refactor: refactor gh release action to use a subworkflow to generate foas

.github/scripts/download_specs.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -eou pipefail
+
+aws s3 cp s3://"${S3_BUCKET}"/openapi/foas-metadata.json foas-metadata.json
+< foas-metadata.json jq 
+
+jq -c '.services[]' foas-metadata.json | while read -r service; do
+    name=$(echo "${service}" | jq -c '.name' | tr -d '"')
+    sha=$(echo "${service}" | jq -c '.sha' | tr -d '"')
+
+    echo "Downloading the OpenAPI Spec for ${name} with sha ${sha}"
+    aws s3 cp "s3://${S3_BUCKET}/openapi/oas/${name}/${sha}.json" "openapi-${name}.json"
+done
+

.github/scripts/generate_federated_spec.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -eou pipefail
+
+# Loop through the filtered services and construct the flag
+service_array=()
+while IFS= read -r service; do
+service_array+=("-e" "openapi-${service}.json")
+done < <(jq -r '.services[] | select(.name != "mms") | .name' foas-metadata.json)
+
+echo "Running FOAS CLI merge command with the following services: " "${service_array[@]}"
+foascli merge -b openapi-mms.json "${service_array[@]}" -o openapi-foas.json -f json
+foascli merge -b openapi-mms.json "${service_array[@]}" -o openapi-foas.yaml -f yaml
+

.github/workflows/generate-openapi.yml

@@ -0,0 +1,58 @@
+name: 'Generate the Federated OpenAPI Spec'
+on:
+  workflow_call:
+    inputs:
+      aws_default_region:
+        description: 'AWS Default Region.'
+        required: true
+        type: string
+      aws_s3_bucket:
+        description: 'AWS S3 Bucket.'
+        required: true
+        type: string
+    secrets: # all secrets are passed explicitly in this workflow
+      api_bot_pat:
+        required: true
+      aws_access_key_id:
+        required: true
+      aws_secret_access_key:
+        required: true
+
+
+permissions:
+  contents: write
+  issues: write
+
+jobs:
+  generate-spec:
+    name: Generate the Federated OpenAPI Spec
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          sparse-checkout: |
+            tools
+            .github/scripts
+      - name: Install Go
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32
+        with:
+          go-version-file: 'tools/cli/go.mod'
+          cache-dependency-path: "tools/cli/go.sum"
+      - name: Build CLI
+        working-directory: tools/cli
+        run: make build && echo "$(pwd)/bin" >> "${GITHUB_PATH}"
+      - name: Retrieve Specs
+        env:
+          AWS_DEFAULT_REGION: ${{inputs.aws_default_region}}
+          AWS_ACCESS_KEY_ID: ${{ secrets.aws_access_key_id }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.aws_secret_access_key }}
+          S3_BUCKET: ${{ inputs.aws_s3_bucket }}
+        run: .github/scripts/download_specs.sh
+      - name: Generate Federated Spec
+        run: .github/scripts/generate_federated_spec.sh
+      - name: Upload artifact
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b
+        with:
+          name: openapi-foas
+          path: openapi-foas.*

.github/workflows/optional-spec-validations.yml

@@ -1,15 +1,14 @@
 name: 'Optional Spec Validations'
 on:
   workflow_call:
-    inputs:
-      run-id:
-        description: 'Run ID of the workflow that triggered this workflow'
-        required: true
-        type: string
     secrets: # all secrets are passed explicitly in this workflow
       api_bot_pat:
         required: true
 
+permissions:
+  contents: write
+  issues: write
+
 jobs:  
   optional-validations:
     runs-on: ubuntu-latest
@@ -21,7 +20,7 @@ jobs:
         with:
           name: openapi-foas
           github-token: ${{ secrets.api_bot_pat }}
-          run-id: ${{ inputs.run-id }}
+          run-id: ${{ github.run_id }}
       - name: Validate the FOAS can be used to generate Postman collection
         run: |
           cp -rf "openapi-foas.json" "./tools/postman/openapi/atlas-api.json"
@@ -35,4 +34,4 @@ jobs:
           labels: failed-release
           title: "(PROD) Optional Postman validation failed :scream_cat:"
           body: See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          token: ${{ secrets.api_bot_pat }}
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release-spec-prod.yml

@@ -6,59 +6,19 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  issues: write
+
 jobs:
   generata-spec:
-    name: Generate the Federated OpenAPI Spec
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
-        with:
-          sparse-checkout: |
-            tools
-      - name: Install Go
-        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32
-        with:
-          go-version-file: 'tools/cli/go.mod'
-          cache-dependency-path: "tools/cli/go.sum"
-      - name: Build CLI
-        working-directory: tools/cli
-        run: make build
-      - name: Retrieve Specs
-        working-directory: tools/cli/bin
-        env:
-          AWS_DEFAULT_REGION: ${{vars.AWS_DEFAULT_REGION}}
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID_PROD }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY_PROD }}
-          S3_BUCKET: ${{ vars.S3_BUCKET_PROD }}
-        run: |
-          aws s3 cp s3://"${S3_BUCKET}"/openapi/foas-metadata.json foas-metadata.json
-          < foas-metadata.json jq 
-
-          jq -c '.services[]' foas-metadata.json | while read -r service; do
-            name=$(echo "${service}" | jq -c '.name' | tr -d '"')
-            sha=$(echo "${service}" | jq -c '.sha' | tr -d '"')
-
-            echo "Downloading the OpenAPI Spec for ${name} with sha ${sha}"
-            aws s3 cp "s3://${S3_BUCKET}/openapi/oas/${name}/${sha}.json" "openapi-${name}.json"
-          done
-      - name: Generate Federated Spec
-        working-directory: tools/cli/bin
-        run: |
-          # Loop through the filtered services and construct the flag
-          service_array=()
-          while IFS= read -r service; do
-            service_array+=("-e" "openapi-${service}.json")
-          done < <(jq -r '.services[] | select(.name != "mms") | .name' foas-metadata.json)
-
-          echo "Running FOAS CLI merge command with the following services: " "${service_array[@]}"
-          ./foascli merge -b openapi-mms.json "${service_array[@]}" -o openapi-foas.json -f json
-          ./foascli merge -b openapi-mms.json "${service_array[@]}" -o openapi-foas.yaml -f yaml
-      - name: Upload artifact
-        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b
-        with:
-          name: openapi-foas
-          path: tools/cli/bin/openapi-foas.*
+    name: Generate the OpenAPI Spec
+    uses: ./.github/workflows/generate-openapi.yml
+    secrets:
+      api_bot_pat: ${{ secrets.API_BOT_PAT }}
+      aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID_PROD }}
+      aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY_PROD }}
+    with:
+      aws_default_region: ${{ vars.AWS_DEFAULT_REGION}}
+      aws_s3_bucket: ${{ vars.S3_BUCKET_PROD}}
 
   # Required validations will stop the release if they fail
   run-required-validations:
@@ -69,16 +29,15 @@ jobs:
       api_bot_pat: ${{ secrets.API_BOT_PAT }}
     with:
       spectral_version: ${{ vars.SPECTRAL_VERSION }}
-      run-id: ${{ github.run_id }}
+
   # Optional validations won't stop the release but only open a GH issue if they fail
   run-optional-validations:
     name: Run Optional Validations
     needs: generata-spec
     uses: ./.github/workflows/optional-spec-validations.yml
     secrets:
       api_bot_pat: ${{ secrets.API_BOT_PAT }}
-    with:
-      run-id: ${{ github.run_id }}
+
   release:
       name: Release OpenAPI Spec
       runs-on: ubuntu-latest
@@ -91,24 +50,30 @@ jobs:
           with:
             go-version-file: 'tools/cli/go.mod'
             cache-dependency-path: "tools/cli/go.sum"
+        - name: Download openapi-foas
+          uses: actions/download-artifact@v4
+          with:
+            name: openapi-foas
+            github-token: ${{ secrets.api_bot_pat }}
+            run-id: ${{ github.run_id }}
+        - name: Build CLI
+          working-directory: tools/cli
+          run: make build
         - name: Run foascli split command
           run: |
-            pushd tools/cli
-            make build
-            popd
-            ./tools/cli/bin/foascli split -s ./tools/cli/test/data/openapi-foas-dev.json --env prod -o ./openapi/v2/openapi.json
-            cp -rf "./tools/cli/test/data/openapi-foas-dev.json" "./openapi/v2.json"
+            ./tools/cli/bin/foascli split -s openapi-foas.json --env prod -o ./openapi/v2/openapi.json
+            cp -rf "openapi-foas.json" "./openapi/v2.json"
 
-            ./tools/cli/bin/foascli split -s ./tools/cli/test/data/openapi-foas-dev.yaml --env prod -o ./openapi/v2/openapi.yaml
-            cp -rf "./tools/cli/test/data/openapi-foas-dev.yaml" "./openapi/v2.yaml"
+            ./tools/cli/bin/foascli split -s openapi-foas.yaml --env prod -o ./openapi/v2/openapi.yaml
+            cp -rf "openapi-foas.yaml" "./openapi/v2.yaml"
         - name: Create Issue
           if: ${{ failure() }}
           uses: imjohnbo/issue-bot@572eed14422c4d6ca37e870f97e7da209422f5bd
           with:
             labels: failed-release
             title: "(PROD) Release: `foascli split` command failed :scream_cat:"
             body: See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
-            token: ${{ secrets.api_bot_pat }}
+            token: ${{ secrets.GITHUB_TOKEN }}
 
         - name: Create Pull Request
           uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c
@@ -130,4 +95,4 @@ jobs:
             labels: failed-release
             title: "(PROD) Release: `Create Pull Request` step failed :scream_cat:"
             body: See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
-            token: ${{ secrets.api_bot_pat }}
+            token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/required-spec-validations.yml

@@ -6,14 +6,14 @@ on:
         description: 'Version of Spectral to use'     
         type: string
         required: true
-      run-id:
-        description: 'Run ID of the workflow that triggered this workflow'
-        required: true
-        type: string
     secrets: # all secrets are passed explicitly in this workflow
       api_bot_pat:
         required: true
 
+permissions:
+  contents: write
+  issues: write
+
 jobs:  
   required-validations:
       runs-on: ubuntu-latest
@@ -25,7 +25,7 @@ jobs:
           with:
             name: openapi-foas
             github-token: ${{ secrets.api_bot_pat }}
-            run-id: ${{ inputs.run-id }}
+            run-id: ${{ github.run_id }}
         - name: Run Spectral
           env:
             SPECTRAL_VERSION: ${{ inputs.spectral_version }}
@@ -37,7 +37,7 @@ jobs:
             labels: failed-release
             title: "(PROD) Required Spectal validation failed :scream_cat:"
             body: See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
-            token: ${{ secrets.api_bot_pat }}
+            token: ${{ secrets.GITHUB_TOKEN }}
         - name: Install Go
           uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32
           with:
@@ -54,7 +54,7 @@ jobs:
           with:
             name: openapi-foas
             github-token: ${{ secrets.api_bot_pat }}
-            run-id: ${{ inputs.run-id }}
+            run-id: ${{ github.run_id }}
         - name: Validate the FOAS can be used with the Go SDK
           run: |
             cp -rf "openapi-foas.yaml" "atlas-sdk-go/openapi/atlas-sdk.yaml"
@@ -68,4 +68,4 @@ jobs:
             labels: failed-release
             title: "(PROD) Required GO SDK validation failed :scream_cat:"
             body: See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
-            token: ${{ secrets.api_bot_pat }}
+            token: ${{ secrets.GITHUB_TOKEN }}