feat: audit workflow for releases

.github/workflows/audit.yml

@@ -0,0 +1,49 @@
+---
+name: Audit Shas
+
+on:
+  workflow_dispatch:
+    inputs:
+      ### Required
+      environment:
+        description: "Deployment environment - dev/test/prod"
+        required: true
+        type: choice
+        options: ["dev","test","prod"]
+        default: "prod"
+      release:
+        description: 'release name'
+        required: true
+        type: string
+        default: "prod"
+jobs:
+  # https://github.com/bcgov-nr/action-deployer-openshift
+  docker_login:
+    - name: Log in to the Container registry
+      if: steps.build.outputs.triggered == 'true'
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: {{ secrets.oc_token }}
+
+  audit_packages:
+    name: Audit
+    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        package: [dops, vehicles, frontend, scheduler, policy]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Audit the installed application for package sha vs deployed sha
+        run: |
+          oc login --token=${{ secrets.oc_token }} --server=${{ vars.oc_server }}
+          oc project c28f0c-${{ inputs.environment }} # Safeguard!
+          export GHCR_SHA=$(docker manifest inspect onroutebc-${{inputs.release}}-${{matrix.package}} | jq '.manifests[0].digest')
+          export SHA_LIST=$(oc get pods -l app.kubernetes.io/instance=onroutebc-${{inputs.release}} -l app.kubernetes.io/name=${{matrix.package}} -o yaml | grep imageID | grep ghcr | cut -d : -f 3)
+          for sha in ${SHA_LIST}
+            do
+              echo "onroutebc-${{inputs.release}}-${{matrix.package}} - pod:${sha} ghcr: ${GHCR_SHA}"
+            done
+