Skip to content

Commit 8877ff9

Browse files
ciarams87ciarams87
committed
Swap workflow files to enable self-hosted runner testing
- Rename ci.yml to ci-temp.yml (preserve original CI workflow) - Rename test-secure-build.yml to ci.yml (enable self-hosted runner access) - This allows testing production conditions on ubuntu-22.04-amd64 runners - Temporary change to validate secure build pipeline implementation
1 parent f0cc31d commit 8877ff9

File tree

3 files changed

+501
-489
lines changed

3 files changed

+501
-489
lines changed

‎.github/workflows/ci-temp.yml‎

Lines changed: 345 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,345 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- release-*
8+
tags:
9+
- "v[0-9]+.[0-9]+.[0-9]+*"
10+
pull_request:
11+
branches:
12+
- "**"
13+
schedule:
14+
- cron: "0 4 * * *" # run every day at 4am UTC
15+
16+
defaults:
17+
run:
18+
shell: bash
19+
20+
env:
21+
GOPROXY: ${{ github.repository_owner == 'nginx' && ((github.event_name == 'push' && github.ref == 'refs/heads/main') || github.ref_type == 'tag') && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-local-approved-dependency', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) || github.repository_owner == 'nginx' && format('https://{0}:{1}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-dev', secrets.ARTIFACTORY_USER, secrets.ARTIFACTORY_TOKEN) || 'direct' }}
22+
23+
concurrency:
24+
group: ${{ github.ref_name }}-ci
25+
cancel-in-progress: true
26+
27+
permissions:
28+
contents: read
29+
30+
jobs:
31+
vars:
32+
name: Checks and variables
33+
runs-on: ubuntu-24.04
34+
outputs:
35+
go_path: ${{ steps.vars.outputs.go_path }}
36+
min_k8s_version: ${{ steps.vars.outputs.min_k8s_version }}
37+
k8s_latest: ${{ steps.vars.outputs.k8s_latest }}
38+
helm_changes: ${{ steps.filter.outputs.charts }}
39+
steps:
40+
- name: Checkout Repository
41+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
42+
with:
43+
fetch-depth: 0
44+
token: ${{ github.actor == 'renovate[bot]' && secrets.NGINX_PAT || github.token }}
45+
46+
- name: Setup Golang Environment
47+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
48+
with:
49+
go-version: stable
50+
cache-dependency-path: |
51+
go.sum
52+
.github/.cache/buster-for-vars
53+
54+
- name: Check for changes
55+
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
56+
id: filter
57+
with:
58+
filters: |
59+
charts:
60+
- charts/nginx-gateway-fabric/**/*
61+
62+
- name: Output Variables
63+
id: vars
64+
run: |
65+
K8S_KIND_VERSION=v1.33.2 # renovate: datasource=docker depName=kindest/node
66+
echo "go_path=$(go env GOPATH)" >> $GITHUB_OUTPUT
67+
echo "min_k8s_version=v1.25.16" >> $GITHUB_OUTPUT
68+
echo "k8s_latest=${K8S_KIND_VERSION}" >> $GITHUB_OUTPUT
69+
70+
- name: Check if go.mod and go.sum are up to date
71+
run: go mod tidy && git diff --exit-code -- go.mod go.sum
72+
73+
- name: Check if go.mod and go.sum are up to date in tests
74+
run: go mod tidy && git diff --exit-code -- go.mod go.sum
75+
working-directory: tests
76+
77+
- name: Check if all the generated files are up to date
78+
run: make generate-all && git diff --exit-code
79+
80+
unit-tests:
81+
name: Unit Tests
82+
runs-on: ubuntu-24.04
83+
needs: vars
84+
steps:
85+
- name: Checkout Repository
86+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
87+
88+
- name: Setup Golang Environment
89+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
90+
with:
91+
go-version: stable
92+
cache-dependency-path: |
93+
go.sum
94+
.github/.cache/buster-for-unit-tests
95+
96+
- name: Run Tests
97+
run: make unit-test
98+
99+
- name: Upload coverage reports to Codecov
100+
uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
101+
with:
102+
token: ${{ secrets.CODECOV_TOKEN }}
103+
104+
- name: Upload Coverage Report
105+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
106+
with:
107+
name: cover-${{ github.run_id }}.html
108+
path: ${{ github.workspace }}/cover.html
109+
if: always()
110+
111+
njs-unit-tests:
112+
name: NJS Unit Tests
113+
runs-on: ubuntu-24.04
114+
needs: vars
115+
steps:
116+
- name: Checkout Repository
117+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
118+
119+
- name: Setup Node.js Environment
120+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
121+
with:
122+
node-version-file: .nvmrc
123+
124+
- name: Run tests
125+
run: npm --prefix ${{ github.workspace }}/internal/controller/nginx/modules install-ci-test
126+
127+
- name: Upload coverage reports to Codecov
128+
uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
129+
with:
130+
token: ${{ secrets.CODECOV_TOKEN }}
131+
132+
binary:
133+
name: Build Binary
134+
runs-on: ${{ github.repository_owner == 'nginx' && (github.ref_type == 'tag' || (github.event_name == 'push' && github.ref == 'refs/heads/main')) && 'ubuntu-22.04-amd64' || 'ubuntu-24.04' }}
135+
needs: [vars, unit-tests, njs-unit-tests]
136+
permissions:
137+
contents: write # for goreleaser/goreleaser-action and lucacome/draft-release to create/update releases
138+
id-token: write # for goreleaser/goreleaser-action to sign artifacts
139+
issues: write # for goreleaser/goreleaser-action to close milestone
140+
steps:
141+
- name: Checkout Repository
142+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
143+
with:
144+
fetch-depth: 0
145+
146+
- name: Setup Golang Environment
147+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
148+
with:
149+
go-version: stable
150+
cache-dependency-path: |
151+
go.sum
152+
.github/.cache/buster-for-binary
153+
154+
- name: Create/Update Draft
155+
uses: lucacome/draft-release@00f74370c044c322da6cb52acc707d62c7762c71 # v1.2.4
156+
with:
157+
minor-label: "enhancement"
158+
major-label: "change"
159+
publish: ${{ github.ref_type == 'tag' }}
160+
collapse-after: 20
161+
notes-header: |
162+
*Below is the auto-generated changelog, which includes all PRs that went into the release.
163+
For a shorter version that highlights only important changes, see [CHANGELOG.md](https://github.com/nginx/nginx-gateway-fabric/blob/{{version}}/CHANGELOG.md).*
164+
if: ${{ github.event_name == 'push' && github.ref != 'refs/heads/main' }}
165+
166+
- name: Download Syft
167+
uses: anchore/sbom-action/download-syft@7b36ad622f042cab6f59a75c2ac24ccb256e9b45 # v0.20.4
168+
if: github.ref_type == 'tag'
169+
170+
- name: Install Cosign
171+
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
172+
if: github.ref_type == 'tag'
173+
174+
- name: Build binary
175+
uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
176+
with:
177+
version: v2.11.2 # renovate: datasource=github-tags depName=goreleaser/goreleaser
178+
args: ${{ github.ref_type == 'tag' && 'release' || 'build --snapshot' }} --clean
179+
env:
180+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
181+
GOPATH: ${{ needs.vars.outputs.go_path }}
182+
AZURE_STORAGE_ACCOUNT: ${{ secrets.AZURE_STORAGE_ACCOUNT }}
183+
AZURE_STORAGE_KEY: ${{ secrets.AZURE_STORAGE_KEY }}
184+
AZURE_BUCKET_NAME: ${{ secrets.AZURE_BUCKET_NAME }}
185+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_COMMUNITY }}
186+
TELEMETRY_ENDPOINT: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/heads/release-') && 'oss-dev.edge.df.f5.com:443' || 'oss.edge.df.f5.com:443' }}
187+
TELEMETRY_ENDPOINT_INSECURE: "false"
188+
189+
- name: Cache Artifacts
190+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
191+
with:
192+
path: ${{ github.workspace }}/dist
193+
key: nginx-gateway-fabric-${{ github.run_id }}-${{ github.run_number }}
194+
195+
build-oss:
196+
name: Build OSS images
197+
needs: [vars, binary]
198+
strategy:
199+
fail-fast: false
200+
matrix:
201+
image: [ngf, nginx]
202+
platforms: ["linux/arm64, linux/amd64"]
203+
uses: ./.github/workflows/build.yml
204+
with:
205+
image: ${{ matrix.image }}
206+
platforms: ${{ matrix.platforms }}
207+
permissions:
208+
contents: read # for docker/build-push-action to read repo content
209+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
210+
packages: write # for docker/build-push-action to push to GHCR
211+
id-token: write # for docker/login to login to NGINX registry
212+
secrets: inherit
213+
214+
build-plus:
215+
name: Build Plus images
216+
needs: [vars, binary]
217+
uses: ./.github/workflows/build.yml
218+
with:
219+
image: plus
220+
platforms: "linux/arm64, linux/amd64"
221+
permissions:
222+
contents: read # for docker/build-push-action to read repo content
223+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
224+
packages: write # for docker/build-push-action to push to GHCR
225+
id-token: write # for docker/login to login to NGINX registry
226+
secrets: inherit
227+
228+
functional-tests:
229+
name: Functional tests
230+
needs: [vars, build-oss, build-plus]
231+
strategy:
232+
fail-fast: false
233+
matrix:
234+
image: [nginx, plus]
235+
k8s-version:
236+
[
237+
"${{ needs.vars.outputs.min_k8s_version }}",
238+
"${{ needs.vars.outputs.k8s_latest }}",
239+
]
240+
uses: ./.github/workflows/functional.yml
241+
with:
242+
image: ${{ matrix.image }}
243+
k8s-version: ${{ matrix.k8s-version }}
244+
secrets: inherit
245+
permissions:
246+
contents: read
247+
248+
conformance-tests:
249+
name: Conformance tests
250+
needs: [vars, build-oss, build-plus]
251+
strategy:
252+
fail-fast: false
253+
matrix:
254+
image: [nginx, plus]
255+
k8s-version:
256+
[
257+
"${{ needs.vars.outputs.min_k8s_version }}",
258+
"${{ needs.vars.outputs.k8s_latest }}",
259+
]
260+
enable-experimental: [true, false]
261+
uses: ./.github/workflows/conformance.yml
262+
with:
263+
image: ${{ matrix.image }}
264+
k8s-version: ${{ matrix.k8s-version }}
265+
enable-experimental: ${{ matrix.enable-experimental }}
266+
secrets: inherit
267+
permissions:
268+
contents: write
269+
270+
helm-tests:
271+
name: Helm Tests
272+
needs: [vars, build-oss, build-plus]
273+
strategy:
274+
fail-fast: false
275+
matrix:
276+
image: [nginx, plus]
277+
k8s-version:
278+
[
279+
"${{ needs.vars.outputs.min_k8s_version }}",
280+
"${{ needs.vars.outputs.k8s_latest }}",
281+
]
282+
uses: ./.github/workflows/helm.yml
283+
with:
284+
image: ${{ matrix.image }}
285+
k8s-version: ${{ matrix.k8s-version }}
286+
secrets: inherit
287+
if: ${{ needs.vars.outputs.helm_changes == 'true' || github.event_name == 'schedule' }}
288+
289+
publish-helm:
290+
name: Package and Publish Helm Chart
291+
runs-on: ${{ github.repository_owner == 'nginx' && (github.ref_type == 'tag' || (github.event_name == 'push' && github.ref == 'refs/heads/main')) && 'ubuntu-22.04-amd64' || 'ubuntu-24.04' }}
292+
needs: [vars, helm-tests]
293+
if: ${{ github.event_name == 'push' && ! startsWith(github.ref, 'refs/heads/release-') }}
294+
permissions:
295+
contents: read
296+
packages: write # for helm to push to GHCR
297+
steps:
298+
- name: Checkout Repository
299+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
300+
301+
- name: Login to GitHub Container Registry
302+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
303+
with:
304+
registry: ghcr.io
305+
username: ${{ github.repository_owner }}
306+
password: ${{ secrets.GITHUB_TOKEN }}
307+
308+
- name: Package
309+
id: package
310+
run: |
311+
output=$(helm package ${{ github.ref_type != 'tag' && '--app-version edge --version 0.0.0-edge' || '' }} charts/nginx-gateway-fabric)
312+
echo "path=$(basename -- $(echo $output | cut -d: -f2))" >> $GITHUB_OUTPUT
313+
314+
- name: Push to GitHub Container Registry
315+
run: |
316+
helm push ${{ steps.package.outputs.path }} oci://ghcr.io/nginx/charts
317+
318+
cel-tests:
319+
name: CEL Tests
320+
runs-on: ubuntu-24.04
321+
needs: vars
322+
steps:
323+
- name: Checkout Repository
324+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
325+
326+
- name: Setup Golang Environment
327+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
328+
with:
329+
go-version: stable
330+
cache-dependency-path: |
331+
go.sum
332+
.github/.cache/buster-for-unit-tests
333+
334+
- name: Deploy Kubernetes
335+
id: k8s
336+
run: |
337+
kind create cluster --name ${{ github.run_id }} --image=kindest/node:${{ needs.vars.outputs.k8s_latest }}
338+
339+
- name: Apply CustomResourceDefinition
340+
run: |
341+
kubectl kustomize config/crd | kubectl apply --server-side -f -
342+
343+
- name: Run Tests
344+
run: make test-cel-validation
345+
working-directory: ./tests

0 commit comments

Comments
 (0)