packer-build-and-publish.yml

name: Packer Build and Publish AMI

on:
  workflow_call:

permissions:
  contents: write
  id-token: write

jobs:
  check-main:
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    outputs:
      is_main: ${{ steps.is_main.outputs.value }}
    steps:
      - name: Checkout main branch
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: main

      - name: Check if main branch contains the tagged commit
        id: is_main
        run: |
          git fetch origin main --depth=$((2**31 - 1)) # Fetch all commits from main
          is_main=$([ -n "$(git branch -r --contains ${{ github.sha }} origin/main)" ] && echo true || echo false)
          echo "value=$is_main" >> "${GITHUB_OUTPUT}"

  check-release:
    runs-on: ubuntu-latest
    outputs:
      release_found: ${{ steps.get_release_by_commit.outputs.release_found }}
      release_id: ${{ steps.get_release_by_commit.outputs.release_id }}
      is_draft: ${{ steps.get_release_by_commit.outputs.is_draft }}
      body: ${{ steps.get_release_by_commit.outputs.body }}
      tag: ${{ steps.get_release_by_commit.outputs.tag }}
    steps:
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Find release for the commit
        id: get_release_by_commit
        run: |
          # Fetch last 100 releases (it sorts by latest, last 100 should be enough)
          releases=$(curl -s -H "Authorization: token ${{ github.token }}" \
            "${{ github.api_url }}/repos/${{ github.repository }}/releases?per_page=100")

          # Iterate over each release
          while read -r release; do
            release_id=$(echo "$release" | jq -r '.id')
            tag_name=$(echo "$release" | jq -r '.tag_name')
            is_draft=$(echo "$release" | jq -r '.draft')
            body=$(echo "$release" | jq -r '.body')

            # Get the commit for the tag
            tag_info=$(curl -s -H "Authorization: token ${{ github.token }}" \
              "${{ github.api_url }}/repos/${{ github.repository }}/git/refs/tags/${tag_name}")

            # Handle annotated and lightweight tags
            tag_type=$(echo "$tag_info" | jq -r '.object.type')
            if [ "$tag_type" = "tag" ]; then
              # Annotated tag, get the commit from the tag object
              tag_object=$(curl -s -H "Authorization: token ${{ github.token }}" \
                "$(echo "$tag_info" | jq -r '.object.url')")
              commit_sha=$(echo "$tag_object" | jq -r '.object.sha')
            else
              # Lightweight tag, points directly to the commit
              commit_sha=$(echo "$tag_info" | jq -r '.object.sha')
            fi

            if [ "$commit_sha" = "${{ github.sha }}" ]; then
              echo "Release found (ID: $release_id)"
              echo "release_found=true" >> $GITHUB_OUTPUT
              echo "release_id=$release_id" >> $GITHUB_OUTPUT
              echo "is_draft=$is_draft" >> $GITHUB_OUTPUT
              echo "tag=$tag_name" >> $GITHUB_OUTPUT
              echo "body<<EOF" >> $GITHUB_OUTPUT
              echo "$body" >> $GITHUB_OUTPUT
              echo "EOF" >> $GITHUB_OUTPUT
              exit 0
            fi
          done < <(echo "$releases" | jq -c '.[]')

          echo "No release found for commit ${{ github.sha }}"
          echo "release_found=false" >> $GITHUB_OUTPUT

  build:
    needs:
      - check-release
    if: needs.check-release.outputs.release_found == 'false'
    runs-on: ubuntu-latest

    env:
      AWS_ACCOUNT: "654654387067"
      AWS_REGION: us-east-2

    strategy:
      fail-fast: false
      matrix:
        template:
          - images/ubuntu/templates/ubuntu-24.04.pkr.hcl
          - images/ubuntu/templates/ubuntu-24.04.arm64.pkr.hcl

    steps:
      - name: Checkout repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Assume OIDC role
        id: auth
        run: |
          AUDIENCE="github-actions-cognito-identity-pool"
          AWS_ACCOUNT_ID="590183704419"
          COGNITO_IDENTITY_POOL_ID="us-east-2:3a4bca79-07af-4921-a9fb-e21475708406"
          JUMP_ROLE_ARN="arn:aws:iam::590183704419:role/github-actions-oidc-jump-role"

          response=$(curl -sLS -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${AUDIENCE}")
          ACCESS_TOKEN=$(echo "${response}" | jq -r ".value")

          # job_workflow_ref is not available in the environment, so we need to
          # extract it from the token.
          payload=$(echo "$ACCESS_TOKEN" | cut -d '.' -f 2)
          # Pad the JWT if length would cause issues with base64 decoding.
          payload=$(awk -vstr="$payload" 'BEGIN {l=length(str)+2; print substr(str"==",1,l-l%4)}' | base64 -d | { cat; echo; })

          jobWorkflowRefValue=$(echo "$payload" | jq -r '.job_workflow_ref')
          echo "job_workflow_ref=${jobWorkflowRefValue}" >> "${GITHUB_OUTPUT}"

          repositoryNameValue=$(echo $GITHUB_REPOSITORY | cut -d'/' -f2)
          echo "repository_name=${repositoryNameValue}" >> "${GITHUB_OUTPUT}"

          getIdResponse=$(aws cognito-identity get-id --identity-pool-id "${COGNITO_IDENTITY_POOL_ID}" \
          --account-id "${AWS_ACCOUNT_ID}" \
          --logins '{"token.actions.githubusercontent.com":"'"${ACCESS_TOKEN}"'"}')
          identityId=$(echo "${getIdResponse}" | jq -rc '.IdentityId')

          cognitoIdentityTokenResponse=$(aws cognito-identity get-open-id-token --identity-id "${identityId}" \
          --logins '{"token.actions.githubusercontent.com":"'"${ACCESS_TOKEN}"'"}')
          cognitoIdentityOidcAccessToken=$(echo "${cognitoIdentityTokenResponse}" | jq -r '.Token')

          echo "::add-mask::$cognitoIdentityOidcAccessToken"

          awsCredentials=$(aws sts assume-role-with-web-identity \
            --role-session-name "GitHubActions" \
            --role-arn "${JUMP_ROLE_ARN}" \
            --duration-seconds 18000 \
            --web-identity-token "${cognitoIdentityOidcAccessToken}")

          accessKeyId=$(echo "$awsCredentials" | jq -r ".Credentials.AccessKeyId")
          echo "::add-mask::$accessKeyId"

          secretAccessKey=$(echo "$awsCredentials" | jq -r ".Credentials.SecretAccessKey")
          echo "::add-mask::$secretAccessKey"

          sessionToken=$(echo "$awsCredentials" | jq -r ".Credentials.SessionToken")
          echo "::add-mask::$sessionToken"

          echo "AWS_ACCESS_KEY_ID=${accessKeyId}" >> "${GITHUB_ENV}"
          echo "AWS_SECRET_ACCESS_KEY=${secretAccessKey}" >> "${GITHUB_ENV}"
          echo "AWS_SESSION_TOKEN=${sessionToken}" >> "${GITHUB_ENV}"

          expiration=$(echo "$awsCredentials" | jq -r ".Credentials.Expiration")

          echo "Jump role session expires at: $expiration"

      - name: Set up Packer
        uses: hashicorp/setup-packer@1aa358be5cf73883762b302a3a03abd66e75b232 # v3.1.0

      - name: Packer build
        env:
          GITHUB_REF: ${{ github.ref }}
          GITHUB_JOB_WORKFLOW_REF: ${{ steps.auth.outputs.job_workflow_ref }}
          GITHUB_REPOSITORY_NAME: ${{ steps.auth.outputs.repository_name }}
        run: |
          packer init ${{ matrix.template }}
          packer build \
            -var provider=aws \
            -var aws_private_ami=true \
            -var image_version="${{ github.ref_name }}" \
            -var aws_assume_role_arn="arn:aws:iam::${{ env.AWS_ACCOUNT }}:role/github-actions/packer-role" \
            -var aws_assume_role_session_name=GitHubActions \
            ${{ matrix.template }}

      - name: Preapre artifacts
        id: artifacts
        run: |
          mkdir -p artifacts
          name=$(basename -s .pkr.hcl ${{ matrix.template }})
          readme=$(git ls-files --others --exclude-standard -- '**/software-report.md')
          mv "$readme" artifacts/${name}-software-report.md
          report=$(git ls-files --others --exclude-standard -- '**/software-report.json')
          mv "$report" artifacts/${name}-software-report.json
          manifest=$(git ls-files --others --exclude-standard -- '**/build-manifest.json')
          mv "$manifest" artifacts/${name}-build-manifest.json
          echo "name=$name" >> "${GITHUB_OUTPUT}"

      - name: Upload artifacts
        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
        with:
          name: "Artifacts for ${{ steps.artifacts.outputs.name }}.pkr.hcl"
          path: artifacts

  publish:
    runs-on: ubuntu-latest
    needs:
      - check-main
      - check-release
      - build
    if: ${{ !failure() && !cancelled() }}
    outputs:
      release_id: ${{ steps.publish.outputs.id || needs.check-release.outputs.release_id }}
      prod_release: ${{ env.PROD_RELEASE }}
    env:
      PROD_RELEASE: ${{ needs.check-main.outputs.is_main == 'true' && !contains(github.ref_name, '-') }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      # If no release exists, download artifacts from the build job
      - name: Download artifacts from build job
        if: needs.check-release.outputs.release_found == 'false'
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          path: artifacts

      - name: Check if latest
        id: is_latest
        run: |
          # Fetch all tags from the repository
          git fetch --tags

          # Fetch all version tags from the repository
          tags=$(git tag | { grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' || true; })

          # Sort the tags using semantic versioning and get latest tag
          latest_tag=$(echo "$tags" | sort -V | tail -n 1)

          # Compare the tag_to_check with the latest tag
          if [ "${{ github.ref_name }}" = "$latest_tag" ]; then
              echo "value=true" >> "${GITHUB_OUTPUT}"
          else
              echo "value=false" >> "${GITHUB_OUTPUT}"
          fi

      - name: Publish release
        id: publish
        if: needs.check-release.outputs.release_found == 'false'
        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
        with:
          files: artifacts/**/*
          body: |
            Release ${{ github.ref_name }} from workflow [#${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
          draft: ${{ env.PROD_RELEASE == 'false' }}
          make_latest: ${{ env.PROD_RELEASE == 'true' && steps.is_latest.outputs.value }}
          generate_release_notes: true

      - name: Update release
        id: update_release
        if: needs.check-release.outputs.release_found == 'true' && needs.check-release.outputs.is_draft == 'true'
        env:
          RELEASE_BODY: ${{ needs.check-release.outputs.body }}
          RELEASE_TAG: ${{ needs.check-release.outputs.tag }}
        run: |
          curl -X PATCH \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: token ${{ github.token }}" \
            ${{ github.api_url }}/repos/${{ github.repository }}/releases/${{ needs.check-release.outputs.release_id }} \
            -d "$(jq -n \
              --arg name "${{ github.ref_name }}" \
              --arg tag_name "${{ github.ref_name }}" \
              --argjson draft ${{ env.PROD_RELEASE == 'false' }} \
              --arg make_latest "${{ env.PROD_RELEASE == 'true' && steps.is_latest.outputs.value }}" \
              --arg body "$(echo "$RELEASE_BODY" | sed "/Release .* from workflow/ s/$RELEASE_TAG/${{ github.ref_name }}/g; /Full Changelog/ s/$RELEASE_TAG/${{ github.ref_name }}/g")" \
              '{name: $name, tag_name: $tag_name, draft: $draft, make_latest: $make_latest, body: $body}' \
            )"

  share-and-copy-amis:
    needs:
      - publish
    if: ${{ !failure() && !cancelled() && needs.publish.outputs.prod_release == 'true' }}
    runs-on: ubuntu-latest

    env:
      DEV_ACCOUNT: "654654387067"
      PROD_ACCOUNT: "590183878691"
      AWS_REGION: us-east-2

    steps:
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Download manifest assets
        run: |
          # Get the list of assets for the specified release
          assets=$(curl -s -H "Authorization: token ${{ github.token }}" \
            "${{ github.api_url }}/repos/${{ github.repository }}/releases/${{ needs.publish.outputs.release_id }}/assets")

          # Filter assets matching the pattern and download each one
          echo "$assets" | jq -r '.[] | select(.name | test("^build-manifest-.*\\.json$")) | "\(.id) \(.name)"' | while read -r asset_id asset_name; do
            echo "Downloading $asset_name (ID: $asset_id)"
            curl -L -H "Accept: application/octet-stream" \
              -H "Authorization: token ${{ github.token }}" \
              "${{ github.api_url }}/repos/${{ github.repository }}/releases/assets/${asset_id}" \
              -o "${asset_name}"
          done

      - name: Authenticate with Dev AWS Account
        uses: grafana/shared-workflows/actions/aws-auth@main
        with:
          aws-region: "us-east-2"
          role-arn: "arn:aws:iam::${{ env.DEV_ACCOUNT }}:role/github-actions/packer-role"
          set-creds-in-environment: true

      - name: Share AMIs with Prod Account
        run: |
          PROD_ACCOUNT_ID="${{ env.PROD_ACCOUNT }}"
          for file in build-manifest-*.json; do
            echo "Processing $file for sharing"
            builds_length=$(jq '.builds | length' "$file")
            for ((i=0; i<$builds_length; i++)); do
              artifact_id=$(jq -r ".builds[$i].artifact_id" "$file")
              IFS=',' read -ra AMI_LIST <<< "$artifact_id"
              for AMI_PAIR in "${AMI_LIST[@]}"; do
                REGION=$(echo $AMI_PAIR | cut -d: -f1)
                AMI_ID=$(echo $AMI_PAIR | cut -d: -f2)
                echo "Sharing AMI $AMI_ID in region $REGION with account $PROD_ACCOUNT_ID"
                aws ec2 modify-image-attribute --image-id $AMI_ID --region $REGION --launch-permission "Add=[{UserId=$PROD_ACCOUNT_ID}]"

                # Retrieve the snapshot IDs associated with the AMI
                SNAPSHOT_IDS=$(aws ec2 describe-images --image-ids $AMI_ID --region $REGION --query 'Images[].BlockDeviceMappings[].Ebs.SnapshotId' --output text)

                # Share each snapshot with the Prod account
                for SNAPSHOT_ID in $SNAPSHOT_IDS; do
                  echo "Sharing snapshot $SNAPSHOT_ID with account $PROD_ACCOUNT_ID"
                  aws ec2 modify-snapshot-attribute --snapshot-id $SNAPSHOT_ID --region $REGION --attribute createVolumePermission --operation-type add --user-ids $PROD_ACCOUNT_ID
                done
              done
            done
          done

      - name: Authenticate with Prod AWS Account
        uses: grafana/shared-workflows/actions/aws-auth@main
        with:
          aws-region: "us-east-2"
          role-arn: "arn:aws:iam::${{ env.PROD_ACCOUNT }}:role/github-actions/packer-role"
          set-creds-in-environment: true

      - name: Copy AMIs to Prod Account
        run: |
          for file in build-manifest-*.json; do
            echo "Processing $file for copying"
            builds_length=$(jq '.builds | length' "$file")
            for ((i=0; i<$builds_length; i++)); do
              artifact_id=$(jq -r ".builds[$i].artifact_id" "$file")
              image_name=$(jq -r ".builds[$i].custom_data.image_name" "$file")
              IFS=',' read -ra AMI_LIST <<< "$artifact_id"
              for AMI_PAIR in "${AMI_LIST[@]}"; do
                REGION=$(echo $AMI_PAIR | cut -d: -f1)
                AMI_ID=$(echo $AMI_PAIR | cut -d: -f2)
                echo "Copying AMI $AMI_ID from region $REGION with name $image_name"
                NEW_AMI_ID=$(aws ec2 copy-image --source-region $REGION --source-image-id $AMI_ID --region $REGION --name "$image_name" --description "Copied from $AMI_ID in $REGION" --query 'ImageId' --output text)
                echo "New AMI ID in prod account: $NEW_AMI_ID"
              done
            done
          done