Skip to content

Commit 2646b8e

Browse files
komishkomish
authored
Refactor workflows to add reusable functional testing and clear token scopes (#538)
Signed-off-by: Jose R. Gonzalez <[email protected]>
1 parent 3d80f47 commit 2646b8e

File tree

5 files changed

+355
-197
lines changed

5 files changed

+355
-197
lines changed

‎.github/workflows/build.yaml‎

Lines changed: 6 additions & 197 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,31 @@
1-
name: Build, Test, Automerge and Tag
2-
3-
# This workflow runs on all PRs that are targetting the main branch.
4-
#
5-
# It runs the test suite. If the PR is a release PR, it automerges and tags the main branch with
6-
# the corresonding new version.
7-
1+
name: Unit Tests
82
on:
9-
pull_request_target:
3+
pull_request:
104
types: [opened, synchronize, reopened]
115
branches: [ main ]
126

137
jobs:
14-
build-test-release:
15-
name: Build artifacts
8+
unit-tests:
9+
name: Unit Tests
1610
runs-on: ubuntu-latest
1711

1812
steps:
19-
- name: Checkout main branch
20-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
21-
with:
22-
persist-credentials: false
23-
24-
- name: Checkout PR branch
13+
- name: Checkout changes
2514
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2615
with:
27-
ref: ${{ github.event.pull_request.head.ref }}
28-
repository: ${{ github.event.pull_request.head.repo.full_name }}
29-
path: "chart-verifier"
3016
persist-credentials: false
31-
3217
- name: Setup Go
3318
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
3419
with:
35-
go-version-file: ./chart-verifier/go.mod
20+
go-version-file: go.mod
3621

3722
- name: Ensure Modules
38-
working-directory: ./chart-verifier
3923
run: make tidy
4024

4125
- name: Build Binary
42-
working-directory: ./chart-verifier
4326
run: make bin
4427

4528
- name: Run tests
46-
working-directory: ./chart-verifier
4729
run: |
4830
# Run go tests
4931
make test
@@ -52,176 +34,3 @@ jobs:
5234
echo "go test - errors running go tests : $(git status -s)"
5335
exit 1
5436
fi
55-
56-
- name: Set up Python 3.x
57-
uses: ./.github/actions/setup-python
58-
59-
- name: Set up Python scripts on PR branch
60-
working-directory: ./chart-verifier
61-
run: |
62-
# set up python requirements and scripts on PR branch
63-
python3 -m venv ve1
64-
cd scripts && ../ve1/bin/pip3 install -r requirements.txt && cd ..
65-
cd scripts && ../ve1/bin/pip3 install . && cd ..
66-
67-
- name: Check if only release file in PR
68-
working-directory: ./chart-verifier
69-
id: check_version_in_PR
70-
env:
71-
API_URL: ${{ github.event.pull_request._links.self.href }}
72-
run: |
73-
# check if release file only is included in PR
74-
ve1/bin/release-checker --api-url="${API_URL}"
75-
76-
- name: Get Date
77-
id: get-date
78-
run: |
79-
echo "date=$(/bin/date -u "+%Y%m%d")" | tee -a $GITHUB_OUTPUT
80-
shell: bash
81-
82-
- uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
83-
id: cache
84-
with:
85-
path: ./chart-verifier/oc
86-
key: ${{ steps.get-date.outputs.date }}
87-
88-
- name: Install oc
89-
working-directory: ./chart-verifier
90-
id: install-oc
91-
run: |
92-
# install oc
93-
curl -sLO https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable/openshift-client-linux.tar.gz
94-
tar zxvf openshift-client-linux.tar.gz -C /usr/local/bin/
95-
which oc
96-
oc version --client=true
97-
98-
- name: Build podman Image
99-
working-directory: ./chart-verifier
100-
id: build_podman_image
101-
run: |
102-
# build a podman image
103-
image_tag="test"
104-
echo "Building container image using podman for the tests, tagging as ${image_tag}"
105-
make build-image "IMAGE_TAG=${image_tag}"
106-
podman build -t "quay.io/redhat-certification/chart-verifier:${image_tag}" .
107-
echo "podman_image_tag=${image_tag}" | tee -a $GITHUB_OUTPUT
108-
109-
- name: Create tarfile
110-
id: create-tarfile
111-
working-directory: ./chart-verifier
112-
run: |
113-
# create test tarball for the tests
114-
ve1/bin/tar-file --release="test"
115-
116-
- name: Login to oc
117-
working-directory: ./chart-verifier
118-
env:
119-
KUBECONFIG: /tmp/ci-kubeconfig
120-
EVENT_NUMBER: ${{ github.event.number }}
121-
run: |
122-
# oc login
123-
API_SERVER=$( echo -n ${{ secrets.API_SERVER }} | base64 -d)
124-
gpg --version
125-
curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
126-
if [ $GITHUB_REPOSITORY == "redhat-certification/chart-verifier" ]; then
127-
# TODO: temporarily allow for skipping TLS verification as the new cluster uses local-only certificates
128-
# This if logic isn't removed to remind us to come back and swap this out when a valid cert is put in place.
129-
oc login --insecure-skip-tls-verify --token="${{ secrets.CLUSTER_TOKEN }}" --server="${API_SERVER}"
130-
else
131-
oc login --insecure-skip-tls-verify --token="${{ secrets.CLUSTER_TOKEN }}" --server="${API_SERVER}"
132-
fi
133-
ve1/bin/sa-for-chart-testing --create "charts-${EVENT_NUMBER}" --token token.txt --server "${API_SERVER}"
134-
135-
- name: Run the tests
136-
working-directory: ./chart-verifier
137-
env:
138-
KUBECONFIG: /tmp/ci-kubeconfig
139-
VERIFIER_TARBALL_NAME : ${{ steps.create-tarfile.outputs.tarball_full_name }}
140-
PODMAN_IMAGE_TAG : ${{ steps.build_podman_image.outputs.podman_image_tag }}
141-
id: run_test
142-
run: |
143-
# run pytest
144-
ve1/bin/pytest -v --log-cli-level=WARNING --tb=short
145-
146-
- name: Delete Namespace
147-
if: ${{ always() && steps.install-oc.conclusion == 'success' }}
148-
working-directory: ./chart-verifier
149-
env:
150-
KUBECONFIG: /tmp/ci-kubeconfig
151-
EVENT_NUMBER: ${{ github.event.number }}
152-
run: |
153-
# delete the namespace
154-
API_SERVER=$( echo -n ${{ secrets.API_SERVER }} | base64 -d)
155-
oc login --token="${{ secrets.CLUSTER_TOKEN }}" --server="${API_SERVER}"
156-
ve1/bin/sa-for-chart-testing --delete "charts-${EVENT_NUMBER}"
157-
158-
- name: Set up Python scripts on main branch
159-
run: |
160-
# set up python requirements and scripts on main branch
161-
echo $(pwd)
162-
python3 -m venv ve1
163-
cd scripts && ../ve1/bin/pip3 install -r requirements.txt && cd ..
164-
cd scripts && ../ve1/bin/pip3 install . && cd ..
165-
166-
- name: Check for restricted files and user permissiom
167-
id: check_authorization
168-
env:
169-
API_URL: ${{ github.event.pull_request._links.self.href }}
170-
API_USER: ${{ github.event.pull_request.user.login }}
171-
run: |
172-
# check for a restricted file and, if found, check user has permissiom
173-
ve1/bin/check-user --api-url="${API_URL}" --user="${API_USER}"
174-
175-
- name: Check if version updated
176-
id: check_version_updated
177-
if: ${{ steps.check_version_in_PR.outputs.PR_includes_release == 'true' }}
178-
env:
179-
PR_VERSION: ${{ steps.check_version_in_PR.outputs.PR_version }}
180-
run: |
181-
# check if version file was changed
182-
ve1/bin/release-checker --version="${PR_VERSION}"
183-
184-
# TODO: Investigate if it's possible to do this using the `gh` CLI tool instead of
185-
# relying on a third-party action.
186-
- name: Approve PR
187-
id: approve_pr
188-
if: ${{ steps.check_version_updated.outputs.updated == 'true'}}
189-
uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0
190-
with:
191-
github-token: ${{ secrets.GITHUB_TOKEN }}
192-
193-
# TODO: Investigate if it's possible to do this using the `gh` CLI tool instead of
194-
# relying on a third-party action.
195-
- name: Merge PR
196-
id: merge_pr
197-
if: ${{ steps.check_version_updated.outputs.updated == 'true'}}
198-
uses: pascalgn/automerge-action@7961b8b5eec56cc088c140b56d864285eabd3f67 # v0.16.4
199-
env:
200-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
201-
MERGE_METHOD: squash
202-
MERGE_LABELS: ""
203-
204-
- name: Get main branch sha
205-
id: main_sha
206-
if: ${{ steps.check_version_updated.outputs.updated == 'true'}}
207-
run: |
208-
git fetch
209-
export ORIGIN_MAIN_SHA=$(git rev-parse origin/main)
210-
echo "origin_main_sha=$ORIGIN_MAIN_SHA" | tee -a $GITHUB_OUTPUT
211-
212-
# TODO: Investigate if it's possible to do this using the `gh` CLI tool instead of
213-
# relying on a third-party action.
214-
- name: Create release tag
215-
id: create_release_tag
216-
if: ${{ steps.check_version_updated.outputs.updated == 'true'}}
217-
uses: mathieudutour/github-tag-action@a22cf08638b34d5badda920f9daf6e72c477b07b # v6.2
218-
with:
219-
# It is necessary to use a Personal Access Token here rather than the usual GITHUB_TOKEN, as this
220-
# step should trigger the release.yaml workflow, and events (such as tags) triggered by the
221-
# GITHUB_TOKEN cannot create a new workflow run. See:
222-
# https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow
223-
# This Personal Access Token belongs to the openshift-helm-charts-bot account.
224-
github_token: ${{ secrets.GH_HELM_BOT_TOKEN }}
225-
custom_tag: ${{ steps.check_version_in_PR.outputs.PR_version }}
226-
tag_prefix: ""
227-
commit_sha: ${{ steps.main_sha.outputs.origin_main_sha }}

‎.github/workflows/dev_release.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,13 @@ on:
1313
- main
1414
env:
1515
DEV_RELEASE: 0.1.0
16+
1617
jobs:
1718
release:
1819
name: Create Dev Release
1920
runs-on: ubuntu-latest
21+
permissions:
22+
contents: write
2023
steps:
2124
- name: Checkout code
2225
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

‎.github/workflows/functional-tests.yaml‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
name: Run Functional Tests
2+
3+
# Runs functional testing against the specified checkout-ref.
4+
# Note that this workflow runs and installs software from the checkout-ref,
5+
# and so untrusted content should be verified as safe to install
6+
7+
on:
8+
workflow_call:
9+
inputs:
10+
event-identifier:
11+
type: string
12+
required: true
13+
description: |
14+
Used to generate a working environment unique to this identifier.
15+
Common use case would be a pull request number
16+
(e.g. github.event.pull_request.number, etc.)
17+
checkout-repository:
18+
type: string
19+
required: false
20+
default: ""
21+
description: |
22+
repository flag to actions/checkout.
23+
24+
If setting to a pull request, caller is responsible
25+
for verifying the user is a trusted user.
26+
checkout-ref:
27+
type: string
28+
required: false
29+
default: ""
30+
description: |
31+
ref flag to actions/checkout
32+
33+
If setting to a pull request, caller is responsible
34+
for verifying the user is a trusted user.
35+
36+
For security, this checkout-ref should generally be a commit hash
37+
for untrusted content.
38+
jobs:
39+
run-functional-tests:
40+
runs-on: ubuntu-latest
41+
steps:
42+
- name: Checkout PR branch
43+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
44+
with:
45+
ref: ${{ inputs.checkout-ref }}
46+
repository: ${{ inputs.checkout-repository }}
47+
persist-credentials: false
48+
49+
- name: Set up Python 3.x
50+
uses: ./.github/actions/setup-python
51+
52+
- name: Set up Python scripts on PR branch
53+
run: |
54+
# set up python requirements and scripts on PR branch
55+
python3 -m venv ve1
56+
cd scripts && ../ve1/bin/pip3 install -r requirements.txt && cd ..
57+
cd scripts && ../ve1/bin/pip3 install . && cd ..
58+
59+
- name: Get Date
60+
id: get-date
61+
run: |
62+
echo "date=$(/bin/date -u "+%Y%m%d")" | tee -a $GITHUB_OUTPUT
63+
shell: bash
64+
65+
- uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
66+
id: cache-oc
67+
with:
68+
path: /usr/local/bin/oc
69+
key: "oc-${{ steps.get-date.outputs.date }}"
70+
71+
- name: Install oc
72+
id: install-oc
73+
if: steps.cache-oc.outputs.cache-hit != 'true'
74+
run: |
75+
# install oc
76+
curl -sLO https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable/openshift-client-linux.tar.gz
77+
tar zxvf openshift-client-linux.tar.gz -C /usr/local/bin/
78+
which oc
79+
oc version --client=true
80+
rm openshift-client-linux.tar.gz
81+
82+
- name: Build podman Image
83+
id: build_podman_image
84+
run: |
85+
# build a podman image
86+
image_tag="test"
87+
echo "Building container image using podman for the tests, tagging as ${image_tag}"
88+
make build-image "IMAGE_TAG=${image_tag}"
89+
podman build -t "quay.io/redhat-certification/chart-verifier:${image_tag}" .
90+
echo "podman_image_tag=${image_tag}" | tee -a $GITHUB_OUTPUT
91+
92+
- name: Create tarfile
93+
id: create-tarfile
94+
run: |
95+
# create test tarball for the tests
96+
ve1/bin/tar-file --release="test"
97+
98+
- name: Login to oc
99+
env:
100+
KUBECONFIG: /tmp/ci-kubeconfig
101+
EVENT_NUMBER: ${{ inputs.event-identifier }}
102+
run: |
103+
# oc login
104+
API_SERVER=$( echo -n ${{ secrets.API_SERVER }} | base64 -d)
105+
gpg --version
106+
curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
107+
if [ $GITHUB_REPOSITORY == "redhat-certification/chart-verifier" ]; then
108+
# TODO: temporarily allow for skipping TLS verification as the new cluster uses local-only certificates
109+
# This if logic isn't removed to remind us to come back and swap this out when a valid cert is put in place.
110+
oc login --insecure-skip-tls-verify --token="${{ secrets.CLUSTER_TOKEN }}" --server="${API_SERVER}"
111+
else
112+
oc login --insecure-skip-tls-verify --token="${{ secrets.CLUSTER_TOKEN }}" --server="${API_SERVER}"
113+
fi
114+
ve1/bin/sa-for-chart-testing --create "charts-${EVENT_NUMBER}" --token token.txt --server "${API_SERVER}"
115+
116+
- name: Run the tests
117+
env:
118+
KUBECONFIG: /tmp/ci-kubeconfig
119+
VERIFIER_TARBALL_NAME: ${{ steps.create-tarfile.outputs.tarball_full_name }}
120+
PODMAN_IMAGE_TAG: ${{ steps.build_podman_image.outputs.podman_image_tag }}
121+
id: run_test
122+
run: |
123+
# run pytest
124+
ve1/bin/pytest -v --log-cli-level=WARNING --tb=short
125+
126+
- name: Delete Namespace
127+
if: ${{ always() && steps.install-oc.conclusion == 'success' }}
128+
env:
129+
KUBECONFIG: /tmp/ci-kubeconfig
130+
EVENT_NUMBER: ${{ inputs.event-identifier }}
131+
run: |
132+
# delete the namespace
133+
API_SERVER=$( echo -n ${{ secrets.API_SERVER }} | base64 -d)
134+
oc login --token="${{ secrets.CLUSTER_TOKEN }}" --server="${API_SERVER}"
135+
ve1/bin/sa-for-chart-testing --delete "charts-${EVENT_NUMBER}"

0 commit comments

Comments
 (0)