pre-pull-images.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "Pre-pull Images"

on:
  pull_request:
    branches: ["main"]
    paths:
      - kubernetes/main/apps/**
      - kubernetes/main/flux/**
      - kubernetes/shared/**

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: true

jobs:
  default-images:
    name: Default Images
    runs-on: ubuntu-latest
    outputs:
      images: ${{ steps.extract-images.outputs.images }}
    steps:
      - name: Generate Token
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: "${{ secrets.BOT_APP_ID }}"
          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"

      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: "${{ steps.app-token.outputs.token }}"
          ref: "${{ github.event.repository.default_branch }}"

      - name: Setup Workflow Tools
        uses: jdx/mise-action@v2
        env:
          GITHUB_TOKEN: "${{ steps.app-token.outputs.token }}"
        with:
          mise_toml: |
            [tools]
            python = "latest"
            "aqua:astral-sh/uv" = "latest"
            "aqua:fluxcd/flux2" = "latest"
            "aqua:helm/helm" = "latest"
            "aqua:kubernetes-sigs/kustomize" = "latest"
            "aqua:mikefarah/yq" = "latest"
            "pipx:flux-local" = "latest"

      - name: Gather Images
        shell: bash
        run: |
          flux-local get cluster \
              --path ${{ github.workspace }}/kubernetes/main/flux \
              --enable-images \
              --output yaml \
              --output-file images.yaml

      - name: Filter Images
        shell: bash
        run: |
          yq -r '[.. | .images? | select(. != null)] | flatten | sort | unique | .[]' \
              images.yaml > images.txt

      - name: Extract Images
        id: extract-images
        shell: bash
        run: |
          images=$(jq --compact-output --raw-input --null-input '[inputs]' images.txt)
          echo "images=${images}" >> $GITHUB_OUTPUT

  pull-request-images:
    name: Pull Request Images
    runs-on: ubuntu-latest
    outputs:
      images: ${{ steps.extract-images.outputs.images }}
    steps:
      - name: Generate Token
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: "${{ secrets.BOT_APP_ID }}"
          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"

      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: "${{ steps.app-token.outputs.token }}"

      - name: Setup Workflow Tools
        uses: jdx/mise-action@v2
        env:
          GITHUB_TOKEN: "${{ steps.app-token.outputs.token }}"
        with:
          mise_toml: |
            [tools]
            python = "latest"
            "aqua:astral-sh/uv" = "latest"
            "aqua:fluxcd/flux2" = "latest"
            "aqua:helm/helm" = "latest"
            "aqua:kubernetes-sigs/kustomize" = "latest"
            "aqua:mikefarah/yq" = "latest"
            "pipx:flux-local" = "latest"

      - name: Gather Images
        shell: bash
        run: |
          flux-local get cluster \
              --path ${{ github.workspace }}/kubernetes/main/flux \
              --enable-images \
              --output yaml \
              --output-file images.yaml

      - name: Filter Images
        shell: bash
        run: |
          yq -r '[.. | .images? | select(. != null)] | flatten | sort | unique | .[]' \
              images.yaml > images.txt

      - name: Extract Images
        id: extract-images
        shell: bash
        run: |
          images=$(jq --compact-output --raw-input --null-input '[inputs]' images.txt)
          echo "images=${images}" >> $GITHUB_OUTPUT

  extract-images:
    name: Extract Images
    runs-on: ubuntu-latest
    needs: ["default-images", "pull-request-images"]
    outputs:
      matrix: ${{ steps.extract-images.outputs.images }}
    steps:
      - name: Compare Default and Pull Request Images
        id: extract-images
        shell: bash
        run: |
          images=$(jq --compact-output --null-input \
              --argjson f1 '${{ needs.default-images.outputs.images }}' \
              --argjson f2 '${{ needs.pull-request-images.outputs.images }}' \
              '$f2 - $f1' \
          )
          echo "images=${images}" >> $GITHUB_OUTPUT

  pre-pull-images:
    if: ${{ needs.extract-images.outputs.matrix != '[]' && fromJSON(needs.extract-images.outputs.matrix).length <= 8 }}
    name: Pre-pull Images
    runs-on: ["gha-runner-scale-set"]
    needs: ["extract-images"]
    strategy:
      matrix:
        images: ${{ fromJSON(needs.extract-images.outputs.matrix) }}
      max-parallel: 4
      fail-fast: false
    steps:
      - name: Generate Token
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: "${{ secrets.BOT_APP_ID }}"
          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"

      - name: Setup Workflow Tools
        uses: jdx/mise-action@v2
        env:
          GITHUB_TOKEN: "${{ steps.app-token.outputs.token }}"
        with:
          mise_toml: |
            [tools]
            "aqua:siderolabs/talos" = "latest"

      - name: Pre-pull Image
        run: talosctl -n $NODE_IP image pull ${{ matrix.images }}

  # Summarize matrix https://github.community/t/status-check-for-a-matrix-jobs/127354/7
  pre-pull-images-success:
    if: ${{ always() }}
    needs: ["pre-pull-images"]
    name: Pre-pull Images Successful
    runs-on: ubuntu-latest
    steps:
      - if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
        name: Check matrix status
        run: exit 1