test-e2e-kbs.yml

name: KBS e2e Suite

on:
  pull_request:
    branches: ["main"]
    paths-ignore:
      - '**/*.md'
  workflow_dispatch:

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  # Common checkout + source archive for all e2e jobs
  code-checkout:
    name: KBS - checkout & archive
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write  # upload source archive as workflow artifact
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Archive source
        run: git archive -o kbs.tar.gz HEAD

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: kbs-source
          path: ./kbs.tar.gz

  # Sample TEE e2e (reuses kbs-e2e template)
  sample-e2e-amd64:
    name: Sample TEE e2e (amd64)
    needs: code-checkout
    uses: ./.github/workflows/workflow-call-kbs-e2e.yml
    permissions:
      contents: read
      packages: write  # push e2e test images to GHCR
    with:
      tee: sample
      tarball: kbs.tar.gz

  sample-e2e-arm64:
    name: Sample TEE e2e (arm64)
    needs: code-checkout
    uses: ./.github/workflows/workflow-call-kbs-e2e.yml
    permissions:
      contents: read
      packages: write  # push e2e test images to GHCR
    with:
      tee: sample
      arch: aarch64
      runs-on-build: '["ubuntu-22.04-arm"]'
      runs-on-test: '["ubuntu-22.04-arm"]'
      tarball: kbs.tar.gz
      kbs-client-features: "cca-attester"

  # Vault integration e2e
  vault-e2e-test:
    name: Vault e2e
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    env:
      OS_VERSION: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      
      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
        with:
          rustflags: ""
          cache: false

      - name: Set up rust build cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        continue-on-error: false
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            target/
          key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }}

      - name: Run KBS Vault integration e2e (no SSL + SSL)
        run: make test-kbs-vault-e2e

  # Docker Compose/Helm e2e materials (shared via workflow artifacts)
  build-docker-e2e-materials:
    name: Build Docker/Helm e2e materials
    uses: ./.github/workflows/workflow-call-build-docker-e2e-materials.yml
    permissions:
      contents: read

  # Docker Compose cluster e2e
  docker-e2e-test:
    name: Docker Compose e2e
    needs: build-docker-e2e-materials
    strategy:
      matrix:
        instance:
          - ubuntu-24.04
          - ubuntu-24.04-arm
        include:
          - instance: ubuntu-24.04
            platform_slug: linux-amd64
          - instance: ubuntu-24.04-arm
            platform_slug: linux-arm64
    runs-on: ${{ matrix.instance }}
    permissions:
      contents: read
    env:
       OS_VERSION: ${{ matrix.instance }}
    steps:
      - name: Checkout KBS
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Download pre-built images
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: docker-e2e-images-${{ matrix.platform_slug }}
          path: ${{ runner.temp }}/docker-e2e-images

      - name: Load images
        run: docker load --input "${RUNNER_TEMP}/docker-e2e-images/images.tar"

      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
        with:
          rustflags: ""
          cache: false

      - name: Set up rust build cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        continue-on-error: false
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            target/
          key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }}

      - name: Run KBS Docker Compose e2e
        env:
          SKIP_DOCKER_COMPOSE_BUILD: "1"
        run: make test-kbs-docker-e2e

  # External plugin e2e
  ext-plugin-e2e-test:
    name: External Plugin e2e
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    env:
      OS_VERSION: ubuntu-24.04
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: Install Rust toolchain
      uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
      with:
        rustflags: ""
        cache: false

    - name: Set up rust build cache
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      continue-on-error: false
      with:
        path: |
          ~/.cargo/registry/index/
          ~/.cargo/registry/cache/
          target/
        key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }}

    - name: Install build dependencies
      run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libprotobuf-dev libtss2-dev

    - name: Install TDX build dependencies
      run: |
        curl -L https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo gpg --dearmor --output /usr/share/keyrings/intel-sgx.gpg
        echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx.gpg] https://download.01.org/intel-sgx/sgx_repo/ubuntu noble main' | sudo tee /etc/apt/sources.list.d/intel-sgx.list
        sudo apt-get update
        sudo apt-get install -y libsgx-dcap-quote-verify-dev

    - name: Run external plugin unit tests
      working-directory: kbs
      run: make check TEST_FEATURES="external-plugin"

    - name: Install e2e test dependencies
      working-directory: kbs/test
      run: make install-dev-dependencies

    - name: Run external plugin e2e tests
      working-directory: kbs/test
      run: make e2e-ext-plugin

  # Sample TEE Helm e2e on a GitHub-hosted runner (always runs).
  helm-trustee-e2e-amd64-sample:
    name: Helm Trustee e2e (amd64 sample tee)
    needs: build-docker-e2e-materials
    uses: ./.github/workflows/workflow-call-helm-e2e.yml
    permissions:
      contents: read
    with:
      leg: sample
      runs-on: '["ubuntu-24.04"]'
      client-artifact: helm-e2e-kbs-client-linux-amd64
      self-hosted: false