e2e.yml

name: e2e test

on:
  workflow_call:
    inputs:
      skip-undeploy:
        description: "Skip undeploy"
        type: boolean
      test-name:
        description: "Test Name"
        type: string
      platform:
        description: "Platform"
        type: string
      runner:
        description: "Runner"
        type: string
      self-hosted:
        description: "Self Hosted"
        type: boolean
      debug-shell:
        description: "Debug shell"
        type: boolean
    secrets:
      GITHUB_TOKEN_IN:
        required: true
      CACHIX_AUTH_TOKEN:
        required: true
      NUNKI_CI_COMMIT_PUSH_PR:
        required: true
      TEAMS_CI_WEBHOOK:
        required: true
      CONTRAST_GHCR_READ:
        required: true

env:
  container_registry: ghcr.io/edgelesssys
  DO_NOT_TRACK: 1

jobs:
  nix-build:
    uses: ./.github/workflows/nix_build.yml
    secrets:
      GITHUB_TOKEN_IN: ${{ secrets.GITHUB_TOKEN_IN }}
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}

  test:
    name: "${{ inputs.test-name }}${{ inputs.debug-shell && ' (with debug shell)' || '' }}"
    runs-on: ${{ inputs.runner }}
    needs: nix-build
    permissions:
      contents: read
      packages: write
    env:
      PLATFORM: ${{ inputs.platform }}
      NODE_INSTALLER_TARGET_CONF_TYPE: ${{ inputs.platform == 'Metal-QEMU-SNP' && 'none' || 'k3s' }}
      TEST_NAME: ${{ inputs.test-name }}
      CONTRAST_GHCR_READ: ${{ secrets.CONTRAST_GHCR_READ }}
      DEBUG_SHELL: ${{ inputs.debug-shell }}
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup_nix
        if: (!inputs.self-hosted)
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN_IN || secrets.GITHUB_TOKEN }}
          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1.2.1
      - name: Log in to ghcr.io Container registry
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN_IN || secrets.GITHUB_TOKEN }}
      - name: Create justfile.env
        run: |
          cat <<EOF > justfile.env
          container_registry=${{ env.container_registry }}
          default_platform=${PLATFORM}
          EOF
      - name: Build and push container images
        run: |
          just coordinator initializer port-forwarder openssl service-mesh-proxy memdump debugshell node-installer "${PLATFORM}"
      - name: Build and push the (impure) containerd-reproducer image
        if: env.TEST_NAME == 'containerd-11644-reproducer'
        run: |
          just containerd-reproducer
      - name: Get credentials for CI cluster
        if: (!inputs.self-hosted)
        run: |
          just get-credentials
      - name: Request fifo ticket
        if: (!inputs.self-hosted || inputs.platform == 'Metal-QEMU-SNP-GPU')
        run: |
          just request-fifo-ticket
      - name: E2E Test
        run: |
          nix build .#scripts.get-logs
          nix run .#scripts.get-logs start workspace/e2e.namespace &
          nix shell -L .#contrast.e2e --command "${TEST_NAME}.test" -test.v \
            --image-replacements workspace/just.containerlookup \
            --namespace-file workspace/e2e.namespace \
            --platform "${PLATFORM}" \
            --node-installer-target-conf-type "${NODE_INSTALLER_TARGET_CONF_TYPE}" \
            --namespace-suffix="-ci" \
            --sync-ticket-file workspace/just.sync-ticket \
            --insecure-enable-debug-shell-access="${DEBUG_SHELL}"
      - name: Download logs
        if: always()
        run: |
          nix run .#scripts.get-logs download workspace/e2e.namespace
      - name: Upload logs
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: e2e_pod_logs-${{ inputs.platform }}-${{ inputs.test-name }}${{ inputs.debug-shell && '-debug-shell' || '' }}
          path: workspace/logs/export-no-stream/logs
      - name: Notify teams channel of failure
        if: failure() && github.event_name == 'schedule' && github.run_attempt == 1
        uses: ./.github/actions/post_to_teams
        with:
          webhook: ${{ secrets.TEAMS_CI_WEBHOOK }}
          title: "${{ inputs.test-name }} failed"
          message: "e2e test ${{ inputs.test-name }} failed"
          additionalFields: '[{"title": "Platform", "value": "${{ inputs.platform }}"},{"title": "Job ID", "value": "${{ github.job }}"}]'
      - name: Cleanup
        if: always() && !inputs.skip-undeploy
        run: |
          # Check if namespace file exists and is not empty
          if [[ ! -f workspace/e2e.namespace ]]; then
            echo "No namespace file found, skipping cleanup." >&2
            exit 0
          fi
          kubectl delete ns "$(cat workspace/e2e.namespace)" --timeout 10m
      - name: Release fifo ticket
        if: always() && (!inputs.self-hosted || inputs.platform == 'Metal-QEMU-SNP-GPU') && !inputs.skip-undeploy
        run: |
          just release-fifo-ticket