backport-action.yml

name: Launch Backport Job
on:
  workflow_call:
    inputs:
      pull_request_url:
        description: URL of the pull request from the issue comment event
        type: string
        required: true
      target_branch:
        description: Branch to backport the changes
        type: string
        required: true
      comment_author:
        description: Author of the PR comment
        type: string
        required: true
      github_repository:
        description: GitHub Repository where the comment was written
        type: string
        required: true
      use_fork:
        description: The action should create a PR from a fork
        type: boolean
        required: false
        default: false
    secrets:
      ado_organization:
        description: Azure DevOps organization that hosts the backport job
        required: true
      ado_project:
        description: Azure DevOps project that hosts the backport job
        required: true
      backport_pipeline_id:
        description: ID of the backport yaml pipeline in Azure DevOps
        required: true
      ado_build_pat:
        description: PAT of an account that can launch builds on the backport pipeline in Azure DevOps
        required: true
      github_account_pat:
        description: PAT for a github account that has write access to source repository
        required: true
jobs:
  launch_ado_build:
    runs-on: ubuntu-latest
    # GITHUB_TOKEN change from read-write to read-only on 2024-02-01 requiring permissions block
    # https://docs.opensource.microsoft.com/github/apps/permission-changes/
    # https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
    permissions:
      actions: none
      contents: read
      security-events: none
    env:
      # Protect against script injection attacks via input variables (i.e., the content of the variables could be executed at the time of evaluation/expansion within a script)
      # Scripts must consume the environment variable settings instead
      GITHUB_REPOSITORY: "${{ inputs.github_repository }}"
      GITHUB_ACCOUNT_PAT: "${{ secrets.github_account_pat }}"
      COMMENT_AUTHOR: "${{ inputs.comment_author }}"
      PULL_REQUEST_URL: "${{ inputs.pull_request_url }}"
      TARGET_BRANCH: "${{ inputs.target_branch }}"
      USE_FORK: "${{ inputs.use_fork }}"
      ADO_ORGANIZATION: "${{ secrets.ado_organization }}"
      ADO_PROJECT: "${{ secrets.ado_project }}"
      ADO_PIPELINE_ID: "${{ secrets.backport_pipeline_id }}"
      ADO_BUILD_PAT: "${{ secrets.ado_build_pat }}"
    steps:
      - name: Gather Parameters
        id: get_parameters
        run: |
          $statusCode = 0
          $message = ""
          try {
            $gitHubRepository = $env:GITHUB_REPOSITORY
            $gitHubAccountPAT = $env:GITHUB_ACCOUNT_PAT
            $commentAuthor = $env:COMMENT_AUTHOR
            $pullRequestUrl = $env:PULL_REQUEST_URL
            $backportTargetBranch = $env:TARGET_BRANCH
            $useFork = $env:USE_FORK

            Write-Host "GITHUB_REPOSITORY: ${gitHubRepository}"
            Write-Host "COMMENT_AUTHOR: ${commentAuthor}"
            Write-Host "PULL_REQUEST_URL: ${pullRequestUrl}"
            Write-Host "TARGET_BRANCH: ${backportTargetBranch}"
            Write-Host "USE_FORK: ${useFork}"

            ($repoOwner, $repoName) = $gitHubRepository.Split("/")
            $headers = $headers = @{ Authorization = "token ${gitHubAccountPAT}"}
            $uri = "https://api.github.com/repos/${repoOwner}/${repoName}/collaborators/${commentAuthor}/permission"
            Write-Host "Checking ${repoOwner} membership for ${commentAuthor} via $uri"
            $response = Invoke-WebRequest -Headers $headers -Uri $uri
            $content = $response.Content | ConvertFrom-Json
            $accessType = $content.permission
            Write-Host "Found membership: $accessType"
            if (-not ($accessType.Equals("admin") -or $accessType.Equals("write"))) {
              throw "${commentAuthor}/permission does not have sufficient permissions for ${gitHubRepository}"
            }

            Write-Host "Grabbing PR details from ${pullRequestUrl}"
            $response = Invoke-WebRequest -UseBasicParsing -Headers $headers -Uri "${pullRequestUrl}" | ConvertFrom-Json
            $backportPRNumber = $response.number

            $parameters = @{
              BackportRepoName = "$repoName";
              BackportRepoOrg = "$repoOwner";
              BackportTargetBranch = "$backportTargetBranch";
              BackportPRNumber = "$backportPRNumber";
              BackportHeadSHA = "$($response.head.sha)";
              UseFork = $useFork -eq "true";
            } | ConvertTo-Json -Compress

            $json = $parameters.Replace("`"","'")
            Write-Host "Setting output variables"
            echo "::set-output name=parameters::$json"
            echo "::set-output name=pr_number::$backportPRNumber"
          } catch {
            Write-Host $_.Exception.Message
            $statusCode = 1
          }
          return $statusCode
        shell: pwsh

      - run: |
          $adoOrganization = $env:ADO_ORGANIZATION
          $adoProject = $env:ADO_PROJECT
          $adoPipelineId = $env:ADO_PIPELINE_ID
          $adoBuildPAT = $env:ADO_BUILD_PAT
          $gitHubRepository = $env:GITHUB_REPOSITORY
          $gitHubAccountPAT = $env:GITHUB_ACCOUNT_PAT

          Write-Host "ADO_ORGANIZATION: ${adoOrganization}"
          Write-Host "ADO_PROJECT: ${adoProject}"
          Write-Host "ADO_PIPELINE_ID: ${adoPipelineId}"
          Write-Host "GITHUB_REPOSITORY: ${gitHubRepository}"

          $message = ""
          $statusCode = 0
          try {
            $launchURI = "https://dev.azure.com/${adoOrganization}/${adoProject}/_apis/pipelines/${adoPipelineId}/runs?api-version=6.0-preview.1"
            Write-Host "Grabbing parameters from prior step"
            $parameters = ConvertFrom-Json "${{ steps.get_parameters.outputs.parameters }}"
            Write-Host "$parameters"
            $jsonBody = @{
                previewRun = false;
                templateParameters = $parameters;
                resources = @{
                  repositories = @{
                    self = @{
                      refName = "refs/heads/main"
                    }
                  }
                };
              } | ConvertTo-Json -Depth 10

            Write-Host "Posting to $launchURI"
            Write-Host $jsonBody
            $encoded = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes(":${adoBuildPAT}"))
            $headers = @{ Authorization = "Basic $encoded"}

            $response = Invoke-WebRequest -UseBasicParsing -Method POST -Headers $headers -ContentType "application/json" -Uri $launchURI -Body $jsonBody
            $responseJson = ConvertFrom-Json $response.Content
            echo "Job successfully launched"
            $message = "Backport Job to branch **$($parameters.BackportTargetBranch)** Created! The magic is happening [here](https://dev.azure.com/${adoOrganization}/${adoProject}/_build/results?buildId=$($responseJson.id))"
          } catch {
            Write-Host $_.Exception.Message
            $message = "I couldn't create a backport to **$($parameters.BackportTargetBranch)** for you. :( Please check the Action logs for more details."
            $statusCode = 1
          } finally {
            $jsonBody = @{
              body = $message
            } | ConvertTo-Json

            $headers = @{ Authorization = "token ${gitHubAccountPAT}"}
            $uri = "https://api.github.com/repos/${gitHubRepository}/issues/${{ steps.get_parameters.outputs.pr_number }}/comments"


            Write-Host "Posting to $uri"
            Write-Host "$jsonBody"
            Invoke-WebRequest -UseBasicParsing -Headers $headers -Method POST -Uri $uri -Body $jsonBody
          }
          return $statusCode
        shell: pwsh