openobserve/.github/workflows/dispatch-event-enterprise.yml

name: initiate_enterprise_build

on:
  pull_request:
    branches:
      - "**"
    types: [synchronize, labeled, ready_for_review, converted_to_draft]
  # Runs when ready-for-ci is added and when the PR is approved; pushes run only while the approval stands.
  pull_request_review:
    types: [submitted]

concurrency:
  # A non-approval review or an unrelated label does nothing, so it must not cancel a running dispatch.
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}${{ ((github.event_name == 'pull_request_review' && github.event.review.state != 'approved') || (github.event.action == 'labeled' && github.event.label.name != 'ready-for-ci')) && format('-{0}', github.run_id) || '' }}
  cancel-in-progress: true

env:
  GITHUB_HEAD_SHA: ${{ github.event.pull_request.head.sha }}

jobs:
  trigger:
    # reviewDecision of a stacked PR is judged by the stack's merge rules, so it is what the merge will require.
    if: ${{ github.event.pull_request.head.repo.fork == false && (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && github.event.pull_request.draft == false) && ((github.event_name == 'pull_request_review' && github.event.review.state == 'approved') || (github.event_name == 'pull_request' && (github.event.action != 'labeled' || github.event.label.name == 'ready-for-ci'))) }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      pull-requests: read
      statuses: read
    outputs:
      dispatch: ${{ steps.check.outputs.dispatch }}
    steps:
      - id: check
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          PR: ${{ github.event.pull_request.number }}
          SHA: ${{ github.event.pull_request.head.sha }}
          ACTION: ${{ github.event_name == 'pull_request' && github.event.action || '' }}
        run: |
          # The job filter leaves only ready-for-ci for labeled; it and ready_for_review dispatch once without an approval.
          if [ "$ACTION" = "labeled" ] || [ "$ACTION" = "ready_for_review" ]; then
            echo "Triggered by $ACTION; approval not required."
            DISPATCH=true
          else
            DECISION=$(gh pr view "$PR" --json reviewDecision --jq .reviewDecision)
            echo "reviewDecision: $DECISION"
            DISPATCH=false
            if [ "$DECISION" = "APPROVED" ]; then DISPATCH=true; fi
          fi
          # A second approval or a re-added label must not rebuild a commit the enterprise build already passed.
          STATUS=$(gh api "repos/$GH_REPO/commits/$SHA/status" --jq '.statuses[] | select(.context == "ent-build-status-check") | "\(.state) \(now - (.updated_at | fromdateiso8601) | floor)"')
          read -r STATE AGE <<< "$STATUS"
          if [ "$DISPATCH" = "true" ] && [ "$STATE" = "success" ]; then
            echo "ent-build-status-check already passed on $SHA."
            DISPATCH=false
          fi
          # o2-enterprise cancels the older run for a branch, so re-dispatching a SHA still building would restart it; past an hour it is presumed lost.
          if [ "$DISPATCH" = "true" ] && [ "$STATE" = "pending" ] && [ "${AGE:-3600}" -lt 3600 ]; then
            echo "ent-build-status-check has been pending on $SHA for ${AGE}s; not re-dispatching."
            DISPATCH=false
          fi
          echo "dispatch=$DISPATCH" >> "$GITHUB_OUTPUT"

  initiate_enterprise_build:
    needs: trigger
    if: ${{ needs.trigger.outputs.dispatch == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
      statuses: write
    steps:
      # Debounce: a push inside this window cancels the run (concurrency) before anything paid starts.
      - if: github.event_name == 'pull_request'
        run: sleep 60
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: ./.github/actions/classify-changes
        id: classify
        with:
          # github.base_ref is empty on pull_request_review events.
          base: origin/${{ github.event.pull_request.base.ref }}
      # ent-build-status-check is required; when no backend or frontend code changed there is nothing to build,
      # so report it as passed here instead of dispatching.
      - name: Report not applicable
        if: ${{ steps.classify.outputs.run_enterprise != 'true' }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh api -X POST "repos/${{ github.repository }}/statuses/${{ github.event.pull_request.head.sha }}" \
            -f state=success -f context=ent-build-status-check -f description="no backend or frontend change; enterprise build not needed"
      - name: Generate token
        if: ${{ steps.classify.outputs.run_enterprise == 'true' }}
        id: generate_token
        uses: actions/create-github-app-token@v3.3.0
        with:
          private-key: ${{ secrets.PRIVATE_KEY }}
          app-id: ${{ secrets.APP_ID }}
          # Set the owner, so the token can be used in all repositories
          owner: ${{ github.repository_owner }}
      - name: Set build short sha
        if: ${{ steps.classify.outputs.run_enterprise == 'true' }}
        shell: bash
        run: |
          unset SHORT_COMMIT_ID
          echo "SHORT_COMMIT_ID=${GITHUB_HEAD_SHA:0:7}" >> $GITHUB_ENV
          echo "COMMIT_ID=${GITHUB_HEAD_SHA}" >> $GITHUB_ENV

      - name: Confirm git commit SHA output
        if: ${{ steps.classify.outputs.run_enterprise == 'true' }}
        run: echo ${{ env.SHORT_COMMIT_ID }}

      # Posted before the dispatch so it can never overwrite the enterprise result; the trigger guard reads it.
      - name: Report dispatched
        id: pending
        if: ${{ steps.classify.outputs.run_enterprise == 'true' }}
        continue-on-error: true
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh api -X POST "repos/$GITHUB_REPOSITORY/statuses/$GITHUB_HEAD_SHA" \
            -f state=pending -f context=ent-build-status-check -f description="dispatched to o2-enterprise; waiting for its build"

      - name: Repository Dispatch
        id: dispatch
        if: ${{ steps.classify.outputs.run_enterprise == 'true' }}
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
        env:
          TOKEN: ${{ steps.generate_token.outputs.token }}
          BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
        with:
          token: ${{ env.TOKEN }} # access token
          repository: openobserve/o2-enterprise
          event-type: initiate-enterprise-build
          client-payload: '{"o2_enterprise_repo": "${{ env.BRANCH_NAME }}", "o2_opensource_repo": "${{ env.BRANCH_NAME }}" ,"o2_commit_id": "${{ env.SHORT_COMMIT_ID }}", "o2_full_commit":"${{env.COMMIT_ID}}", "o2_target_branch": "${{ github.event.pull_request.base.ref }}"}'
      # A pending left by a dispatch that never went out would make the trigger guard skip the next one for an hour.
      - name: Report dispatch failed
        if: ${{ (failure() || cancelled()) && steps.pending.outcome == 'success' && steps.dispatch.outcome != 'success' }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh api -X POST "repos/$GITHUB_REPOSITORY/statuses/$GITHUB_HEAD_SHA" \
            -f state=error -f context=ent-build-status-check -f description="dispatch to o2-enterprise failed; re-add ready-for-ci or re-approve the PR to retry"