Skip to content

Commit 24d76df

Browse files
armsnyderarmsnyder
committed
Enable EE acceptance tests in pull requests
1 parent 6c1a60d commit 24d76df

File tree

8 files changed

+328
-130
lines changed

8 files changed

+328
-130
lines changed

‎.github/workflows/pr-acceptance.yml

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# This workflow runs acceptance tests on pull requests (both CE and EE). It needs to be run in the
2+
# target project instead of the fork in order to use secrets. This is why the actions/checkout
3+
# action regularly has to specify the pull request sha.
4+
#
5+
# SECURITY ADVISORY
6+
# Be careful while making changes to this file.
7+
# See: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
8+
9+
name: pr-acceptance
10+
11+
on:
12+
# The pull_request_target event type fires for pull requests, but in the context of the target
13+
# project.
14+
pull_request_target:
15+
# Acceptance tests are unnecessary to run on some types of PRs.
16+
paths-ignore:
17+
- 'docs/**'
18+
- 'examples/**'
19+
- 'README.md'
20+
- 'CHANGELOG.md'
21+
- 'CONTRIBUTING.md'
22+
23+
concurrency:
24+
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
25+
cancel-in-progress: true
26+
27+
jobs:
28+
go-version:
29+
runs-on: ubuntu-latest
30+
outputs:
31+
go-version: ${{ steps.go-version.outputs.go-version }}
32+
steps:
33+
# Check out the pull request code (as opposed to the target project).
34+
- uses: actions/checkout@v2
35+
with:
36+
ref: ${{ github.event.pull_request.head.sha }}
37+
# Read the .go-version file and output it for other jobs to use.
38+
- id: go-version
39+
run: echo "::set-output name=go-version::$(cat .go-version)"
40+
41+
acceptance-ce:
42+
timeout-minutes: 60
43+
runs-on: ubuntu-latest
44+
needs: [go-version]
45+
steps:
46+
- uses: actions/setup-go@v2
47+
with:
48+
go-version: ${{ needs.go-version.outputs.go-version }}
49+
# Check out the pull request code (as opposed to the target project).
50+
- uses: actions/checkout@v2
51+
with:
52+
ref: ${{ github.event.pull_request.head.sha }}
53+
# Cache the Go modules.
54+
- uses: actions/cache@v2
55+
with:
56+
path: ~/go/pkg/mod
57+
key: ${{ github.job }}-${{ runner.os }}-go${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum', 'GNUMakefile') }}
58+
# CAUTION: EXECUTING UNTRUSTED CODE.
59+
# This is made safe because we have not referenced any secrets or GitHub tokens.
60+
- run: make testacc-up
61+
- run: make testacc
62+
63+
acceptance-ee:
64+
timeout-minutes: 60
65+
runs-on: ubuntu-latest
66+
needs: [go-version]
67+
steps:
68+
- uses: actions/setup-go@v2
69+
with:
70+
go-version: ${{ needs.go-version.outputs.go-version }}
71+
# Check out the target project (as opposed to the pull request code).
72+
# Yes, this is intentional. We are using trusted code while working with the GitLab license.
73+
- uses: actions/checkout@v2
74+
- name: Decrypt license
75+
run: |
76+
openssl version
77+
openssl enc -d -aes-256-cbc -pbkdf2 -iter 20000 -in Gitlab-license.encrypted -out Gitlab-license.txt -pass "pass:${{ secrets.LICENSE_ENCRYPTION_PASSWORD }}"
78+
- run: make testacc-up SERVICE=gitlab-ee
79+
# Check out the pull request code (as opposed to the target project).
80+
# This overwrites the entire directory and deleted the unencrypted GitLab license file. The
81+
# service has already started and continues using the license even though the file is deleted.
82+
- uses: actions/checkout@v2
83+
with:
84+
ref: ${{ github.event.pull_request.head.sha }}
85+
# Cache the Go modules.
86+
- uses: actions/cache@v2
87+
with:
88+
path: ~/go/pkg/mod
89+
key: ${{ github.job }}-${{ runner.os }}-go${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum', 'GNUMakefile') }}
90+
# CAUTION: EXECUTING UNTRUSTED CODE.
91+
# This is made safe because we have already cleaned up the unencrypted GitLab license file,
92+
# we have no other secrets, and we are not using GitHub tokens.
93+
- run: make testacc

‎.github/workflows/pr-lint.yml

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# This workflow runs basic checks for pull requests that do not need secrets.
2+
3+
name: pr-lint
4+
5+
on: [pull_request]
6+
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
9+
cancel-in-progress: true
10+
11+
jobs:
12+
go-version:
13+
runs-on: ubuntu-latest
14+
outputs:
15+
go-version: ${{ steps.go-version.outputs.go-version }}
16+
steps:
17+
- uses: actions/checkout@v2
18+
# Read the .go-version file and output it for other jobs to use.
19+
- id: go-version
20+
run: echo "::set-output name=go-version::$(cat .go-version)"
21+
22+
lint:
23+
runs-on: ubuntu-latest
24+
needs: [go-version]
25+
strategy:
26+
fail-fast: false
27+
# Run all lint targets.
28+
matrix:
29+
target:
30+
- lint-golangci
31+
- lint-tfprovider
32+
- lint-examples-tf
33+
- lint-examples-sh
34+
- lint-generated
35+
steps:
36+
- uses: actions/setup-go@v2
37+
with:
38+
go-version: ${{ needs.go-version.outputs.go-version }}
39+
- uses: actions/checkout@v2
40+
# Cache the Go modules and compiled tools for the specific lint target.
41+
- uses: actions/cache@v2
42+
with:
43+
path: |
44+
~/go/pkg/mod
45+
bin
46+
key: ${{ github.job }}-${{ matrix.target }}-${{ runner.os }}-go${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum', 'GNUMakefile') }}
47+
- run: make ${{ matrix.target }}
48+
49+
unit-test:
50+
runs-on: ${{ matrix.os }}
51+
needs: [go-version]
52+
strategy:
53+
fail-fast: false
54+
matrix:
55+
os: [ubuntu-latest, macos-latest, windows-latest]
56+
steps:
57+
- uses: actions/setup-go@v2
58+
with:
59+
go-version: ${{ needs.go-version.outputs.go-version }}
60+
- uses: actions/checkout@v2
61+
# Cache the Go modules.
62+
- uses: actions/cache@v2
63+
with:
64+
path: ~/go/pkg/mod
65+
key: ${{ github.job }}-${{ runner.os }}-go${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum', 'GNUMakefile') }}
66+
- run: make test

‎.github/workflows/push.yml

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# This workflow runs all checks when code is pushed. It does NOT run for pull requests.
2+
3+
name: push
4+
5+
on:
6+
# The workflow_dispatch event type is for manual workflow execution.
7+
workflow_dispatch: {}
8+
push: {}
9+
# In addition to pushes, run the workflow weekly to detect issues with the latest GitLab version.
10+
schedule:
11+
# ┌───────────── minute (0 - 59)
12+
# │ ┌───────────── hour (0 - 23)
13+
# │ │ ┌───────────── day of the month (1 - 31)
14+
# │ │ │ ┌───────────── month (1 - 12 or JAN-DEC)
15+
# │ │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
16+
# * * * * *
17+
- cron: '0 0 * * 3'
18+
19+
concurrency:
20+
group: ${{ github.workflow }}-${{ github.ref }}
21+
cancel-in-progress: true
22+
23+
jobs:
24+
go-version:
25+
runs-on: ubuntu-latest
26+
outputs:
27+
go-version: ${{ steps.go-version.outputs.go-version }}
28+
steps:
29+
- uses: actions/checkout@v2
30+
# Read the .go-version file and output it for other jobs to use.
31+
- id: go-version
32+
run: echo "::set-output name=go-version::$(cat .go-version)"
33+
34+
lint:
35+
runs-on: ubuntu-latest
36+
needs: [go-version]
37+
strategy:
38+
fail-fast: false
39+
# Run all lint targets.
40+
matrix:
41+
target:
42+
- lint-golangci
43+
- lint-tfprovider
44+
- lint-examples-tf
45+
- lint-examples-sh
46+
- lint-generated
47+
steps:
48+
- uses: actions/setup-go@v2
49+
with:
50+
go-version: ${{ needs.go-version.outputs.go-version }}
51+
- uses: actions/checkout@v2
52+
# Cache the Go modules and compiled tools for the specific lint target.
53+
- uses: actions/cache@v2
54+
with:
55+
path: |
56+
~/go/pkg/mod
57+
bin
58+
key: ${{ github.job }}-${{ matrix.target }}-${{ runner.os }}-go${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum', 'GNUMakefile') }}
59+
- run: make ${{ matrix.target }}
60+
61+
unit-test:
62+
runs-on: ${{ matrix.os }}
63+
needs: [go-version]
64+
strategy:
65+
fail-fast: false
66+
matrix:
67+
os: [ubuntu-latest, macos-latest, windows-latest]
68+
steps:
69+
- uses: actions/setup-go@v2
70+
with:
71+
go-version: ${{ needs.go-version.outputs.go-version }}
72+
- uses: actions/checkout@v2
73+
# Cache the Go modules.
74+
- uses: actions/cache@v2
75+
with:
76+
path: ~/go/pkg/mod
77+
key: ${{ github.job }}-${{ runner.os }}-go${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum', 'GNUMakefile') }}
78+
- run: make test
79+
80+
# Check whether the LICENSE_ENCRYPTION_PASSWORD secret exists.
81+
# Workaround for https://github.com/actions/runner/issues/520.
82+
license-encryption-password:
83+
runs-on: ubuntu-latest
84+
outputs:
85+
defined: ${{ steps.defined.outputs.defined }}
86+
steps:
87+
- id: defined
88+
env:
89+
LICENSE_ENCRYPTION_PASSWORD: ${{ secrets.LICENSE_ENCRYPTION_PASSWORD }}
90+
if: ${{ env.LICENSE_ENCRYPTION_PASSWORD != '' }}
91+
run: echo "::set-output name=defined::true"
92+
93+
acceptance-ce:
94+
timeout-minutes: 60
95+
runs-on: ubuntu-latest
96+
needs: [go-version]
97+
steps:
98+
- uses: actions/setup-go@v2
99+
with:
100+
go-version: ${{ needs.go-version.outputs.go-version }}
101+
- uses: actions/checkout@v2
102+
# Cache the Go modules.
103+
- uses: actions/cache@v2
104+
with:
105+
path: ~/go/pkg/mod
106+
key: ${{ github.job }}-${{ runner.os }}-go${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum', 'GNUMakefile') }}
107+
- run: make testacc-up
108+
- run: make testacc
109+
110+
acceptance-ee:
111+
# Only run EE tests if the LICENSE_ENCRYPTION_PASSWORD secret exists, so that the workflow
112+
# doesn't fail when code is pushed to a fork.
113+
if: ${{ needs.license-encryption-password.outputs.defined }}
114+
timeout-minutes: 60
115+
runs-on: ubuntu-latest
116+
needs: [go-version, license-encryption-password]
117+
steps:
118+
- uses: actions/setup-go@v2
119+
with:
120+
go-version: ${{ needs.go-version.outputs.go-version }}
121+
- uses: actions/checkout@v2
122+
# Cache the Go modules.
123+
- uses: actions/cache@v2
124+
with:
125+
path: ~/go/pkg/mod
126+
key: ${{ github.job }}-${{ runner.os }}-go${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum', 'GNUMakefile') }}
127+
- name: Decrypt license
128+
run: |
129+
openssl version
130+
openssl enc -d -aes-256-cbc -pbkdf2 -iter 20000 -in Gitlab-license.encrypted -out Gitlab-license.txt -pass "pass:${{ secrets.LICENSE_ENCRYPTION_PASSWORD }}"
131+
# Note we specifically launch the gitlab-ee service.
132+
- run: make testacc-up SERVICE=gitlab-ee
133+
- run: make testacc

‎.github/workflows/release.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ jobs:
2121
go-version: ${{ steps.go-version.outputs.go-version }}
2222
steps:
2323
- uses: actions/checkout@v2
24+
# Read the .go-version file and output it for other jobs to use.
2425
- id: go-version
2526
run: echo "::set-output name=go-version::$(cat .go-version)"
2627

0 commit comments

Comments
 (0)