Actions: Add Swagger verification (#106873)

.drone.yml

@@ -1116,83 +1116,6 @@ volumes:
 clone:
   retries: 3
 depends_on: []
-image_pull_secrets:
-- gcr
-- gar
-kind: pipeline
-name: pr-swagger-gen
-node:
-  type: no-parallel
-platform:
-  arch: amd64
-  os: linux
-services: []
-steps:
-- commands:
-  - echo $(/usr/bin/github-app-external-token) > /github-app/token
-  environment:
-    GITHUB_APP_ID:
-      from_secret: github-app-app-id
-    GITHUB_APP_INSTALLATION_ID:
-      from_secret: github-app-installation-id
-    GITHUB_APP_PRIVATE_KEY:
-      from_secret: github-app-private-key
-  failure: ignore
-  image: us-docker.pkg.dev/grafanalabs-global/docker-deployment-tools-prod/github-app-secret-writer:2024-11-05-v11688112090.1-83920c59
-  name: github-app-generate-token
-  volumes:
-  - name: github-app
-    path: /github-app
-- commands:
-  - apk add --update curl jq bash
-  - GITHUB_TOKEN=$(cat /github-app/token)
-  - is_fork=$(curl --retry 5 "https://$${GITHUB_TOKEN}@api.github.com/repos/grafana/grafana/pulls/$DRONE_PULL_REQUEST"
-    | jq .head.repo.fork)
-  - if [ "$is_fork" != false ]; then return 1; fi
-  - git clone "https://x-access-token:$${GITHUB_TOKEN}@github.com/grafana/grafana-enterprise.git"
-    ../grafana-enterprise
-  - cd ../grafana-enterprise
-  - if git checkout ${DRONE_SOURCE_BRANCH}; then echo "checked out ${DRONE_SOURCE_BRANCH}";
-    elif git checkout ${DRONE_TARGET_BRANCH}; then echo "git checkout ${DRONE_TARGET_BRANCH}";
-    else git checkout main; fi
-  - cd ../
-  - ln -s src grafana
-  - cd ./grafana-enterprise
-  - ./build.sh
-  depends_on:
-  - github-app-generate-token
-  failure: ignore
-  image: alpine/git:2.40.1
-  name: clone-enterprise
-  volumes:
-  - name: github-app
-    path: /github-app
-- commands:
-  - apk add --update git make
-  - make swagger-clean && make openapi3-gen
-  - for f in public/api-merged.json public/openapi3.json; do git add $f; done
-  - if [ -z "$(git diff --name-only --cached)" ]; then echo "Everything seems up to
-    date!"; else git diff --cached && echo "Please ensure the branch is up-to-date,
-    then regenerate the specification by running make swagger-clean && make openapi3-gen"
-    && return 1; fi
-  depends_on:
-  - clone-enterprise
-  image: golang:1.24.4-alpine
-  name: swagger-gen
-trigger:
-  event:
-  - pull_request
-type: docker
-volumes:
-- host:
-    path: /var/run/docker.sock
-  name: docker
-- name: github-app
-  temp: {}
----
-clone:
-  retries: 3
-depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
@@ -5166,6 +5089,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: 3aac355a5391ddeb89373f25dbae8003fb89e5c2645a7e8456dbbc5b6be44db1
+hmac: 062d3adb66b70ca115b7a8178c4d1171c394ee73d11790d6a5a3e01e9ea9137c
 
 ...

.github/CODEOWNERS

@@ -842,6 +842,7 @@ embed.go @grafana/grafana-as-code
 /.github/workflows/shellcheck.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/release-build.yml  @grafana/grafana-developer-enablement-squad
 /.github/actions/changelog @zserge
+/.github/workflows/swagger-gen.yml @grafana/grafana-backend-group
 /.github/workflows/pr-frontend-unit-tests.yml @grafana/grafana-frontend-platform
 /.github/workflows/frontend-lint.yml @grafana/grafana-frontend-platform
 /.github/workflows/analytics-events-report.yml @grafana/grafana-frontend-platform

.github/workflows/swagger-gen.yml

@@ -0,0 +1,55 @@
+name: Swagger generated code
+
+on:
+  push:
+    branches:
+      - main
+      - release-*
+  pull_request:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Verify committed API specs match
+    runs-on: ubuntu-latest
+    if: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) || github.repository == 'grafana/grafana' }}
+    permissions:
+      contents: read # clone the repository
+      id-token: write # required for Vault access
+    steps:
+      # Set up repository clone
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Setup Enterprise
+        uses: ./.github/actions/setup-enterprise
+        with:
+          github-app-name: 'grafana-ci-bot'
+
+      - name: Set go version
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Generate Swagger specs
+        run: make swagger-clean && make openapi3-gen
+      - name: Check for changes
+        run: |
+          git add -f public/api-merged.json public/openapi3.json
+          if [ -z "$(git diff --name-only --cached)" ]; then
+            echo "No changes detected in API specs."
+          else
+            echo "Changes detected in API specs. Please review the changes."
+            echo "You can regenerate them locally with: make swagger-clean && make openapi3-gen"
+            exit 1
+          fi

.github/zizmor.yml

@@ -22,6 +22,7 @@ rules:
       - pr-test-integration.yml
       - publish-kinds-release.yml
       - pr-e2e-tests.yml
+      - swagger-gen.yml
   dangerous-triggers:
     ignore:
       - auto-milestone.yml

scripts/drone/events/pr.star

@@ -24,10 +24,6 @@ load(
     "scripts/drone/pipelines/lint_backend.star",
     "lint_backend_pipeline",
 )
-load(
-    "scripts/drone/pipelines/swagger_gen.star",
-    "swagger_gen",
-)
 load(
     "scripts/drone/pipelines/test_backend.star",
     "test_backend",
@@ -132,9 +128,6 @@ def pr_pipelines():
             prefix = ver_mode,
         ),
         docs_pipelines(ver_mode, trigger_docs_pr()),
-        swagger_gen(
-            ver_mode,
-        ),
         integration_benchmarks(
             prefix = ver_mode,
         ),

scripts/drone/pipelines/swagger_gen.star

@@ -1,58 +0,0 @@
-"""
-This module returns all pipelines used in OpenAPI specification generation of Grafana HTTP APIs
-"""
-
-load(
-    "scripts/drone/steps/github.star",
-    "github_app_generate_token_step",
-    "github_app_pipeline_volumes",
-)
-load(
-    "scripts/drone/steps/lib.star",
-    "enterprise_setup_step",
-)
-load(
-    "scripts/drone/utils/images.star",
-    "images",
-)
-load(
-    "scripts/drone/utils/utils.star",
-    "pipeline",
-)
-
-def swagger_gen_step(ver_mode):
-    if ver_mode != "pr":
-        return None
-
-    return {
-        "name": "swagger-gen",
-        "image": images["go"],
-        "commands": [
-            "apk add --update git make",
-            "make swagger-clean && make openapi3-gen",
-            "for f in public/api-merged.json public/openapi3.json; do git add $f; done",
-            'if [ -z "$(git diff --name-only --cached)" ]; then echo "Everything seems up to date!"; else git diff --cached && echo "Please ensure the branch is up-to-date, then regenerate the specification by running make swagger-clean && make openapi3-gen" && return 1; fi',
-        ],
-        "depends_on": [
-            "clone-enterprise",
-        ],
-    }
-
-def swagger_gen(ver_mode, source = "${DRONE_SOURCE_BRANCH}"):
-    test_steps = [
-        github_app_generate_token_step(),
-        enterprise_setup_step(source = source, canFail = True),
-        swagger_gen_step(ver_mode = ver_mode),
-    ]
-
-    p = pipeline(
-        name = "{}-swagger-gen".format(ver_mode),
-        trigger = {
-            "event": ["pull_request"],
-        },
-        services = [],
-        steps = test_steps,
-        volumes = github_app_pipeline_volumes(),
-    )
-
-    return p