action.yml

name: SAFE Network Testnet Workflow Action
description: GitHub action to use the sn-testnet-deploy repository to deploy a testnet
inputs:
  action:
    description: >
      Task to be carried out.
      Accepts 'create', 'destroy', 'resources', 'logs', 'list-inventory', 'print-inventory'.
    required: true
  ansible-vault-password:
    description: Password for Ansible vault.
    required: true
  ansible-verbose:
    description: Set to use verbose output for Ansible
    required: true
    default: false
  aws-access-key-id:
    description: AWS access key ID
  aws-access-key-secret:
    description: AWS access key
  aws-region:
    description: AWS region
    default: eu-west-2
  beta-encryption-key:
    description: Supply an encryption key that will be used with the auditor.
  do-token:
    description: Digital Ocean Authorization token
    required: true
  faucet-version:
    description: Supply a version for the faucet. Otherwise the latest will be used.
  network-contacts-file-name:
    description: Provide a name for the network contacts file
  node-count:
    description: Number of nodes service instances to be started
  public-rpc:
    description: Set to make node manager RPC daemons publicly accessible
    required: true
    default: false
  protocol-version:
    description: The network protocol version can be set to 'restricted' or any custom version string.
  provider:
    description: The cloud provider. Accepts 'aws' or 'digital-ocean'.
    required: true
  re-attempts:
    description: The number of times to re-run testnet-deploy in case of failures.
    default: "0"
  rust-log:
    description: Set RUST_LOG to this value for testnet-deploy
    required: false
  safenode-features:
    description: Comma-separated list of features to be used when building a branch of safenode
  safenode-version:
    description: Supply a version for safenode. Otherwise the latest will be used.
  safenode-manager-version:
    description: Supply a version for safenode-manager. Otherwise the latest will be used.
  safe-network-branch:
    description: >
      Build binaries from the specified safe_network branch. The testnet will use these binaries.
  safe-network-user:
    description: >
      Build binaries from the safe_network repository owned by this org or username. The testnet
      will use these binaries.
  ssh-secret-key:
    description: SSH key used to run the nodes on the Digital Ocean droplets
  subnet-id:
    description: If running on AWS, this is the subnet of the VPC on which the VMs will be created.
  security-group-id:
    description: If running on AWS, this is the ID of the security groups the VMs will use.
  testnet-name:
    description: The name of the testnet.
    required: true
  testnet-deploy-branch:
    description: >
      The branch for the sn-testnet-deploy repository. Enables using forks to test changes for
      testnet-deploy.
    default: main
  testnet-deploy-user:
    description: >
      The user or organisation for the sn-testnet-deploy repository. Enables using forks to test
      changes for testnet-deploy.
    default: maidsafe
  vm-count:
    description: Number of node VMs to be deployed

runs:
  using: composite
  steps:
    #
    # ======   Prerequisites   ======
    #
    - uses: hashicorp/setup-terraform@v1
      with:
        terraform_wrapper: false

    - name: Install tools
      shell: bash
      run: |
        sudo apt-get update -y
        # There is some issue with the latest version of Ansible not correctly
        # reading the Digital Ocean token from environment variables, so just
        # pin to this version for now.
        pip install --user ansible==8.2.0
        pip install --user boto3
        sudo apt-get install jq -y

    - name: Install tools
      if: inputs.action == 'logs'
      shell: bash
      run: |
        sudo apt-get update -y
        sudo apt-get install rsync -y

    - name: Clone the deployer and setup prerequisite files
      shell: bash
      env:
        AWS_ACCESS_KEY_ID: ${{ inputs.aws-access-key-id }}
        AWS_DEFAULT_REGION: ${{ inputs.aws-region }}
        AWS_SECRET_ACCESS_KEY: ${{ inputs.aws-access-key-secret }}
        DO_PAT: ${{ inputs.do-token }}
        NODE_COUNT: ${{ inputs.node-count }}
        PROVIDER: ${{ inputs.provider }}
        RUST_LOG: ${{ inputs.rust-log }}
        SAFE_NETWORK_BRANCH: ${{ inputs.safe-network-branch }}
        SAFE_NETWORK_USER: ${{ inputs.safe-network-user }}
        SN_TESTNET_DEV_SECURITY_GROUP_ID: ${{ inputs.security-group-id }}
        SN_TESTNET_DEV_SUBNET_ID: ${{ inputs.subnet-id }}
        TERRAFORM_STATE_BUCKET_NAME: maidsafe-org-infra-tfstate
        TESTNET_DEPLOY_BRANCH: ${{ inputs.testnet-deploy-branch }}
        TESTNET_DEPLOY_USER: ${{ inputs.testnet-deploy-user }}
        TESTNET_NAME: ${{ inputs.testnet-name }}
        VM_COUNT: ${{ inputs.vm-count }}
      run: |
        set -e

        # This action might be called from inside another repo (after checking
        # out). Thus we should clone the deployer inside home.
        cd ~
        echo "ORIGINAL_DIR=$(pwd)" >> $GITHUB_ENV

        # This step can be be called multiple times during the same workflow. Hence we have to check
        # if the file/folder exists before we can create them.
        if [ ! -d "sn-testnet-deploy" ]; then
          git clone --quiet --single-branch --depth 1 \
            --branch $TESTNET_DEPLOY_BRANCH https://github.com/$TESTNET_DEPLOY_USER/sn-testnet-deploy
        fi

        if [ ! -f ~/.ssh/id_rsa ]; then
          mkdir ~/.ssh
          echo "${{ inputs.ssh-secret-key }}" >> ~/.ssh/id_rsa
          chmod 0400 ~/.ssh/id_rsa
          ssh-keygen -y -f ~/.ssh/id_rsa > ~/.ssh/id_rsa.pub
        fi

        if [ ! -f ~/.ansible/vault-password ]; then
          mkdir ~/.ansible
          echo "${{ inputs.ansible-vault-password }}" >> ~/.ansible/vault-password
        fi

        cd sn-testnet-deploy
        if [ ! -f ".env" ]; then
          echo "ANSIBLE_VAULT_PASSWORD_PATH=/home/runner/.ansible/vault-password" >> .env
          echo "AWS_ACCESS_KEY_ID=${{ env.AWS_ACCESS_KEY_ID }}" >> .env
          echo "AWS_DEFAULT_REGION=${{ env.AWS_DEFAULT_REGION }}" >> .env
          echo "AWS_SECRET_ACCESS_KEY=${{ env.AWS_SECRET_ACCESS_KEY }}" >> .env
          echo "DO_PAT=${{ env.DO_PAT }}" >> .env
          echo "SSH_KEY_PATH=/home/runner/.ssh/id_rsa" >> .env
          echo "SN_TESTNET_DEV_SUBNET_ID=${{ env.SN_TESTNET_DEV_SUBNET_ID }}" >> .env
          echo "SN_TESTNET_DEV_SECURITY_GROUP_ID=${{ env.SN_TESTNET_DEV_SECURITY_GROUP_ID }}" >> .env
          echo "TERRAFORM_STATE_BUCKET_NAME=${{ env.TERRAFORM_STATE_BUCKET_NAME }}" >> .env
        fi
    #
    # ======   Create Testnet   ======
    #
    - name: Create testnet
      if: inputs.action == 'create'
      env:
        ANSIBLE_VERBOSE: ${{ inputs.ansible-verbose }}
        AWS_DEFAULT_REGION: ${{ inputs.aws-region }}
        BETA_ENCRYPTION_KEY: ${{ inputs.beta-encryption-key }}
        FAUCET_VERSION: ${{ inputs.faucet-version }}
        NETWORK_CONTACTS_FILE_NAME: ${{ inputs.network-contacts-file-name }}
        NODE_COUNT: ${{ inputs.node-count }}
        PROTOCOL_VERSION: ${{ inputs.protocol-version }}
        PROVIDER: ${{ inputs.provider }}
        PUBLIC_RPC: ${{ inputs.public-rpc }}
        RETRY_ATTEMPTS: ${{ inputs.re-attempts }}
        RUST_LOG: ${{ inputs.rust-log }}
        SAFENODE_FEATURES: ${{ inputs.safenode-features }}
        SAFENODE_VERSION: ${{ inputs.safenode-version }}
        SAFENODE_MANAGER_VERSION: ${{ inputs.safenode-manager-version }}
        SAFE_NETWORK_BRANCH: ${{ inputs.safe-network-branch }}
        SAFE_NETWORK_USER: ${{ inputs.safe-network-user }}
        TESTNET_NAME: ${{ inputs.testnet-name }}
        VM_COUNT: ${{ inputs.vm-count }}
      shell: bash
      run: |
        set -e

        cd ~/sn-testnet-deploy

        command="cargo run -- deploy \
          --name $TESTNET_NAME \
          --provider $PROVIDER \
          --node-count $NODE_COUNT \
          --vm-count $VM_COUNT "
        [[ $ANSIBLE_VERBOSE == "true" ]] && command="$command --ansible-verbose "
        [[ -n $BETA_ENCRYPTION_KEY ]] && command="$command --beta-encryption-key $BETA_ENCRYPTION_KEY "
        [[ -n $FAUCET_VERSION ]] && command="$command --faucet-version $FAUCET_VERSION "
        [[ -n $NETWORK_CONTACTS_FILE_NAME ]] && command="$command --network-contacts-file-name $NETWORK_CONTACTS_FILE_NAME "
        [[ -n $PROTOCOL_VERSION ]] && command="$command --protocol-version $PROTOCOL_VERSION "
        [[ $PUBLIC_RPC == "true" ]] && command="$command --public-rpc "
        [[ -n $SAFENODE_FEATURES ]] && command="$command --safenode-features $SAFENODE_FEATURES "
        [[ -n $SAFENODE_VERSION ]] && command="$command --safenode-version $SAFENODE_VERSION "
        [[ -n $SAFENODE_MANAGER_VERSION ]] && command="$command --safenode-manager-version $SAFENODE_MANAGER_VERSION "
        [[ -n $SAFE_NETWORK_BRANCH ]] && command="$command --branch $SAFE_NETWORK_BRANCH "
        [[ -n $SAFE_NETWORK_USER ]] && command="$command --repo-owner $SAFE_NETWORK_USER "

        max_attempts=$((RETRY_ATTEMPTS + 1)) # +1 as default retry_attempts is 0
        for i in $(seq 1 $max_attempts); do
          echo "Attempt $i of $max_attempts"
          
          set +e # Temporarily turn off 'exit on error'
          echo "Will run testnet-deploy with: $command"
          eval $command
          result=$?
          set -e # Re-enable 'exit on error'

          if [[ $result -eq 0 ]]; then
            echo "Testnet tool completed successfully."
            break
          else
            echo "Attempt $i of testnet tool failed. Retrying..."
          fi
        done

        if [[ $result -ne 0 ]]; then
          echo "Testnet creation failed"
          exit 1
        fi

    - name: Upload the inventory file
      if: inputs.action == 'create'
      uses: actions/upload-artifact@main
      with:
        name: wan_testnet_deployment_inventory_${{ inputs.testnet-name }}
        path: ~/.local/share/safe/testnet-deploy

    - name: Set SAFE_PEERS and SN_INVENTORY (Linux)
      if: inputs.action == 'create'
      shell: bash
      run: |
        inventory_path=/home/runner/.local/share/safe/testnet-deploy/"${{ inputs.testnet-name }}"-inventory.json
        echo "Inventory Path: $inventory_path"
        genesis_multiaddr=$(jq -r '.genesis_multiaddr' $inventory_path)
        echo "SAFE_PEERS=$genesis_multiaddr" >> $GITHUB_ENV
        echo "SN_INVENTORY=$inventory_path" >> $GITHUB_ENV

    #
    # ======   Destroy Testnet   ======
    #
    - name: Destroy testnet
      if: inputs.action == 'destroy'
      env:
        AWS_DEFAULT_REGION: ${{ inputs.aws-region }}
        PROVIDER: ${{ inputs.provider }}
        RETRY_ATTEMPTS: ${{ inputs.re-attempts }}
        RUST_LOG: ${{ inputs.rust-log }}
        TESTNET_NAME: ${{ inputs.testnet-name }}
      shell: bash
      run: |
        set -e
        cd ~/sn-testnet-deploy

        max_attempts=$((RETRY_ATTEMPTS + 1))
        for i in $(seq 1 $max_attempts); do
          echo "Attempt $i of $max_attempts"
          
          set +e # Temporarily turn off 'exit on error'
          cargo run -- clean --name "$TESTNET_NAME" --provider "$PROVIDER"
          result=$?
          set -e # Re-enable 'exit on error'

          if [[ $result -eq 0 ]]; then
            echo "Testnet tool completed successfully."
            break
          else
            echo "Attempt $i of testnet tool failed. Retrying..."
          fi
        done

        if [[ $result -ne 0 ]]; then
          echo "Destroying the testnet failed"
          exit 1
        fi
    #
    # ======   Get resources   ======
    #
    - name: Get resources
      if: inputs.action == 'resources'
      env:
        PROVIDER: ${{ inputs.provider }}
        RUST_LOG: ${{ inputs.rust-log }}
        TESTNET_NAME: ${{ inputs.testnet-name }}
      shell: bash
      run: |
        set -e
        cd ~/sn-testnet-deploy

        max_attempts=$((RETRY_ATTEMPTS + 1))
        for i in $(seq 1 $max_attempts); do
          echo "Attempt $i of $max_attempts"
          
          set +e # Temporarily turn off 'exit on error'
          cargo run -- logs rsync --name "$TESTNET_NAME" --provider "$PROVIDER" --resources-only
          result=$?
          set -e # Re-enable 'exit on error'

          if [[ $result -eq 0 ]]; then
            echo "Testnet tool completed successfully."
            break
          else
            echo "Attempt $i of testnet tool failed. Retrying..."
          fi
        done

        if [[ $result -ne 0 ]]; then
          echo "Get resources failed"
          exit 1
        fi
      
    - name: Upload the resources
      if: inputs.action == 'resources'
      uses: actions/upload-artifact@main
      with:
        name: wan_testnet_resources_${{ inputs.testnet-name }}
        path: ~/sn-testnet-deploy/logs/${{ inputs.testnet-name }}
    #
    # ======   Rsync logs   ======
    #
    - name: Rsync logs
      if: inputs.action == 'logs'
      env:
        PROVIDER: ${{ inputs.provider }}
        RETRY_ATTEMPTS: ${{ inputs.re-attempts }}
        RUST_LOG: ${{ inputs.rust-log }}
        TESTNET_NAME: ${{ inputs.testnet-name }}
      shell: bash
      run: |
        set -e
        cd ~/sn-testnet-deploy

        max_attempts=$((RETRY_ATTEMPTS + 1))
        for i in $(seq 1 $max_attempts); do
          echo "Attempt $i of $max_attempts"
          
          set +e # Temporarily turn off 'exit on error'
          cargo run -- logs rsync --name "$TESTNET_NAME" --provider "$PROVIDER"
          result=$?
          set -e # Re-enable 'exit on error'

          if [[ $result -eq 0 ]]; then
            echo "Testnet tool completed successfully."
            break
          else
            echo "Attempt $i of testnet tool failed. Retrying..."
          fi
        done

        if [[ $result -ne 0 ]]; then
          echo "All attempts to run testnet tool failed!!"
          exit 1
        fi

    - name: Upload the logs
      if: inputs.action == 'logs'
      uses: actions/upload-artifact@main
      with:
        name: wan_testnet_logs_${{ inputs.testnet-name }}
        path: ~/sn-testnet-deploy/logs/${{ inputs.testnet-name }}

    #
    # ======   Fetch inventory   ======
    #
    - name: Fetch inventory
      if: inputs.action == 'list-inventory'
      env:
        PROVIDER: ${{ inputs.provider }}
        RETRY_ATTEMPTS: ${{ inputs.re-attempts }}
        RUST_LOG: ${{ inputs.rust-log }}
        TESTNET_NAME: ${{ inputs.testnet-name }}
      shell: bash
      run: |
        set -e
        cd ~/sn-testnet-deploy

        max_attempts=$((RETRY_ATTEMPTS + 1))
        for i in $(seq 1 $max_attempts); do
          echo "Attempt $i of $max_attempts"
          
          set +e # Temporarily turn off 'exit on error'
          cargo run -- inventory --name "$TESTNET_NAME" --provider "$PROVIDER"
          result=$?
          set -e # Re-enable 'exit on error'

          if [[ $result -eq 0 ]]; then
            echo "Testnet tool completed successfully."
            break
          else
            echo "Attempt $i of testnet tool failed. Retrying..."
          fi
        done

        if [[ $result -ne 0 ]]; then
          echo "All attempts to run testnet tool failed!!"
          exit 1
        fi

    - name: Upload the inventory file
      if: inputs.action == 'inventory'
      uses: actions/upload-artifact@main
      with:
        name: wan_testnet_deployment_inventory_${{ inputs.testnet-name }}
        path: ~/.local/share/safe/testnet-deploy

    # We don't want the action to change dirs on its own
    - name: Change PWD back to the original DIR
      shell: bash
      run: |
        cd "$ORIGINAL_DIR"
    #
    # ======   Print inventory   ======
    #
    - name: Print inventory
      if: inputs.action == 'print-inventory'
      env:
        PROVIDER: ${{ inputs.provider }}
        NETWORK_CONTACTS_FILE_NAME: ${{ inputs.network-contacts-file-name }}
        TESTNET_NAME: ${{ inputs.testnet-name }}
      shell: bash
      run: |
        cd ~/sn-testnet-deploy

        command="cargo run -- inventory --name $TESTNET_NAME --force-regeneration"
        [[ -n $NETWORK_CONTACTS_FILE_NAME ]] && command="$command --network-contacts-file-name $NETWORK_CONTACTS_FILE_NAME"
        eval $command

branding:
  icon: "globe"
  color: "blue"