vm-demo: record audit events for every human input

apps/vm-demo/kargo/stages.yaml

@@ -61,6 +61,8 @@ spec:
       - task:
           name: vm-converge
         vars:
+        - name: release
+          value: "${{ outputs.render.appVersion }} on ${{ outputs.render.baseTemplate }}"
         - name: platformRef
           value: ${{ outputs.push.commit }}
 ---
@@ -113,6 +115,8 @@ spec:
       - task:
           name: vm-converge
         vars:
+        - name: release
+          value: "${{ outputs.render.appVersion }} on ${{ outputs.render.baseTemplate }}"
         - name: platformRef
           value: ${{ outputs.push.commit }}
 ---
@@ -164,6 +168,8 @@ spec:
       - task:
           name: vm-converge
         vars:
+        - name: release
+          value: "${{ outputs.render.appVersion }} on ${{ outputs.render.baseTemplate }}"
         - name: platformRef
           value: ${{ outputs.push.commit }}
 ---
@@ -238,9 +244,41 @@ spec:
         config:
           repoURL: https://github.com/akuity/sedemo-platform
           prNumber: ${{ outputs['open-pr'].pr.id }}
+      # Audit: who merged the SysOps PR (human input). GitHub's public API
+      # reports merged_by; the PR lives in this public repo.
+      - uses: http
+        as: pr-info
+        if: ${{ outputs.render.changed }}
+        retry:
+          errorThreshold: 3
+        config:
+          url: https://api.github.com/repos/akuity/sedemo-platform/pulls/${{ outputs['open-pr'].pr.id }}
+          headers:
+          - name: Accept
+            value: application/vnd.github+json
+          successExpression: response.status == 200
+          outputs:
+          - name: mergedBy
+            fromExpression: response.body.merged_by.login
+          - name: url
+            fromExpression: response.body.html_url
+      - uses: record-audit-event
+        as: audit-pr-merged
+        if: ${{ outputs.render.changed }}
+        retry:
+          errorThreshold: 3
+        config:
+          type: pr-merged
+          actor: github:${{ outputs['pr-info'].mergedBy }}
+          message: "Rendered config PR #${{ outputs['open-pr'].pr.id }} for ${{ ctx.stage }} merged by ${{ outputs['pr-info'].mergedBy }}"
+          data:
+            pr: ${{ outputs['pr-info'].url }}
+            mergeCommit: ${{ outputs.merged.commit }}
       - task:
           name: vm-converge
         vars:
+        - name: release
+          value: "${{ outputs.render.appVersion }} on ${{ outputs.render.baseTemplate }}"
         - name: platformRef
           value: "${{ outputs.render.changed ? outputs.merged?.commit : outputs.render.commit }}"
 ---
@@ -337,15 +375,72 @@ spec:
           waitForStatus:
             issueKey: ${{ outputs.change.key }}
             expectedStatus: Approved
+      # Audit: who approved the CHANGE issue (human input). The jira step's
+      # changelog names the user who moved it to Approved.
+      - uses: jira
+        as: approval
+        retry:
+          errorThreshold: 3
+        config:
+          credentials:
+            sharedSecretName: jira-access-secret
+          searchIssue:
+            jql: key = ${{ outputs.change.key }}
+            fields:
+            - status
+            expands:
+            - changelog
+      - uses: record-audit-event
+        as: audit-change-approved
+        retry:
+          errorThreshold: 3
+        config:
+          type: change-approved
+          actor: "jira:${{ last(filter(outputs.approval.issue.changelog.histories, any(.items, .field == 'status' && .toString == 'Approved')))?.author?.displayName ?? 'unknown' }}"
+          message: "${{ outputs.change.key }} approved by ${{ last(filter(outputs.approval.issue.changelog.histories, any(.items, .field == 'status' && .toString == 'Approved')))?.author?.displayName ?? 'unknown' }} for ${{ outputs.render.appVersion }} on ${{ outputs.render.baseTemplate }}"
+          data:
+            issue: https://eddiewebb.atlassian.net/browse/${{ outputs.change.key }}
       - uses: git-wait-for-pr
         as: merged
         if: ${{ outputs.render.changed }}
         config:
           repoURL: https://github.com/akuity/sedemo-platform
           prNumber: ${{ outputs['open-pr'].pr.id }}
+      # Audit: who merged the SysOps PR (human input). GitHub's public API
+      # reports merged_by; the PR lives in this public repo.
+      - uses: http
+        as: pr-info
+        if: ${{ outputs.render.changed }}
+        retry:
+          errorThreshold: 3
+        config:
+          url: https://api.github.com/repos/akuity/sedemo-platform/pulls/${{ outputs['open-pr'].pr.id }}
+          headers:
+          - name: Accept
+            value: application/vnd.github+json
+          successExpression: response.status == 200
+          outputs:
+          - name: mergedBy
+            fromExpression: response.body.merged_by.login
+          - name: url
+            fromExpression: response.body.html_url
+      - uses: record-audit-event
+        as: audit-pr-merged
+        if: ${{ outputs.render.changed }}
+        retry:
+          errorThreshold: 3
+        config:
+          type: pr-merged
+          actor: github:${{ outputs['pr-info'].mergedBy }}
+          message: "Rendered config PR #${{ outputs['open-pr'].pr.id }} for ${{ ctx.stage }} merged by ${{ outputs['pr-info'].mergedBy }}"
+          data:
+            pr: ${{ outputs['pr-info'].url }}
+            mergeCommit: ${{ outputs.merged.commit }}
       - task:
           name: vm-converge
         vars:
+        - name: release
+          value: "${{ outputs.render.appVersion }} on ${{ outputs.render.baseTemplate }}"
         - name: platformRef
           value: "${{ outputs.render.changed ? outputs.merged?.commit : outputs.render.commit }}"
       - uses: jira

apps/vm-demo/kargo/tasks.yaml

@@ -83,6 +83,23 @@ spec:
       message: >-
         images/base.json at this base-image Freight has no template (not yet
         baked). Promote a Freight from a baked commit.
+  # Audit: who asked for this promotion (human input #1). Auto-promotions and
+  # auto-rollbacks have no human actor and are recorded as Kargo (automatic).
+  - uses: record-audit-event
+    as: audit-requested
+    retry:
+      errorThreshold: 3
+    config:
+      type: promotion-requested
+      message: >-
+        ${{ (ctx.meta.promotion.actor ?? '') != '' ? ctx.meta.promotion.actor : 'Kargo (automatic)' }}
+        promoted rollouts-app ${{ imageFrom(vars.artifactRepo, warehouse('app')).Tag }}
+        on base ${{ task.outputs.base.template }} to ${{ vars.stage }}
+      data:
+        stage: ${{ vars.stage }}
+        freight: ${{ ctx.targetFreight.name }}
+        appVersion: ${{ imageFrom(vars.artifactRepo, warehouse('app')).Tag }}
+        baseTemplate: ${{ task.outputs.base.template }}
   # Render-time gate: the chart marks its keys `required`, so a missing value
   # (e.g. `namespace` in env/<stage>/values.yaml) fails here, before any VM
   # is touched. color is the tag suffix after the first '-' (50-blue: blue),
@@ -162,6 +179,9 @@ spec:
   - name: stage
     value: ${{ ctx.stage }}
   - name: platformRef
+  # "<app tag> on <base template>", for the deployed audit event.
+  - name: release
+    value: ""
   - name: infraRepo
     value: https://github.com/akuity/sedemo-vm-infra
   steps:
@@ -186,3 +206,15 @@ spec:
       runID: ${{ task.outputs.dispatch.runID }}
       expectedConclusion: success
       pollInterval: 5s
+  # Audit: the outcome that closes this promotion's chain of custody.
+  - uses: record-audit-event
+    as: audit-deployed
+    retry:
+      errorThreshold: 3
+    config:
+      type: deployed
+      message: "${{ vars.release }} deployed to ${{ vars.stage }} and converged"
+      data:
+        stage: ${{ vars.stage }}
+        renderedCommit: ${{ vars.platformRef }}
+        convergeRun: https://github.com/akuity/sedemo-vm-infra/actions/runs/${{ task.outputs.dispatch.runID }}