pre-pull-images.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: Pre-pull Images

on:
  pull_request:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: true

env:
  HOMEBREW_NO_ANALYTICS: "1"

jobs:
  filter-changes:
    name: Filter changes
    runs-on: ubuntu-latest
    outputs:
      any_changed: ${{ steps.changed-files.outputs.any_changed }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Get Changed Files
        id: changed-files
        uses: tj-actions/changed-files@v45
        with:
          files: kubernetes/**

  extract-images:
    if: ${{ needs.filter-changes.outputs.any_changed == 'true' }}
    name: Extract Images
    runs-on: ubuntu-latest
    needs:
      - filter-changes
    strategy:
      matrix:
        branches:
          - default
          - pull
      fail-fast: false
    outputs:
      default: ${{ steps.extract-images.outputs.default }}
      pull: ${{ steps.extract-images.outputs.pull }}
    steps:
      - name: Generate Token
        uses: actions/create-github-app-token@v1
        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
        id: app-token
        with:
          app-id: ${{ secrets.LAB_ASSISTANT_APP_ID }}
          private-key: ${{ secrets.LAB_ASSISTANT_APP_KEY }}

      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: "${{ steps.app-token.outputs.token }}"
          ref: "${{ matrix.branches == 'default' && github.event.repository.default_branch || '' }}"

      - name: Gather Images
        uses: docker://ghcr.io/allenporter/flux-local:v7.2.1
        with:
          args: >-
            get cluster
            --all-namespaces
            --path /github/workspace/kubernetes/flux/cluster
            --enable-images
            --only-images
            --output json
            --output-file images.json

      - name: Extract Images
        id: extract-images
        run: |
          echo "${{ matrix.branches }}=$(jq --compact-output '.' images.json)" >> "${GITHUB_OUTPUT}"

  compare-images:
    if: ${{ needs.extract-images.outputs.default != needs.extract-images.outputs.pull }}
    name: Compare Images
    runs-on: ubuntu-latest
    needs:
      - extract-images
    outputs:
      images: ${{ steps.compare-images.outputs.images }}
    steps:
      - name: Compare Images
        id: compare-images
        run: |
          images=$(jq --compact-output --null-input \
              --argjson f1 '${{ needs.extract-images.outputs.default }}' \
              --argjson f2 '${{ needs.extract-images.outputs.pull }}' \
              '$f2 - $f1' \
          )
          echo "images=${images}" >> "${GITHUB_OUTPUT}"

          {
              echo "## New images to Pull"
              echo '```json'
              echo "${images}" | jq
              echo '```'
          } >> "${GITHUB_STEP_SUMMARY}"

  pre-pull-images:
    if: ${{ needs.compare-images.outputs.images != '[]' }}
    name: Pre-pull Images
    runs-on:
      - arc-bjw-s-labs-home-ops
    needs:
      - compare-images
    strategy:
      matrix:
        images: ${{ fromJSON(needs.compare-images.outputs.images) }}
      max-parallel: 4
      fail-fast: false
    steps:
      - name: Install talosctl
        run: curl -fsSL https://talos.dev/install | sh

      - name: Pre-pull Image
        run: talosctl -n "$NODE_IP" image pull "${{ matrix.images }}"

  pre-pull-images-success:
    if: ${{ !cancelled() }}
    needs:
      - pre-pull-images
    name: Pre-pull Images Successful
    runs-on: ubuntu-latest
    steps:
      - name: Check job status
        if: ${{ contains(needs.*.result, 'failure') }}
        run: exit 1

  retry-on-failure:
    name: Retry on failure
    if: ${{ !cancelled() && failure() && fromJSON(github.run_attempt) < 3 }}
    runs-on: ubuntu-latest
    needs:
      - pre-pull-images-success
    steps:
      - name: Generate Token
        uses: actions/create-github-app-token@v1
        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
        id: app-token
        with:
          app-id: ${{ secrets.LAB_ASSISTANT_APP_ID }}
          private-key: ${{ secrets.LAB_ASSISTANT_APP_KEY }}
          owner: ${{ github.repository_owner }}

      - name: Trigger remote workflow
        uses: actions/github-script@v7
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            await github.rest.actions.createWorkflowDispatch({
              owner: 'bjw-s-labs',
              repo: 'github-workflows',
              ref: 'main',
              workflow_id: 'retry-failed-workflow.yaml',
              inputs: {
                github_repository: '${{ github.repository }}',
                run_id: '${{ github.run_id }}',
                delay: '30m',
              },
            })