From 48d4587f2b0ec0dccd42f337b1ec945829fe8caf Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Thu, 26 Aug 2021 14:31:08 -0700
Subject: [PATCH] Adding tag canary to gert workflow_run working correctly.

---
 .github/workflows/release-checks.yml     | 43 ++++++++++++++++++++----
 .github/workflows/validate-and-build.yml | 11 +++++-
 2 files changed, 46 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release-checks.yml b/.github/workflows/release-checks.yml
index 00a40668ce..1bc473cbbe 100644
--- a/.github/workflows/release-checks.yml
+++ b/.github/workflows/release-checks.yml
@@ -4,13 +4,46 @@ on:
     workflows: ["validate-and-build"]
     types: [completed]
       
-    
+
 
 jobs:
+
+  #Check that the validate-and-build workflow succeeded
+  check-validate-and-build-success:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Failure
+        run: | 
+          if ${{ github.event.workflow_run.conclusion == 'success' }} ; then
+            echo "SUCCESS: validate-and-build.yml ran successfully. Continue"
+            exit 0
+          else
+            echo "FAIL: validate-and-build.yml DID NOT run successfully. Terminating..."
+            exit 1
+          fi  
+
+
+  #Enusre that we are running on a tag.  There is no good way to see if this was
+  #triggered from a tag/release, so we use the creation of an aritifact in the
+  #validate-and-build workflow to represent it
+  verify-tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Restore Content-Pack Artifacts for AppInspect testing
+        uses: dawidd6/action-download-artifact@v2
+        with:
+          workflow: validate-and-build.yml
+          workflow_conclusion: success
+          name: tag-canary
+          path: .
+        run: |
+          #If this file does not exist, then cat will return a nonzero status (failure)
+          #and the entire workflow will fail
+          cat tag-canary.txt
+
   run-appinspect:
     runs-on: ubuntu-latest
     #Only run when tagged
-    if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }}
     steps:
 
       - name: Checkout Repo
@@ -80,7 +113,6 @@ jobs:
     runs-on: ubuntu-latest
     needs: [run-appinspect]
     #Only run when tagged
-    if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }}
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v2
@@ -127,7 +159,6 @@ jobs:
     runs-on: ubuntu-latest
     needs: [run-appinspect, create-report]
     #Only run when tagged
-    if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }}
     steps: 
 
       - name: Checkout Repo
@@ -222,7 +253,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [run-appinspect, create-report, update-sources-github]
     #Only run when tagged
-    if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }}
+
     steps:
 
       #Get the artifacts that we need
@@ -271,7 +302,6 @@ jobs:
     runs-on: ubuntu-latest
     needs: [run-appinspect, create-report, update-sources-github, publish-github-release]
     #Only run when tagged
-    if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }}
     steps:  
       
       - uses: dawidd6/action-download-artifact@v2
@@ -299,7 +329,6 @@ jobs:
     runs-on: ubuntu-latest
     needs: [run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update]
     #Only run when tagged
-    if: ${{ startsWith(github.ref, 'refs/tags/v') && github.event.workflow_run.conclusion == 'success' }}
     steps:  
       - name: Checkout Repo
         uses: actions/checkout@v2
diff --git a/.github/workflows/validate-and-build.yml b/.github/workflows/validate-and-build.yml
index 54767b940c..e131ca8203 100644
--- a/.github/workflows/validate-and-build.yml
+++ b/.github/workflows/validate-and-build.yml
@@ -250,6 +250,7 @@ jobs:
           cp upload/DA-ESS_AmazonWebServices_Content-*tar.gz DA-ESS_AmazonWebServices_Content-latest.tar.gz
           sha256sum DA-ESS_AmazonWebServices_Content-latest.tar.gz >> checksum.txt
 
+          touch tag-canary.txt
       - name: store_artifacts
         uses: actions/upload-artifact@v2
         with:
@@ -263,4 +264,12 @@ jobs:
           path: |
             build/DA-ESS-ContentUpdate-latest.tar.gz
             build/DA-ESS_AmazonWebServices_Content-latest.tar.gz
-            build/checksum.txt
\ No newline at end of file
+            build/checksum.txt
+      
+      #Store the tag to indicate that this was a tagged build
+      - name: store_artifacts
+        uses: actions/upload-artifact@v2
+        with:
+          name: tag-canary
+          path: |
+            tag-canary.txt
\ No newline at end of file