ci: add check for deploy label [skip ci] (#15513)

* ci: add check for deploy label [skip ci]

* ci: trigger the destroy workflow when deploy label is removed

* ci: wait-on-check action fork with a fix for checking multiple runs

Using the HEAD branch ref when checking for the api-tests workflow
can lead to checking the status of multiple runs and failing,
because we only want successfull ones.

* ci: use status endpoint to ensure instance is running

* ci: delete instance URL comment when destroying

* ci: use extra job for checking if label was removed

.github/workflows/deploy-instance.yml

@@ -14,15 +14,27 @@ jobs:
     if: contains(github.event.pull_request.labels.*.name, 'deploy')
     runs-on: ubuntu-latest
     env:
+      HTTP: https --check-status
+      USER_EMAIL: ${{ secrets.IM_BOT_EMAIL }}
+      PASSWORD: ${{ secrets.IM_BOT_PASSWORD }}
+      IM_HOST: 'https://api.im.dhis2.org'
       INSTANCE_HOST: 'https://dev.im.dhis2.org'
       INSTANCE_NAME: pr-${{ github.event.pull_request.number }}
     steps:
+      - name: Dump context
+        uses: crazy-max/ghaction-dump-context@v2
+
       - name: Wait for API tests
-        uses: lewagon/[email protected]
+        # Using this fork of the upstream https://github.com/lewagon/wait-on-check-action,
+        # as it will filter out and check only the latest run of a workflow when checking for the allowed conclusions,
+        # instead of checking all of the re-runs and possibly failing due to skipped or cancelled runs.
+        # See https://github.com/lewagon/wait-on-check-action/issues/85 for more info.
+        uses: t3chguy/wait-on-check-action@master
         with:
           ref: ${{ github.head_ref }}
           check-name: 'api-test'
           repo-token: ${{ secrets.GITHUB_TOKEN }}
+          allowed-conclusions: success
 
       - uses: actions/checkout@v4
         with:
@@ -35,20 +47,19 @@ jobs:
       - name: Deploy DHIS2 instance
         working-directory: scripts/instances
         env:
-          HTTP: https --check-status
-          USER_EMAIL: ${{ secrets.IM_BOT_EMAIL }}
-          PASSWORD: ${{ secrets.IM_BOT_PASSWORD }}
-          IM_HOST: 'https://api.im.dhis2.org'
           IMAGE_REPOSITORY: core-pr
           IMAGE_TAG: ${{ github.event.pull_request.number }}
           IMAGE_PULL_POLICY: Always
-          DATABASE_ID: sl-sierra-leone-dev-sql-gz
+          DATABASE_ID: test-dbs-sierra-leone-dev-sql-gz
         run: ./findByName.sh dev $INSTANCE_NAME && ./restart.sh dev $INSTANCE_NAME || ./deploy-dhis2.sh dev $INSTANCE_NAME
 
       - name: Wait for instance
-        run: timeout 300 bash -c 'while [[ "$(curl -fsSL -o /dev/null -w %{http_code} $INSTANCE_HOST/$INSTANCE_NAME)" != "200" ]]; do sleep 5; done'
+        working-directory: scripts/instances
+        env:
+          EXPECTED_STATUS: Running
+        run: timeout 600 bash -ex -c 'until [[ "$(./status.sh dev $INSTANCE_NAME | jq -r)" == "$EXPECTED_STATUS" ]]; do echo "Instance is not $EXPECTED_STATUS yet ..."; sleep 5; done'
 
-      - name: Generate analytics
+      - name: Start analytics generation
         run: curl -X POST -u "${{ secrets.DHIS2_USERNAME }}:${{ secrets.DHIS2_PASSWORD }}" "$INSTANCE_HOST/$INSTANCE_NAME/api/resourceTables/analytics" -d 'executeTei=true'
 
       - name: Comment instance URL

.github/workflows/destroy-instance.yml

@@ -2,15 +2,36 @@ name: Destroy instance
 
 on:
   pull_request:
-    types: [closed]
+    types: [closed, unlabeled]
 
 # Cancel previous runs of the same workflow and PR number or branch/tag
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
+  check-deploy-label:
+    runs-on: ubuntu-latest
+    outputs:
+      removed: ${{ steps.check.outputs.removed }}
+    steps:
+      - name: Check if "deploy" was removed
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          last_removed_label=$(
+            gh api "repos/$GITHUB_REPOSITORY/issues/${{ github.event.pull_request.number }}/events" \
+            --jq 'map(select(.event == "unlabeled"))[-1].label.name'
+          )
+
+          if [[ "$last_removed_label" == 'deploy' ]]; then
+              echo "removed=true" >> "$GITHUB_OUTPUT"
+          fi
+
   destroy-instance:
+    needs: check-deploy-label
+    if: (github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'deploy')) || needs.check-deploy-label.outputs.removed
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -30,3 +51,9 @@ jobs:
           IM_HOST: 'https://api.im.dhis2.org'
           INSTANCE_NAME: pr-${{ github.event.number }}
         run: ./findByName.sh dev $INSTANCE_NAME && ./destroy.sh dev $INSTANCE_NAME
+
+      - name: Delete instance URL comment
+        uses: actions-cool/maintain-one-comment@v3
+        with:
+          body: "Instance deployed to https://dev.im.dhis2.org/pr-${{ github.event.pull_request.number }}"
+          delete: true