integration_test.yaml

# Copyright 2024 Canonical Ltd.
# See LICENSE file for licensing details.

name: Integration tests

on:
  workflow_call:
    inputs:
      builder-runner-label:
        description: Label for building the charm
        type: string
        default: ubuntu-latest
      charmcraft-channel:
        description: Charmcraft channel to use for the integration test
        type: string
        default: latest/stable
      charmcraft-ref:
        description: Used in conjunction with charmcraft-repository to pull and build charmcraft from source instead of using snapstore version.
        type: string
        default: ""
      charmcraft-repository:
        description: Pull and build charmcraft from source instead of using snapstore version (this means that the `charmcraft-channel` input will be ignored).
        type: string
        default: ""
      channel:
        description: Actions operator provider channel as per https://github.com/charmed-kubernetes/actions-operator#usage
        type: string
        default: latest/stable
      charm-directory:
        type: string
        description: The directory for the charm under the working-directory
        default: "."
      extra-arguments:
        description: Additional arguments to pass to the integration test execution
        type: string
      extra-test-matrix:
        description: |
          Aditional mapping to lists of matrices to be applied on top of series and modules matrix in JSON format, i.e. '{"extras":["foo","bar"]}'.
          Each mapping will be injected into the matrix section of the integration-test.
        type: string
        default: "{}"
      juju-channel:
        description: Actions operator juju channel as per https://github.com/charmed-kubernetes/actions-operator#usage
        type: string
        default: 2.9/stable
      identifier:
        type: string
        description: >-
          Identifier for the integration test job: This is used to distinguish between multiple integration test jobs
          running within the same workflow. It is recommended to set this identifier to the job name.
        default: ""
      load-test-enabled:
        type: boolean
        description: Whether load testing is enabled
        default: false
      load-test-run-args:
        type: string
        description: Command line arguments for the load test execution
        default: ""
      modules:
        description: List of testing modules to run the tests in JSON format, i.e. '["foo", "bar"]'. Each element will be passed to pytest through tox as -k argument
        type: string
        default: '[""]'
      pre-run-script:
        description: Path to the bash script to be run before the integration tests
        type: string
      provider:
        description: Actions operator provider as per https://github.com/charmed-kubernetes/actions-operator#usage
        type: string
        default: microk8s
      rockcraft-channel:
        description: Rockcraft channel to use for the integration test
        type: string
        default: latest/stable
      rockcraft-ref:
        description: Used in conjunction with rockcraft-repository to pull and build rockcraft from source instead of using snapstore version.
        type: string
        default: ""
      rockcraft-repository:
        description: Pull and build rockcraft from source instead of using snapstore version (this means that the rockcraft-channel input will be ignored).
        type: string
        default: ""
      rockcraft-enable-security-nesting:
        description: Set security.nesting=true on the rockcraft lxc project to allow for nested containers.
        type: boolean
        default: false
      microk8s-addons:
        description: Microk8s provider add-ons override. A minimum set of addons (the defaults) must be enabled.
        type: string
        default: "dns ingress rbac storage"
      self-hosted-runner:
        type: boolean
        description: Whether to use self-hosted runners to run the jobs.
        default: false
      self-hosted-runner-arch:
        type: string
        description: Architecture to use on self-hosted runners to run the jobs.
        default: "x64"
      self-hosted-runner-label:
        type: string
        description: Label for selecting the self-hosted runners.
        default: "large"
      series:
        description: List of series to run the tests in JSON format, i.e. '["jammy", "focal"]'. Each element will be passed to pytest through tox as --series argument
        type: string
        default: '[""]'
      setup-devstack-swift:
        description: Use setup-devstack-swift action to prepare a swift server for testing.
        type: boolean
        default: false
      test-timeout:
        description: Timeout in minutes for the integration test.
        type: number
        default: 360
      test-tox-env:
        description: The tox environment name for the integration test.
        type: string
        default: "integration"
      tmate-debug:
        description: Use tmate debugging session on integration test failure.
        type: boolean
        default: false
      tmate-timeout:
        description: Timeout in minutes to keep tmate debugging session.
        type: number
        default: 30
      trivy-fs-config:
        type: string
        description: Trivy YAML configuration for fs testing that is checked in as part of the repo
      trivy-fs-enabled:
        type: boolean
        description: Whether Trivy testing of type fs is enabled
        default: false
      trivy-fs-ref:
        type: string
        description: Target directory to do the Trivy testing
        default: "."
      trivy-image-config:
        type: string
        description: Trivy YAML configuration for image testing that is checked in as part of the repo
      trivy-severity-config:
        type: string
        description: Trivy severity configuration for image testing
        default: "CRITICAL,HIGH"
      upload-image:
        type: string
        description: >-
          Can be either 'artifact' or 'registry', which determines the method by which images used 
          in integration tests are uploaded. If set to 'artifact', the images will be uploaded as GitHub 
          action artifacts. If set to 'registry', the images will be uploaded to ghcr. 
          If this parameter is not specified, the default behavior is to use 'artifact' for pull requests 
          originating from forked repositories, and 'registry' for all other cases.
        default: ""
      working-directory:
        type: string
        description: The working directory for jobs
        default: "./"
      zap-auth-header:
        description: If this is defined then its value will be added as a header to all of the ZAP requests
        type: string
      zap-auth-header-value:
        description: If this is defined then its value will be used as the header name to all of the ZAP requests
        type: string
      zap-before-command:
        description: Command to run before ZAP testing
        type: string
      zap-cmd-options:
        description: Options to be used by ZAP
        type: string
        default: "-T 60"
      zap-enabled:
        type: boolean
        description: Whether ZAP testing is enabled
        default: false
      zap-target:
        description: If this is not set, the unit IP address will be used as ZAP target
        type: string
      zap-target-port:
        description: ZAP target port
        type: string
        default: '80'
      zap-target-protocol:
        description: ZAP target protocol
        type: string
        default: "http"
      zap-rules-file-name:
        description: Rules file to ignore any alerts from the ZAP scan
        type: string

env:
  REGISTRY: ghcr.io
  OWNER: ${{ github.repository_owner }}

jobs:
  plan:
    name: Plan
    runs-on: ${{ inputs.builder-runner-label }}
    outputs:
      plan: ${{ steps.plan.outputs.plan }}
    steps:
      - uses: actions/checkout@v4.2.2
      - uses: canonical/operator-workflows/internal/plan@main
        id: plan
        with:
          identifier: ${{ inputs.identifier }}
          upload-image: ${{ inputs.upload-image }}
          working-directory: ${{ inputs.working-directory }}

  build:
    name: Build ${{ matrix.build.type }} (${{ matrix.build.name }})
    needs: [ plan ]
    runs-on: ${{ inputs.builder-runner-label }}
    strategy:
      matrix:
        build: ${{ fromJSON(needs.plan.outputs.plan).build }}
    steps:
      - uses: canonical/setup-lxd@v0.1.2
      - name: Set LXC security nesting
        if: ${{ inputs.rockcraft-enable-security-nesting }}
        run: |
          lxc profile set default security.nesting true
      - uses: actions/checkout@v4
      - uses: canonical/operator-workflows/internal/build@main
        id: build
        with:
          build-plan: ${{ toJSON(matrix.build) }}
          charmcraft-channel: ${{ inputs.charmcraft-channel }}
          charmcraft-ref: ${{ inputs.charmcraft-ref }}
          charmcraft-repository: ${{ inputs.charmcraft-repository }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          rockcraft-channel: ${{ inputs.rockcraft-channel }}
          rockcraft-ref: ${{ inputs.rockcraft-ref }}
          rockcraft-repository: ${{ inputs.rockcraft-repository }}

  plan-scan:
    name: Plan Image Scanning
    runs-on: ${{ inputs.builder-runner-label }}
    needs: [ plan, build ]
    outputs:
      scans: ${{ steps.plan-scan.outputs.scans }}
    steps:
      - uses: canonical/operator-workflows/internal/plan-scan@main
        id: plan-scan
        with:
          plan: ${{ needs.plan.outputs.plan }}

  scan:
    name: Scan Image (${{ matrix.scan.file }})
    runs-on: ${{ inputs.builder-runner-label }}
    needs: [ plan-scan ]
    if: ${{ needs.plan-scan.outputs.scans != '[]' }}
    strategy:
      matrix:
        scan: ${{ fromJSON(needs.plan-scan.outputs.scans) }}
    steps:
      - uses: actions/checkout@v4.2.2
      - name: Change directory
        run: |
          TEMP_DIR=$(mktemp -d)
          cp -rp ./${{ inputs.working-directory }}/. $TEMP_DIR
          rm -rf .* * || :
          cp -rp $TEMP_DIR/. .
          rm -rf $TEMP_DIR
          ls -lah
      - uses: actions/download-artifact@v4.1.8
        if: matrix.scan.artifact != ''
        with:
          name: ${{ matrix.scan.artifact }}
      - if: endsWith( matrix.scan.file, '.rock')
        run: |
          skopeo copy oci-archive:${{ matrix.scan.file }} docker-archive:${{ matrix.scan.file }}.tar
          mv ${{ matrix.scan.file }}.tar ${{ matrix.scan.file }}
      - uses: docker/login-action@v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - if: matrix.scan.image != ''
        run: |
          docker image pull ${{ matrix.scan.image }}
          docker image save -o ${{ matrix.scan.file }} ${{ matrix.scan.image }}
      - name: Run Github Trivy Image Action
        uses: aquasecurity/trivy-action@0.29.0
        with:
          input: ${{ matrix.scan.file }}
          trivy-config: ${{ inputs.trivy-image-config }}
          exit-code: '1'
          severity: ${{ inputs.trivy-severity-config }}
        env:
          TRIVY_DISABLE_VEX_NOTICE: true
      - name: Check trivyignore
        run: |
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.46.0
          if [ -f ".trivyignore" ]
          then
            output=$(trivy image $ROCK_IMAGE --severity ${{ inputs.trivy-severity-config }} -q -f json --ignorefile "" | jq -r '.Results[].Vulnerabilities[].VulnerabilityID' 2>/dev/null || echo "No vulnerabilities found")
            line=0
            while read CVE;
            do
              line=$(( line + 1 ))
              if [[ "$output" != *"$CVE"* ]] && [[ ! "$CVE" =~ ^#.* ]]
              then
              echo "::notice file=.trivyignore,line=${line}::$CVE not present anymore, can be safely removed."
              fi
            done < .trivyignore
          fi
        env:
          TRIVY_USERNAME: ${{ github.actor }}
          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          ROCK_IMAGE: ${{ env.IMAGE_REF }}

  integration-test:
    name: Integration tests
    uses: ./.github/workflows/integration_test_run.yaml
    needs: [ plan, build ]
    if: always() && needs.plan.result == 'success' && (needs.build.result == 'success' || toJSON(fromJSON(needs.plan.outputs.plan).build) == '[]')
    secrets: inherit
    with:
      channel: ${{ inputs.channel }}
      charmcraft-ref: ${{ inputs.charmcraft-ref }}
      charmcraft-repository: ${{ inputs.charmcraft-repository }}
      extra-arguments: ${{ inputs.extra-arguments }}
      extra-test-matrix: ${{ inputs.extra-test-matrix }}
      juju-channel: ${{ inputs.juju-channel }}
      load-test-enabled: ${{ inputs.load-test-enabled }}
      load-test-run-args: ${{ inputs.load-test-run-args }}
      microk8s-addons: ${{ inputs.microk8s-addons }}
      modules: ${{ inputs.modules }}
      owner: ${{ github.repository_owner }}
      plan: ${{ needs.plan.outputs.plan }}
      pre-run-script: ${{ inputs.pre-run-script }}
      provider: ${{ inputs.provider }}
      registry: ghcr.io
      self-hosted-runner-arch: ${{ inputs.self-hosted-runner-arch }}
      self-hosted-runner-label: ${{ inputs.self-hosted-runner-label }}
      self-hosted-runner: ${{ inputs.self-hosted-runner }}
      series: ${{ inputs.series }}
      setup-devstack-swift: ${{ inputs.setup-devstack-swift }}
      test-timeout: ${{ inputs.test-timeout }}
      test-tox-env: ${{ inputs.test-tox-env }}
      tmate-debug: ${{ inputs.tmate-debug }}
      tmate-timeout: ${{ inputs.tmate-timeout }}
      trivy-fs-config: ${{ inputs.trivy-fs-config }}
      trivy-fs-enabled: ${{ inputs.trivy-fs-enabled }}
      trivy-fs-ref: ${{ inputs.trivy-fs-ref }}
      working-directory: ${{ inputs.working-directory }}
      zap-auth-header-value: ${{ inputs.zap-auth-header-value }}
      zap-auth-header: ${{ inputs.zap-auth-header }}
      zap-before-command: ${{ inputs.zap-before-command }}
      zap-cmd-options: ${{ inputs.zap-cmd-options }}
      zap-enabled: ${{ inputs.zap-enabled }}
      zap-rules-file-name: ${{ inputs.zap-rules-file-name }}
      zap-target-port: ${{ inputs.zap-target-port }}
      zap-target-protocol: ${{ inputs.zap-target-protocol }}
      zap-target: ${{ inputs.zap-target }}
  required_status_checks:
    name: Required Integration Test Status Checks
    runs-on: ${{ inputs.builder-runner-label }}
    needs:
      - integration-test
    if: always() && !cancelled()
    timeout-minutes: 5
    steps:
      - run: |
          [ '${{ needs.integration-test.result }}' = 'success' ] || (echo integration-test failed && false)