$templates_file")
              kind=$(yq '.kind' "$RUNNER_TEMP/new/$templates_file")
              name=$(yq '.metadata.name' "$RUNNER_TEMP/new/$templates_file")
              namespace=$(yq '.metadata.namespace' "$RUNNER_TEMP/new/$templates_file")
              resource_metadata="# $api_version/$kind/$namespace/$name"
              comment_templates_body+=$(sed -e "1d" -e "/^@@/a$resource_metadata" <<< "$dyff_detail")
              comment_templates_body+="\n\n\n"
            fi
          done <<< "$templates_files"

          if [[ -n "$comment_templates_body" ]]; then
              comment_body+="<details><summary><b>$values_dir.yaml</b></summary>\n"
              comment_body+='\n```diff\n'
              comment_body+="$comment_templates_body"
              comment_body+='```\n'
              comment_body+="\n</details>\n"
          fi

        done <<< "$values_directories"

        if [ -z "$comment_body" ]; then
          comment_body="No changes in rendered templates"
        fi

        echo -e "$header$comment_body" | tee "$RUNNER_TEMP/dyff-output.md"
        echo "pr-number=$PR_NUMBER" | tee "$RUNNER_TEMP/pr-number.txt"

    - name: Upload generated manifests
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
      with:
        name: dyff-templates
        path: ${{ steps.dyff.outputs.output_dir }}
        retention-days: 1