kst-pull.yml

name: Kandji Sync Toolkit Pull
on:
  workflow_call:
    inputs:
      debug:
        description: "Enable debug log to console"
        required: false
        default: false
        type: boolean
      force:
        description: "Force pull to overwrite changes in GitHub repository"
        required: false
        default: false
        type: boolean
      clean:
        description: "Delete profiles and scripts if missing from Kandji"
        required: false
        default: true
        type: boolean
    secrets:
      kst_tenant:
        description: "Your Kandji tenant's API URL"
        required: true
      kst_token:
        description: "Your Kandji tenant's API token"
        required: true
      slack_webhook_url:
        description: "Slack webhook URL for sending notifications"
        required: false
jobs:
  pull-from-kandji:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    env:
      KST_TENANT: ${{ secrets.kst_tenant }}
      KST_TOKEN: ${{ secrets.kst_token }}
      KST_REPORT: "/home/runner/.local/state/kst/log/kst_report.json"
    steps:
      - name: Clone Repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Install uv
        uses: astral-sh/setup-uv@v5
        with:
          version: "0.7.2"
          enable-cache: true

      - name: Install kst
        run: uv tool install --python 3.13 kst

      - name: Display kst Version
        run: kst --version

      - name: Configure kst options
        run: |
          if [[ "${{ inputs.debug }}" == "true" ]]; then
            echo "Debug logging enabled"
            echo debug_opts="--debug --log -" >> $GITHUB_ENV
          fi

          declare -a includes=(
            "--include" "conflict"
            "--include" "new_remote"
            "--include" "updated_remote"
          )
          declare -a options=()

          if [[ "${{ inputs.force }}" == "true" ]]; then
            echo "Force pull enabled, local updates will be overwritten"
            options+=("--force")
            includes+=("--include" "updated_local")
          fi

          if [[ "${{ inputs.clean }}" == "true" ]]; then
            echo "Clean option enabled, local profiles and scripts will be deleted if missing from Kandji"
            options+=("--clean")
            includes+=("--include" "new_local")
          fi

          echo "includes=${includes[*]}" >> $GITHUB_ENV
          echo "options=${options[*]}" >> $GITHUB_ENV

      - name: Configure github-actions[bot] user
        run : |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Ensure .kst marker file
        run: |
          if [ ! -f ".kst" ]; then
            echo "Creating .kst marker file"
            touch .kst
            git add .kst
            git commit -m "Add .kst marker file"
          fi

      - name: Show Pending Profile Changes
        run: kst ${debug_opts} profile list ${includes[*]}

      - name: Pull Profiles from Kandji
        run: kst ${debug_opts} profile pull --all ${options[*]}

      - name: Check Profiles Report
        id: profiles-report
        run: |
          echo "summary=$(jq '.[0].summary' $KST_REPORT)" >> $GITHUB_OUTPUT

          # Set the message and color based on the status
          case "$(jq -r '.[0].status' $KST_REPORT)" in
            "success")
              message="Custom profiles were updated in your repository."
              color="#36a64f"
              ;;
            "warning")
              message="Warnings occurred while updating profiles in your repository."
              color="#f2c717"
              ;;
            "failed")
              message="Errors occurred while updating profiles in your repository."
              color="#ed1f1f"
              ;;
            *)
              message="An unknown status occrued while updating profiles in your repository: $status"
              color="#f2c717"
              ;;
          esac
          echo "message=${message}" >> $GITHUB_OUTPUT
          echo "color=${color}" >> $GITHUB_OUTPUT

      - name: Show Pending Script Changes
        run: kst ${debug_opts} script list ${includes[*]}

      - name: Pull Scripts from Kandji
        run: kst ${debug_opts} script pull --all ${options[*]}

      - name: Check Scripts Report
        id: scripts-report
        run: |
          echo "summary=$(jq '.[0].summary' $KST_REPORT)" >> $GITHUB_OUTPUT

          # Set the message and color based on the status
          case "$(jq -r '.[0].status' $KST_REPORT)" in
            "success")
              message="Custom scripts were updated in your repository."
              color="#36a64f"
              ;;
            "warning")
              message="Warnings occurred while updating scripts in your repository."
              color="#f2c717"
              ;;
            "failed")
              message="Errors occurred while updating scripts in your repository."
              color="#ed1f1f"
              ;;
            *)
              message="An unknown status occrued while updating scripts in your repository: $status"
              color="#f2c717"
              ;;
          esac
          echo "message=${message}" >> $GITHUB_OUTPUT
          echo "color=${color}" >> $GITHUB_OUTPUT

      - name: Write Changes to the GitHub Repository
        run: git push

      - name: Send Profiles Result Slack Notification
        if: ${{ steps.profiles-report.outputs.summary != '""' }}
        uses: slackapi/slack-github-action@v2.0.0
        with:
          webhook: ${{ secrets.slack_webhook_url }}
          webhook-type: incoming-webhook
          payload: |
            {
              "attachments": [
                {
                  "color": "${{ steps.profiles-report.outputs.color }}",
                  "blocks": [
                    {
                      "type": "header",
                      "text": {
                        "type": "plain_text",
                        "text": "${{ steps.profiles-report.outputs.message }}"
                      }
                    },
                    {
                      "type": "section",
                      "text": {
                        "type": "plain_text",
                        "text": ${{ steps.profiles-report.outputs.summary }}
                      }
                    },
                    {
                      "type": "context",
                      "elements": [
                        {
                          "type": "mrkdwn",
                          "text": "<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|GitHub Action Log>"
                        }
                      ]
                    }
                  ]
                }
              ]
            }

      - name: Send Scripts Result Slack Notification
        if: ${{ steps.scripts-report.outputs.summary != '""' }}
        uses: slackapi/slack-github-action@v2.0.0
        with:
          webhook: ${{ secrets.slack_webhook_url }}
          webhook-type: incoming-webhook
          payload: |
            {
              "attachments": [
                {
                  "color": "${{ steps.scripts-report.outputs.color }}",
                  "blocks": [
                    {
                      "type": "header",
                      "text": {
                        "type": "plain_text",
                        "text": "${{ steps.scripts-report.outputs.message }}"
                      }
                    },
                    {
                      "type": "section",
                      "text": {
                        "type": "plain_text",
                        "text": ${{ steps.scripts-report.outputs.summary }}
                      }
                    },
                    {
                      "type": "context",
                      "elements": [
                        {
                          "type": "mrkdwn",
                          "text": "<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|GitHub Action Log>"
                        }
                      ]
                    }
                  ]
                }
              ]
            }

      - name: Send Slack Notification on Job Failure
        if: ${{ failure() }}
        uses: slackapi/slack-github-action@v2.0.0
        with:
          webhook: ${{ secrets.slack_webhook_url }}
          webhook-type: incoming-webhook
          payload: |
            {
              "attachments": [
                {
                  "color": "#ed1f1f",
                  "blocks": [
                    {
                      "type": "header",
                      "text": {
                        "type": "plain_text",
                        "text": "Kandji Sync Toolkit Pull Workflow Error"
                      }
                    },
                    {
                      "type": "section",
                      "text": {
                        "type": "plain_text",
                        "text": "Steps failed while executing the workflow. Please check the link for more details."
                      }
                    },
                    {
                      "type": "context",
                      "elements": [
                        {
                          "type": "mrkdwn",
                          "text": "<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|GitHub Action Log>"
                        }
                      ]
                    }
                  ]
                }
              ]
            }