Test/check token (#9)

* test: add check token job

* fix: modify the actual secret jwt name

* fix: format the check token

* fix: checkout sh file

* test: change to workflow_call

* fix: format to use workflow_call

* fix: use different variable name for broker

* fix: convert input to env in workflow_call

* fix: only pass secrets in workflow_call

* fix: secrets inherit

* fix: add secrets in workflow_call

* fix: use secrets in workflow_call

* fix: no type for secrets

* fix: use inputs and secrets directly in workflow_call

* feat: use composer to generate pipelines

* fix: remove sh script

.github/workflows/build-release.yaml

@@ -20,9 +20,14 @@ env:
   SERVICE_NAME: java-maven-pipeline-example
 
 jobs:
+  check_token_expiration:
+    uses: ./.github/workflows/check-token.yaml
+    secrets:
+      token: ${{ secrets.broker_jwt_0e727e83_f027_426a_a31c_d7c1cceaddf6 }}
   build-release:
     name: Build and release
     runs-on: ubuntu-latest
+    needs: check_token_expiration
     permissions:
       contents: read
       packages: write

.github/workflows/check-token.yaml

@@ -0,0 +1,37 @@
+name: Check token expiration
+
+on:
+  workflow_call:
+    inputs:
+      url:
+        description: "The Broker URL"
+        default: https://broker.io.nrs.gov.bc.ca
+        type: string
+    secrets:
+      token:
+        description: "The Broker token"
+        required: true
+
+jobs:
+  check-jwt:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check token expiration
+        shell: bash
+        run: |
+          RESPONSE_CODE=$(curl -o /dev/null -s -w "%{http_code}" -X 'GET' \
+            ${{ inputs.url }}/v1/health/token-check \
+            -H 'accept: */*' \
+            -H 'Authorization: Bearer '"${{ secrets.token }}"'' \
+            )
+
+          if [ "$RESPONSE_CODE" -eq 401 ]; then
+            echo "Unauthorized (401)"
+            exit 1
+          elif [ "$RESPONSE_CODE" -eq 403 ]; then
+            echo "Invalid JWT: Block list has match"
+            exit 1
+          else
+            echo "Response code: $RESPONSE_CODE"
+          fi

.github/workflows/deploy.yaml

@@ -20,10 +20,15 @@ env:
   PACKAGE_REPO: https://maven.pkg.github.com/bcgov/java-maven-pipeline-example
 
 jobs:
+  check_token_expiration:
+    uses: ./.github/workflows/check-token.yaml
+    secrets:
+      token: ${{ secrets.broker_jwt_0e727e83_f027_426a_a31c_d7c1cceaddf6 }}
   deploy-build:
     name: Deploy development version
     if: ${{ ! startsWith(github.ref, 'refs/tags/') }}
     runs-on: ubuntu-latest
+    needs: check_token_expiration
     outputs:
       project_version: ${{ steps.set-build-output.outputs.project_version }}
       build_guid: ${{ steps.set-build-output.outputs.build_guid }}
@@ -94,6 +99,7 @@ jobs:
     name: Deploy release version
     if: ${{ startsWith(github.ref, 'refs/tags/') }}
     runs-on: ubuntu-latest
+    needs: check_token_expiration
     outputs:
       project_version: ${{ steps.set-tag-output.outputs.project_version }}
       build_guid: ${{ steps.set-tag-output.outputs.build_guid }}