Spinnaker Tips: Setting a github status check on a PR from a pipeline

A common situation we hit is creating a pull request on github with some terraform changes that are run through our pipelines. We’d like to verify the terraform changes cleanly “plan” before we apply them. An example is when someone has a typo (how many times I’ve left dangling commas in a JSON object!) and the plan fails due to this. Spinnaker has a solution for this though it’s not well documented. Let’s see how this works!

Setup

First you’ll need to enable echo to send github status notifications. There are a couple of places to enable this notification:

Deck:

 window.spinnakerSettings.notifications.githubStatus.enabled = true;

Echo:

github-status:
  enabled: true
  token: REPLACEME
  endpoint: https://api.github.com

You can instead of setting these two flags directly just add a notifications block to operator/halyard using: https://docs.armory.io/continuous-deployment/installation/armory-operator/op-manifest-reference/notification/

You should also be familiar with github triggers and hooks in spinnaker. See the following documentation around configuring webhooks and triggering pipelines from github webhooks:

• Configuring github to send webhooks: https://spinnaker.io/docs/setup/other_config/triggers/github/
• Configuring github triggers: https://spinnaker.io/docs/guides/user/pipeline/triggers/github/

How to use it

The first challenge with a github status notification is how to know when and where to send the notifications. GitHub status notifications are sent using a SHA to a specific commit. As such we need to know the commit SHA in order to add a status to that commit.

First Go to spinnaker, create a pipeline and add a github trigger. We’ll use the sha from the trigger for sending a status response. You can now also add a notification that posts a status update.

Note the ${execution.trigger.hash} for the sha block. This lets the notification pull the triggered github commit sha to post a status notification back to Github. You can set this notification on the entire pipeline, or on specific stages.

Your pipeline can execute any number of checks or work and report back a status response. Please note that you’ll likely want to send notifications on a limited set of branches so remember to make sure to configure your triggers and notifications as needed!

You can see the results here where the status check will show “pipeline/pipeline name” including the results of the pipeline.

Note that I tested this without a Github trigger but I just passed the SHA directly via a parameter. I used the following spel expression for my test case.

${execution.trigger.type == "git" ? execution.trigger.hash : parameters.github_hash}