feat: add chainsaw based e2e tests

.github/actions/build-and-test/action.yaml

@@ -0,0 +1,102 @@
+name: Action - Build and Test
+description: "Build and test the operator (with optional e2e tests)"
+
+inputs:
+  run-e2e:
+    description: "Run e2e tests"
+    required: false
+    default: "false"
+  go-version:
+    description: "Go version to use"
+    required: true
+  ngrok-api-key:
+    description: "NGROK_API_KEY for e2e tests, if enabled"
+    required: false
+    default: "fake-api-key"
+  ngrok-authtoken:
+    description: "NGROK_AUTHTOKEN for e2e tests, if enabled"
+    required: false
+    default: "fake-authtoken"
+
+runs:
+  using: "composite"
+  steps:
+    - uses: debianmaster/actions-k3s@master
+      id: k3s
+      with:
+        version: 'latest'
+
+    - shell: bash
+      run: |
+        kubectl get nodes
+        kubectl get pods -A
+
+    - name: Set up Go
+      uses: actions/setup-go@v3
+      with:
+        go-version: ${{ inputs.go-version }}
+
+    - name: Build
+      shell: bash
+      run: make build
+
+    - name: Lint
+      shell: bash
+      run: make lint
+
+    - name: Setup Envtest
+      shell: bash
+      run: make envtest
+
+    - name: Test
+      shell: bash
+      run: make test
+
+    - name: Build the Docker image
+      shell: bash
+      run: make docker-build
+
+    - name: Deploy controller to local cluster
+      shell: bash
+      env:
+        # deploy with 1-click demo mode when not running e2e tests
+        DEPLOY_ONE_CLICK_DEMO_MODE: ${{ inputs.run-e2e == 'true' &&  'false' || 'true' }}
+        NGROK_API_KEY: ${{ inputs.ngrok-api-key }}
+        NGROK_AUTHTOKEN: ${{ inputs.ngrok-authtoken }}
+        E2E_BINDING_NAME: k8s/e2e-${{ github.run_id }}
+      run: |
+        # create some namespaces for bindings tests
+        kubectl create ns e2e || true
+
+        # deploy ngrok-op for e2e tests
+        make deploy_for_e2e
+
+    - name: Check if controller is up
+      shell: bash
+      run: |
+        kubectl get nodes
+        kubectl get pods -A
+
+    - name: Install cosign
+      if: ${{ inputs.run-e2e == 'true' }}
+      uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
+    - name: Install chainsaw
+      if: ${{ inputs.run-e2e == 'true' }}
+      uses: kyverno/action-install-chainsaw@d311eacde764f806c9658574ff64c9c3b21f8397 # v0.2.11
+      with:
+        verify: true
+
+    - name: Run e2e tests
+      shell: bash
+      if: ${{ inputs.run-e2e == 'true' }}
+      run: |
+        make e2e-tests
+
+    # best effort to remove ngrok k8s resources from cluster
+    # this allows our finalizers to delete upstream ngrok API resources too
+    # that hopefully helps not pollute our ngrok-operator-ci account
+    - name: Cleanup e2e tests
+      shell: bash
+      if: ${{ inputs.run-e2e == 'true' }}
+      run: |
+        make e2e-clean

.github/actions/changes/action.yaml

@@ -0,0 +1,52 @@
+name: Action - Changes
+description: "Detect changes in the repository"
+
+outputs:
+  charts:
+    description: "If any part of Helm charts have changed"
+    value: ${{ steps.filter.outputs.charts }}
+  chartyaml:
+    description: "If the Helm Chart.yaml has changed"
+    value: ${{ steps.filter.outputs.chartyaml }}
+  go:
+    description: "If the go (build) files have changed"
+    value: ${{ steps.filter.outputs.go }}
+  tag:
+    description: "If the tag (VERSION) has changed"
+    value: ${{ steps.filter.outputs.tag }}
+  tests:
+    description: "If the tests have changed"
+    value: ${{ steps.filter.outputs.tests }}
+  make:
+    description: "If the Makefile has changed"
+    value: ${{ steps.filter.outputs.make }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: filter
+      id: filter
+      uses: dorny/[email protected]
+      with:
+        filters: |
+          chartyaml:
+            - 'helm/ngrok-operator/Chart.yaml'
+          charts:
+            - 'helm/ngrok-operator/**'
+            - 'scripts/e2e.sh'
+          go:
+            - '**.go'
+            - 'go.mod'
+            - 'go.sum'
+            - 'cmd/**'
+            - 'internal/**'
+            - 'pkg/**'
+            - 'Dockerfile'
+            - 'scripts/e2e.sh'
+            - 'VERSION'
+          tests:
+            - 'test/**'
+          make:
+            - 'Makefile'
+          tag:
+            - 'VERSION'

.github/workflows/ci.yaml

@@ -4,6 +4,8 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  pull_request_target:
+    branches: [ "main" ]
 
 env:
   GO_VERSION: '1.23'
@@ -13,38 +15,20 @@ jobs:
 
   changes:
     runs-on: ubuntu-latest
-    outputs:
-      charts: ${{ steps.filter.outputs.charts }}
-      chartyaml: ${{ steps.filter.outputs.chartyaml }}
-      go: ${{ steps.filter.outputs.go }}
-      tag: ${{ steps.filter.outputs.tag }}
     permissions:
       contents: read
       pull-requests: read
+    outputs:
+      charts: ${{ steps.changes.outputs.charts }}
+      chartyaml: ${{ steps.changes.outputs.chartyaml }}
+      go: ${{ steps.changes.outputs.go }}
+      tag: ${{ steps.changes.outputs.tag }}
+      tests: ${{ steps.changes.outputs.tests }}
+      make: ${{ steps.changes.outputs.make }}
     steps:
-    - name: Checkout repo
-      uses: actions/checkout@v3
-    - id: filter
-      uses: dorny/[email protected]
-      with:
-        filters: |
-          chartyaml:
-            - 'helm/ngrok-operator/Chart.yaml'
-          charts:
-            - 'helm/ngrok-operator/**'
-            - 'scripts/e2e.sh'
-          go:
-            - '**.go'
-            - 'go.mod'
-            - 'go.sum'
-            - 'cmd/**'
-            - 'internal/**'
-            - 'pkg/**'
-            - 'Dockerfile'
-            - 'scripts/e2e.sh'
-            - 'VERSION'
-          tag:
-            - 'VERSION'
+    - uses: actions/checkout@v3
+    - uses: "./.github/actions/changes"
+      id: changes
 
   # Make sure that Kubebuilder autogenerated files are up to date.
   kubebuilder-diff:
@@ -105,54 +89,42 @@ jobs:
     - run: git diff --exit-code go.mod
     - run: git diff --exit-code go.sum
 
+  echo:
+    runs-on: ubuntu-latest
+    needs: [changes]
+    steps:
+    - uses: actions/checkout@v3
+    - run: |
+        echo "go: ${{ needs.changes.outputs.go }}"
+        echo "charts: ${{ needs.changes.outputs.charts }}"
+        echo "chartyaml: ${{ needs.changes.outputs.chartyaml }}"
+        echo "tests: ${{ needs.changes.outputs.tests }}"
+        echo "make: ${{ needs.changes.outputs.make }}"
 
-  build:
+  build-and-test:
     runs-on: ubuntu-latest
     needs:
     - changes
     - kubebuilder-diff
     if: |
       (needs.changes.outputs.go == 'true') ||
-      (needs.changes.outputs.charts == 'true')
+      (needs.changes.outputs.charts == 'true') ||
+      (needs.changes.outputs.chartyaml == 'true') ||
+      (needs.changes.outputs.tests == 'true') ||
+      (needs.changes.outputs.make == 'true')
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
     - uses: actions/checkout@v3
-
-    - uses: debianmaster/actions-k3s@master
-      id: k3s
-      with:
-        version: 'latest'
-    - run: |
-        kubectl get nodes
-        kubectl get pods -A
-
-    - name: Set up Go
-      uses: actions/setup-go@v3
+    - uses: "./.github/actions/build-and-test"
       with:
+        # this workflow is for incoming PRs, so we want to skip e2e tests
+        # and deploy the demo mode because our api keys are not available
+        # on contributor's forks
+        run-e2e: false
         go-version: ${{ env.GO_VERSION }}
 
-    - name: Build
-      run: make build
-
-    - name: Lint
-      run: make lint
-
-    - name: Setup Envtest
-      run: make envtest
-
-    - name: Test
-      run: make test
-
-    - name: Build the Docker image
-      run: make docker-build
-
-    - name: Deploy controller to local cluster
-      run: make deploy NGROK_API_KEY=fake-ci-key NGROK_AUTHTOKEN=fake-ci-token
-
-    - name: Check if controller is up
-      run: |
-        kubectl get nodes
-        kubectl get pods -A
-
   helm:
     runs-on: ubuntu-latest
     timeout-minutes: 15

.github/workflows/test.yaml

@@ -0,0 +1,51 @@
+name: Tests
+on:
+  push:
+    branches: [ "main" ]
+  pull_request_target:
+    branches: [ "main" ]
+
+env:
+  GO_VERSION: '1.23'
+  DOCKER_BUILDX_PLATFORMS: linux/amd64,linux/arm64
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      charts: ${{ steps.changes.outputs.charts }}
+      chartyaml: ${{ steps.changes.outputs.chartyaml }}
+      go: ${{ steps.changes.outputs.go }}
+      tag: ${{ steps.changes.outputs.tag }}
+      tests: ${{ steps.changes.outputs.tests }}
+      make: ${{ steps.changes.outputs.make }}
+    steps:
+    - uses: actions/checkout@v3
+    - uses: "./.github/actions/changes"
+      id: changes
+
+  build-and-test:
+    runs-on: ubuntu-latest
+    needs:
+    - changes
+    - kubebuilder-diff
+    if: |
+      (needs.changes.outputs.go == 'true') ||
+      (needs.changes.outputs.charts == 'true') ||
+      (needs.changes.outputs.chartyaml == 'true') ||
+      (needs.changes.outputs.tests == 'true') ||
+      (needs.changes.outputs.make == 'true')
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+    - uses: actions/checkout@v3
+    - uses: "./.github/actions/build-and-test"
+      with:
+        run-e2e: true
+        go-version: ${{ env.GO_VERSION }}
+        ngrok-api-key: ${{ secrets.NGROK_CI_API_KEY }}
+        ngrok-authtoken: ${{ secrets.NGROK_CI_AUTHTOKEN }}