deploy.yml

name: Deploy Detections to Splunk

on:
  push:
    branches: [main]
    paths:
      - "detections/**/*.yml"
  workflow_dispatch:
    inputs:
      deploy_all:
        description: "Deploy all detection files instead of only files changed in the latest push"
        required: false
        type: boolean
        default: false
      deploy_status:
        description: "Deployment status override used to enable or disable saved searches"
        required: false
        type: choice
        default: production
        options:
          - draft
          - testing
          - production
          - deprecated

permissions:
  contents: read
  pull-requests: read

concurrency:
  group: splunk-deploy-main
  cancel-in-progress: false

jobs:
  deploy:
    name: Deploy to Splunk
    # Runs on the self-hosted Ubuntu runner (Orbstack) — needs local Splunk access
    runs-on: [self-hosted, linux, dac]
    env:
      DEPLOY_STATUS: ${{ github.event_name == 'workflow_dispatch' && inputs.deploy_status || 'production' }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Verify deployment source
        if: github.event_name == 'push'
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          merged_pr_count=$(curl -fsSL \
            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
            -H "Accept: application/vnd.github+json" \
            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls" \
            | jq '[.[] | select(.base.ref == "main" and .state == "closed" and .merged_at != null)] | length')

          if [ "$merged_pr_count" -eq 0 ]; then
            echo "::error::Deployments from main require a commit associated with a merged PR into main."
            exit 1
          fi

      - name: Install dependencies
        run: pip3 install --break-system-packages -r requirements.txt

      - name: Show deployment status
        run: echo "DEPLOY_STATUS=${DEPLOY_STATUS}"

      - name: Identify changed detection files
        id: changed
        shell: bash
        env:
          BEFORE_SHA: ${{ github.event.before }}
          DEPLOY_ALL: ${{ inputs.deploy_all || false }}
        run: |
          if [ "$DEPLOY_ALL" = "true" ]; then
            CHANGED=$(find detections -type f -name '*.yml' | sort | tr '\n' ' ' | sed 's/[[:space:]]*$//')
            DELETED=""
          else
            BASE="${BEFORE_SHA:-HEAD~1}"
            if [[ "$BASE" =~ ^0+$ ]]; then
              BASE="HEAD~1"
            fi
            CHANGED=$(git diff --name-only --diff-filter=ACMRT "$BASE" HEAD -- 'detections/**/*.yml' | tr '\n' ' ' | sed 's/[[:space:]]*$//')
            DELETED=$(git diff --name-only --diff-filter=D "$BASE" HEAD -- 'detections/**/*.yml' | tr '\n' ' ' | sed 's/[[:space:]]*$//')
          fi
          echo "files=$CHANGED" >> "$GITHUB_OUTPUT"
          echo "deleted=$DELETED" >> "$GITHUB_OUTPUT"
          echo "Detections to deploy: $CHANGED"
          if [ -n "$DELETED" ]; then
            echo "Deleted detections detected: $DELETED"
          fi

      - name: Block deleted detection files
        if: steps.changed.outputs.deleted != ''
        run: |
          echo "::error::Deleted detection files cannot be deployed safely. Use status: deprecated and an explicit Splunk decommission process."
          echo "Deleted detections: ${{ steps.changed.outputs.deleted }}"
          exit 1

      - name: Dry-run deploy (preview)
        if: steps.changed.outputs.files != ''
        env:
          SPLUNK_URL: ${{ secrets.SPLUNK_URL }}
          SPLUNK_TOKEN: ${{ secrets.SPLUNK_TOKEN }}
          SPLUNK_APP: ${{ vars.SPLUNK_APP || 'search' }}
        run: |
          python3 scripts/deploy.py \
            --dry-run \
            ${{ steps.changed.outputs.files }}

      - name: Deploy detections
        if: steps.changed.outputs.files != ''
        env:
          SPLUNK_URL: ${{ secrets.SPLUNK_URL }}
          SPLUNK_TOKEN: ${{ secrets.SPLUNK_TOKEN }}
          SPLUNK_APP: ${{ vars.SPLUNK_APP || 'search' }}
        run: |
          python3 scripts/deploy.py \
            ${{ steps.changed.outputs.files }}

      - name: No detections changed
        if: steps.changed.outputs.files == ''
        run: echo "No detection YAML files were modified — nothing to deploy."