ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
  schedule:
    # Nightly K8s-version-matrix smoke at 04:17 UTC. Off-peak slot avoids
    # contention with US/EU working-hours PR traffic and the lint cache.
    - cron: '17 4 * * *'

permissions:
  contents: read

jobs:
  validate-yaml-json:
    name: Validate YAML/JSON
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout public source
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            ref="refs/pull/${PR_NUMBER}/merge"
          else
            ref="${GITHUB_REF}"
          fi
          git -c protocol.version=2 fetch --no-tags --depth=1 origin "+${ref}:refs/remotes/origin/checkout"
          git checkout --force --detach refs/remotes/origin/checkout
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Set up promtool
        env:
          PROMETHEUS_VERSION: 2.55.1
        run: |
          set -euo pipefail
          mkdir -p /tmp/prometheus
          asset="prometheus-${PROMETHEUS_VERSION}.linux-amd64.tar.gz"
          base_url="https://github.com/prometheus/prometheus/releases/download/v${PROMETHEUS_VERSION}"
          curl -sSLO "${base_url}/${asset}"
          curl -sSLO "${base_url}/sha256sums.txt"
          grep "  ${asset}$" sha256sums.txt | sha256sum -c -
          tar -xzf "${asset}" --strip-components=1 -C /tmp/prometheus "prometheus-${PROMETHEUS_VERSION}.linux-amd64/promtool"
          echo "/tmp/prometheus" >> "${GITHUB_PATH}"
      - name: Validate YAML and Grafana JSON
        run: make validate-yaml-json

  markdown-links:
    name: Markdown links
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout public source
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            ref="refs/pull/${PR_NUMBER}/merge"
          else
            ref="${GITHUB_REF}"
          fi
          git -c protocol.version=2 fetch --no-tags --depth=1 origin "+${ref}:refs/remotes/origin/checkout"
          git checkout --force --detach refs/remotes/origin/checkout
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Check local Markdown links
        run: make check-markdown-links

  examples:
    name: Examples
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout public source
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            ref="refs/pull/${PR_NUMBER}/merge"
          else
            ref="${GITHUB_REF}"
          fi
          git -c protocol.version=2 fetch --no-tags --depth=1 origin "+${ref}:refs/remotes/origin/checkout"
          git checkout --force --detach refs/remotes/origin/checkout
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Set up Go
        run: scripts/ci-setup-go.sh
      - name: Execute example scripts
        run: make check-examples

  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout public source
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            ref="refs/pull/${PR_NUMBER}/merge"
          else
            ref="${GITHUB_REF}"
          fi
          git -c protocol.version=2 fetch --no-tags --depth=1 origin "+${ref}:refs/remotes/origin/checkout"
          git checkout --force --detach refs/remotes/origin/checkout
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Set up Go
        run: scripts/ci-setup-go.sh
      - name: golangci-lint
        run: make lint

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout public source
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            ref="refs/pull/${PR_NUMBER}/merge"
          else
            ref="${GITHUB_REF}"
          fi
          git -c protocol.version=2 fetch --no-tags --depth=1 origin "+${ref}:refs/remotes/origin/checkout"
          git checkout --force --detach refs/remotes/origin/checkout
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Set up Go
        run: scripts/ci-setup-go.sh
      - name: Generate
        run: make generate
      - name: Build
        run: make build
      - name: Verify no diff after generate
        run: |
          git diff --exit-code || (echo "Generated files are out of date. Run 'make generate'." && exit 1)

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout public source
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            ref="refs/pull/${PR_NUMBER}/merge"
          else
            ref="${GITHUB_REF}"
          fi
          git -c protocol.version=2 fetch --no-tags --depth=1 origin "+${ref}:refs/remotes/origin/checkout"
          git checkout --force --detach refs/remotes/origin/checkout
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Set up Go
        run: scripts/ci-setup-go.sh
      - name: Run tests
        run: make test

  conformance:
    name: Conformance
    runs-on: ubuntu-latest
    steps:
      - name: Checkout public source
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            ref="refs/pull/${PR_NUMBER}/merge"
          else
            ref="${GITHUB_REF}"
          fi
          git -c protocol.version=2 fetch --no-tags --depth=1 origin "+${ref}:refs/remotes/origin/checkout"
          git checkout --force --detach refs/remotes/origin/checkout
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Set up Go
        run: scripts/ci-setup-go.sh
      - name: Run reference conformance suites
        run: make conformance
      - name: Verify hello-world custom-substrate proof
        run: make conformance-hello-world

  cli-smoke:
    name: CLI Smoke and Stress
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout public source
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            ref="refs/pull/${PR_NUMBER}/merge"
          else
            ref="${GITHUB_REF}"
          fi
          git -c protocol.version=2 fetch --no-tags --depth=1 origin "+${ref}:refs/remotes/origin/checkout"
          git checkout --force --detach refs/remotes/origin/checkout
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Set up Go
        run: scripts/ci-setup-go.sh
      - name: Run CLI smoke and stress tests
        run: make cli-smoke cli-stress

  install-render:
    name: Install Render
    runs-on: ubuntu-latest
    steps:
      - name: Checkout public source
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            ref="refs/pull/${PR_NUMBER}/merge"
          else
            ref="${GITHUB_REF}"
          fi
          git -c protocol.version=2 fetch --no-tags --depth=1 origin "+${ref}:refs/remotes/origin/checkout"
          git checkout --force --detach refs/remotes/origin/checkout
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Set up Helm and kubectl
        run: scripts/ci-setup-tools.sh
      - name: Verify install render
        run: scripts/verify-install.sh render

  kind-smoke:
    name: Kind Install Smoke
    runs-on: ubuntu-latest
    timeout-minutes: 20
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout public source
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            ref="refs/pull/${PR_NUMBER}/merge"
          else
            ref="${GITHUB_REF}"
          fi
          git -c protocol.version=2 fetch --no-tags --depth=1 origin "+${ref}:refs/remotes/origin/checkout"
          git checkout --force --detach refs/remotes/origin/checkout
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Set up Helm, kubectl, and kind
        env:
          CI_SETUP_KIND: "true"
        run: scripts/ci-setup-tools.sh
      - name: Install chart and run quickstart smoke
        env:
          KAPRO_CI_KEEP_CLUSTER_ON_FAILURE: "true"
          KAPRO_CI_QUICKSTARTS: direct,flux,argo,oci
        run: scripts/ci-kind-smoke.sh
      - name: Collect Kind smoke diagnostics
        if: failure()
        run: |
          mkdir -p kind-smoke-diagnostics
          kind export logs --name kapro-ci-smoke kind-smoke-diagnostics/kind || true
          kubectl --context kind-kapro-ci-smoke get events -A --sort-by=.lastTimestamp > kind-smoke-diagnostics/events.txt || true
          kubectl --context kind-kapro-ci-smoke get all -A -o wide > kind-smoke-diagnostics/all.txt || true
          kubectl --context kind-kapro-ci-smoke get substrates.kapro.io,fleets.kapro.io,clusters.kapro.io,plans.kapro.io,promotions.kapro.io,promotionruns.runtime.kapro.io,targets.runtime.kapro.io -A -o yaml > kind-smoke-diagnostics/kapro-resources.yaml || true
          kubectl --context kind-kapro-ci-smoke -n kapro-system logs deploy/kapro-kapro-operator --tail=-1 > kind-smoke-diagnostics/operator.log || true

  release-smoke:
    name: Release Smoke
    runs-on: ubuntu-latest
    steps:
      - name: Checkout public source
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            ref="refs/pull/${PR_NUMBER}/merge"
          else
            ref="${GITHUB_REF}"
          fi
          git -c protocol.version=2 fetch --no-tags --depth=1 origin "+${ref}:refs/remotes/origin/checkout"
          git checkout --force --detach refs/remotes/origin/checkout
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Set up Helm
        run: scripts/ci-setup-tools.sh
      - name: Verify release packaging
        run: VERSION=v0.6.2 make release-smoke

  docker:
    name: Docker Build (dry-run)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout public source
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            ref="refs/pull/${PR_NUMBER}/merge"
          else
            ref="${GITHUB_REF}"
          fi
          git -c protocol.version=2 fetch --no-tags --depth=1 origin "+${ref}:refs/remotes/origin/checkout"
          git checkout --force --detach refs/remotes/origin/checkout
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Build operator image (no push)
        run: docker build -f build/package/Dockerfile.operator -t ghcr.io/kapro-dev/kapro-operator:pr-${{ github.event.number }} .
      - name: Build cluster-controller image (no push)
        run: docker build -f build/package/Dockerfile.cluster-controller -t ghcr.io/kapro-dev/kapro-cluster-controller:pr-${{ github.event.number }} .

  kind-smoke-matrix:
    # K8s version matrix for the Kind install smoke. Runs nightly on
    # schedule and on-demand via workflow_dispatch. The single-version
    # Kind Install Smoke job above runs on pull requests.
    name: Kind Smoke (K8s ${{ matrix.k8s }})
    runs-on: ubuntu-latest
    timeout-minutes: 25
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    strategy:
      fail-fast: false
      matrix:
        k8s:
          - v1.28.13
          - v1.29.8
          - v1.30.4
          - v1.31.0
    steps:
      - name: Checkout public source
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git"
          if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
            ref="refs/pull/${PR_NUMBER}/merge"
          else
            ref="${GITHUB_REF}"
          fi
          git -c protocol.version=2 fetch --no-tags --depth=1 origin "+${ref}:refs/remotes/origin/checkout"
          git checkout --force --detach refs/remotes/origin/checkout
          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
      - name: Set up Helm, kubectl, and kind
        env:
          CI_SETUP_KIND: "true"
        run: scripts/ci-setup-tools.sh
      - name: Install chart and run quickstart smoke
        env:
          KAPRO_CI_KIND_IMAGE: kindest/node:${{ matrix.k8s }}
          KAPRO_CI_KIND_CLUSTER: kapro-ci-${{ matrix.k8s }}
          KAPRO_CI_KEEP_CLUSTER_ON_FAILURE: "true"
          KAPRO_CI_QUICKSTARTS: direct,flux,argo,oci
        run: scripts/ci-kind-smoke.sh
      - name: Collect Kind smoke diagnostics
        if: failure()
        env:
          KAPRO_CI_KIND_CLUSTER: kapro-ci-${{ matrix.k8s }}
        run: |
          mkdir -p kind-smoke-diagnostics
          kind export logs --name "${KAPRO_CI_KIND_CLUSTER}" kind-smoke-diagnostics/kind || true
          kubectl --context "kind-${KAPRO_CI_KIND_CLUSTER}" get events -A --sort-by=.lastTimestamp > kind-smoke-diagnostics/events.txt || true
          kubectl --context "kind-${KAPRO_CI_KIND_CLUSTER}" get all -A -o wide > kind-smoke-diagnostics/all.txt || true
          kubectl --context "kind-${KAPRO_CI_KIND_CLUSTER}" get substrates.kapro.io,fleets.kapro.io,clusters.kapro.io,plans.kapro.io,promotions.kapro.io,promotionruns.runtime.kapro.io,targets.runtime.kapro.io -A -o yaml > kind-smoke-diagnostics/kapro-resources.yaml || true
          kubectl --context "kind-${KAPRO_CI_KIND_CLUSTER}" -n kapro-system logs deploy/kapro-kapro-operator --tail=-1 > kind-smoke-diagnostics/operator.log || true