chatops.yaml

#
# Copyright (C) 2019-2025 vdaas.org vald team <vald@vdaas.org>
#
# Licensed under the Apache License, Version 2.0 (the "License");
# You may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
name: ChatOps
on:
  issue_comment:
    types: [created]
jobs:
  dump-contexts-to-log:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/dump-context
  label:
    if: github.event.comment.user.login != 'vdaas-ci'
    name: Add labels
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/vdaas/vald/vald-ci-container:nightly
    steps:
      - name: Check PR Comments
        id: check_comments_label
        uses: machine-learning-apps/actions-chatops@master
        with:
          TRIGGER_PHRASE: "/label"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Check permissions
        if: steps.check_comments_label.outputs.BOOL_TRIGGERED == 'true'
        id: check_permissions
        run: |
          curl -o chatops_permissions.yaml https://raw.githubusercontent.com/vdaas/vald/main/.github/chatops_permissions.yaml
          roles=`yq r chatops_permissions.yaml "users.${USERNAME}.role.*"`
          if [ "$roles" = "" ]; then
            roles=`yq r chatops_permissions.yaml "default-roles.*"`
          fi
          for role in `echo $roles`
          do
              if yq r chatops_permissions.yaml "roles.${role}.policies.*" | grep "^${REQUIRED_POLICY}$" > /dev/null 2>&1 ; then
                echo "[OK] label requested by ${USERNAME}"
                echo "EXECUTABLE=true" >> $GITHUB_OUTPUT
                break
              fi
          done
        env:
          USERNAME: ${{ steps.check_comments_label.outputs.COMMENTER_USERNAME }}
          REQUIRED_POLICY: label
      - name: Add label
        if: steps.check_comments_label.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true'
        run: |
          labels=`echo "${TRAILING_LINE}" | jq -cMR 'split(" ")'`
          curl --include --verbose --fail \
          -H "Accept: application/json" \
          -H "Content-Type:application/json" \
          -H "Authorization: token ${GITHUB_TOKEN}" \
          --request POST \
          --data "{\"labels\": ${labels}}" \
          `echo "${ISSUE_URL}" | sed -e 's/{\/name}//'`
        env:
          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
          ISSUE_URL: ${{ github.event.issue.labels_url }}
          USERNAME: ${{ steps.check_comments_label.outputs.COMMENTER_USERNAME }}
          TRAILING_LINE: ${{ steps.check_comments_label.outputs.TRAILING_LINE }}
  rebase:
    if: github.event.comment.user.login != 'vdaas-ci'
    name: Rebase
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/vdaas/vald/vald-ci-container:nightly
    steps:
      - name: Check PR Comments
        id: check_comments_rebase
        uses: machine-learning-apps/actions-chatops@master
        with:
          TRIGGER_PHRASE: "/rebase"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Check permissions
        if: steps.check_comments_rebase.outputs.BOOL_TRIGGERED == 'true'
        id: check_permissions
        run: |
          curl -o chatops_permissions.yaml https://raw.githubusercontent.com/vdaas/vald/main/.github/chatops_permissions.yaml
          roles=`yq r chatops_permissions.yaml "users.${USERNAME}.role.*"`
          if [ "$roles" = "" ]; then
            roles=`yq r chatops_permissions.yaml "default-roles.*"`
          fi
          for role in `echo $roles`
          do
              if yq r chatops_permissions.yaml "roles.${role}.policies.*" | grep "^${REQUIRED_POLICY}$" > /dev/null 2>&1 ; then
                echo "[OK] rebase requested by ${USERNAME}"
                echo "EXECUTABLE=true" >> $GITHUB_OUTPUT
                break
              fi
          done
        env:
          USERNAME: ${{ steps.check_comments_rebase.outputs.COMMENTER_USERNAME }}
          REQUIRED_POLICY: rebase
      - name: Comment back to PR
        if: steps.check_comments_rebase.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true'
        run: |
          curl --include --verbose --fail \
          -H "Accept: application/json" \
          -H "Content-Type:application/json" \
          -H "Authorization: token ${GITHUB_TOKEN}" \
          --request POST \
          --data "{\"body\": \"**[REBASE]** Rebase triggered by ${USERNAME} for branch: ${BRANCH}\"}" \
          $API_URL
        env:
          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
          API_URL: ${{ github.event.issue.comments_url }}
          BRANCH: ${{ steps.check_comments_rebase.outputs.BRANCH_NAME }}
          USERNAME: ${{ steps.check_comments_rebase.outputs.COMMENTER_USERNAME }}
      - uses: actions/checkout@v4
        if: steps.check_comments_rebase.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true'
        with:
          fetch-depth: 0
          token: ${{ secrets.DISPATCH_TOKEN }}
      - name: Set Git config
        run: |
          git config --global --add safe.directory ${GITHUB_WORKSPACE}
      - name: Automatic Rebase
        if: steps.check_comments_rebase.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true'
        uses: cirrus-actions/rebase@1.8
        env:
          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
      - name: Failure comment
        if: failure()
        run: |
          curl --include --verbose --fail \
          -H "Accept: application/json" \
          -H "Content-Type:application/json" \
          -H "Authorization: token ${GITHUB_TOKEN}" \
          --request POST \
          --data "{\"body\": \"**[REBASE]** Failed to rebase.\"}" \
          $API_URL
        env:
          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
          API_URL: ${{ github.event.issue.comments_url }}
  gentest:
    if: github.event.comment.user.login != 'vdaas-ci'
    name: Add tests
    needs:
      - rebase
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/vdaas/vald/vald-ci-container:nightly
    steps:
      - name: check PR Comments
        id: check_comments_gen_test
        uses: machine-learning-apps/actions-chatops@master
        with:
          TRIGGER_PHRASE: "/gen-test"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: check permissions
        if: steps.check_comments_gen_test.outputs.BOOL_TRIGGERED == 'true'
        id: check_permissions
        run: |
          curl -o chatops_permissions.yaml https://raw.githubusercontent.com/vdaas/vald/main/.github/chatops_permissions.yaml
          roles=`yq r chatops_permissions.yaml "users.${USERNAME}.role.*"`
          if [ "$roles" = "" ]; then
            roles=`yq r chatops_permissions.yaml "default-roles.*"`
          fi
          for role in `echo $roles`
          do
              if yq r chatops_permissions.yaml "roles.${role}.policies.*" | grep "^${REQUIRED_POLICY}$" > /dev/null 2>&1 ; then
                echo "[OK] add-contributor requested by ${USERNAME}"
                echo "EXECUTABLE=true" >> $GITHUB_OUTPUT
                break
              fi
          done
        env:
          USERNAME: ${{ steps.check_comments_gen_test.outputs.COMMENTER_USERNAME }}
          REQUIRED_POLICY: gen-test
      - name: check executable
        if: steps.check_comments_gen_test.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true'
        run: |
          curl --include --verbose --fail \
          -H "Accept: application/json" \
          -H "Content-Type:application/json" \
          -H "Authorization: token ${GITHUB_TOKEN}" \
          --request POST \
          --data "{\"body\": \"**[GEN TEST]** Generating missing test files triggered by ${USERNAME}.\"}" \
          $API_URL
        env:
          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
          USERNAME: ${{ steps.check_comments_gen_test.outputs.COMMENTER_USERNAME }}
          PR_AUTHOR: ${{ github.event.issue.user.login }}
          API_URL: ${{ github.event.issue.comments_url }}
      - uses: actions/checkout@v4
        if: steps.check_comments_gen_test.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true'
        with:
          fetch-depth: 0
      - name: set git config
        run: |
          git config --global --add safe.directory ${GITHUB_WORKSPACE}
      - uses: crazy-max/ghaction-import-gpg@v6
        if: steps.check_comments_gen_test.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true'
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          git_user_signingkey: true
          git_commit_gpgsign: true
      - name: Generate tests and push
        id: gen_test
        if: steps.check_comments_gen_test.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true'
        run: |
          curl -s ${PR_INFO_URL} > /tmp/pr_info.json
          PR_RESP=`cat /tmp/pr_info.json`
          HEAD_BRANCH=$(cat /tmp/pr_info.json | jq -r .head.ref)
          if [[ -z "$HEAD_BRANCH" ]]; then
            echo "Cannot get head branch information for PR #${PR_NUM}!"
            echo "API response: $PR_RESP"
            exit 1
          fi
          echo "Head branch for PR #${PR_NUM} is ${HEAD_BRANCH}"

          git checkout ${HEAD_BRANCH}

          make gotests/install
          echo -n "ERR_LOG=" >> $GITHUB_OUTPUT
          make gotests/gen 2>> $GITHUB_OUTPUT

          git add cmd hack internal pkg
          git commit -S --signoff -m ":robot: Add automatically generated tests"

          git pull --rebase

          git remote set-url origin "https://${GITHUB_USER}:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"

          git push origin ${HEAD_BRANCH}
        env:
          GITHUB_USER: ${{ secrets.DISPATCH_USER }}
          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
          PR_INFO_URL: ${{ github.event.issue.pull_request.url }}
          PR_AUTHOR: ${{ github.event.issue.user.login }}
          PR_NUM: ${{ github.event.issue.number }}
      - name: failure comment
        if: failure()
        run: |
          ERR_LOG=${{ steps.gen_test.outputs.ERR_LOG }}
          curl --include --verbose --fail \
          -H "Accept: application/json" \
          -H "Content-Type:application/json" \
          -H "Authorization: token ${GITHUB_TOKEN}" \
          --request POST \
          --data "{\"body\": \"**[GEN TEST]** Failed to generate tests. Error: $ERR_LOG\"}" \
          $API_URL
        env:
          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
          API_URL: ${{ github.event.issue.comments_url }}
  format:
    if: github.event.comment.user.login != 'vdaas-ci'
    name: Add license and run golines + gofumpt + goimports
    needs:
      - rebase
      - gentest
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/vdaas/vald/vald-ci-container:nightly
    steps:
      - name: check PR Comments
        id: check_comments_format
        uses: machine-learning-apps/actions-chatops@master
        with:
          TRIGGER_PHRASE: "/format"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: check permissions
        if: steps.check_comments_format.outputs.BOOL_TRIGGERED == 'true'
        id: check_permissions
        run: |
          curl -o chatops_permissions.yaml https://raw.githubusercontent.com/vdaas/vald/main/.github/chatops_permissions.yaml
          roles=`yq r chatops_permissions.yaml "users.${USERNAME}.role.*"`
          if [ "$roles" = "" ]; then
            roles=`yq r chatops_permissions.yaml "default-roles.*"`
          fi
          for role in `echo $roles`
          do
              if yq r chatops_permissions.yaml "roles.${role}.policies.*" | grep "^${REQUIRED_POLICY}$" > /dev/null 2>&1 ; then
                echo "[OK] format requested by ${USERNAME}"
                echo "EXECUTABLE=true" >> $GITHUB_OUTPUT
                break
              fi
          done
        env:
          USERNAME: ${{ steps.check_comments_format.outputs.COMMENTER_USERNAME }}
          REQUIRED_POLICY: format
      - name: check executable
        if: steps.check_comments_format.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true'
        run: |
          curl --include --verbose --fail \
          -H "Accept: application/json" \
          -H "Content-Type:application/json" \
          -H "Authorization: token ${GITHUB_TOKEN}" \
          --request POST \
          --data "{\"body\": \"**[FORMAT]** Updating license headers and formatting go codes triggered by ${USERNAME}.\"}" \
          $API_URL
        env:
          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
          USERNAME: ${{ steps.check_comments_format.outputs.COMMENTER_USERNAME }}
          API_URL: ${{ github.event.issue.comments_url }}
      - uses: actions/checkout@v4
        if: steps.check_comments_format.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true'
        with:
          fetch-depth: 0
          token: ${{ secrets.DISPATCH_TOKEN }}
      - name: set git config
        run: |
          git config --global --add safe.directory ${GITHUB_WORKSPACE}
      - uses: crazy-max/ghaction-import-gpg@v6
        if: steps.check_comments_format.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true'
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          git_user_signingkey: true
          git_commit_gpgsign: true
      - name: update and push
        id: format_push
        if: steps.check_comments_format.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true'
        run: |
          export PATH=$(go env GOBIN):$PATH

          curl -s ${PR_INFO_URL} > /tmp/pr_info.json
          PR_RESP=`cat /tmp/pr_info.json`
          HEAD_BRANCH=$(cat /tmp/pr_info.json | jq -r .head.ref)
          if [[ -z "$HEAD_BRANCH" ]]; then
            echo "Cannot get head branch information for PR #${PR_NUM}!"
            echo "API response: $PR_RESP"
            exit 1
          fi
          echo "Head branch for PR #${PR_NUM} is ${HEAD_BRANCH}"

          git checkout ${HEAD_BRANCH}

          echo "Update license headers and format go codes/yaml"

          sudo make format

          git checkout go.mod go.sum

          if git diff --quiet --exit-code; then
            echo "UPDATED=false" >> $GITHUB_OUTPUT
            echo "Nothing updated"
          else
            echo "UPDATED=true" >> $GITHUB_OUTPUT
            git add .
            git commit -S --signoff -m ":robot: Update license headers / Format go codes and yaml files"

            git remote set-url origin "https://${GITHUB_USER}:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"

            git push origin ${HEAD_BRANCH}
          fi
        env:
          GITHUB_USER: ${{ secrets.DISPATCH_USER }}
          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
          PR_INFO_URL: ${{ github.event.issue.pull_request.url }}
          PR_NUM: ${{ github.event.issue.number }}
      - name: no changes
        if: steps.check_comments_format.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true' && steps.format_push.outputs.UPDATED == 'false'
        run: |
          curl --include --verbose --fail \
          -H "Accept: application/json" \
          -H "Content-Type:application/json" \
          -H "Authorization: token ${GITHUB_TOKEN}" \
          --request POST \
          --data "{\"body\": \"**[FORMAT]** Nothing to format.\"}" \
          $API_URL
        env:
          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
          API_URL: ${{ github.event.issue.comments_url }}
      - name: failure comment
        if: failure()
        run: |
          curl --include --verbose --fail \
          -H "Accept: application/json" \
          -H "Content-Type:application/json" \
          -H "Authorization: token ${GITHUB_TOKEN}" \
          --request POST \
          --data "{\"body\": \"**[FORMAT]** Failed to format.\"}" \
          $API_URL
        env:
          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
          API_URL: ${{ github.event.issue.comments_url }}
  approve:
    if: github.event.comment.user.login != 'vdaas-ci'
    name: Approve
    needs:
      - rebase
      - format
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/vdaas/vald/vald-ci-container:nightly
    steps:
      - name: check PR Comments
        id: check_comments_approve
        uses: machine-learning-apps/actions-chatops@master
        with:
          TRIGGER_PHRASE: "/approve"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: check permissions
        if: steps.check_comments_approve.outputs.BOOL_TRIGGERED == 'true'
        id: check_permissions
        run: |
          curl -o chatops_permissions.yaml https://raw.githubusercontent.com/vdaas/vald/main/.github/chatops_permissions.yaml
          roles=`yq r chatops_permissions.yaml "users.${USERNAME}.role.*"`
          if [ "$roles" = "" ]; then
            roles=`yq r chatops_permissions.yaml "default-roles.*"`
          fi
          for role in `echo $roles`
          do
              if yq r chatops_permissions.yaml "roles.${role}.policies.*" | grep "^${REQUIRED_POLICY}$" > /dev/null 2>&1 ; then
                echo "[OK] approved requested by ${USERNAME}"
                echo "EXECUTABLE=true" >> $GITHUB_OUTPUT
                break
              fi
          done
        env:
          USERNAME: ${{ steps.check_comments_approve.outputs.COMMENTER_USERNAME }}
          REQUIRED_POLICY: approve
      - name: approve
        if: steps.check_comments_approve.outputs.BOOL_TRIGGERED == 'true' && steps.check_permissions.outputs.EXECUTABLE == 'true'
        run: |
          curl --include --verbose --fail \
          -H "Accept: application/json" \
          -H "Content-Type:application/json" \
          -H "Authorization: token ${GITHUB_TOKEN}" \
          --request POST \
          --data "{\"body\": \"**[APPROVED]** This PR is approved by ${USERNAME}.\", \"event\": \"APPROVE\"}" \
          "${PR_URL}/reviews"
        env:
          GITHUB_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
          PR_URL: ${{ github.event.issue.pull_request.url }}
          USERNAME: ${{ steps.check_comments_approve.outputs.COMMENTER_USERNAME }}