e2e.yml

name: e2e test

on:
  workflow_call:
    inputs:
      skip-undeploy:
        description: "Skip undeploy"
        type: boolean
      test-name:
        description: "Test Name"
        type: string
      platform:
        description: "Platform"
        type: string
      runner:
        description: "Runner"
        type: string
      self-hosted:
        description: "Self Hosted"
        type: boolean
      debug-shell:
        description: "Debug shell"
        type: boolean
    secrets:
      GITHUB_TOKEN_IN:
        required: true
      CACHIX_AUTH_TOKEN:
        required: true
      NUNKI_CI_COMMIT_PUSH_PR:
        required: true
      TEAMS_CI_WEBHOOK:
        required: true
      CONTRAST_GHCR_READ:
        required: true

env:
  container_registry: ghcr.io/edgelesssys
  DO_NOT_TRACK: 1

jobs:
  test:
    name: "${{ inputs.test-name }}${{ inputs.debug-shell && ' (with debug shell)' || '' }}"
    runs-on: ${{ inputs.runner }}
    permissions:
      contents: read
      packages: write
    env:
      PLATFORM: ${{ inputs.platform }}
      # TODO(katexochen): switch this to host specific configuration in dev-docs/e2e/<hostname>.
      NODE_INSTALLER_TARGET_CONF_TYPE: ${{ (inputs.platform == 'Metal-QEMU-SNP' || inputs.platform == 'Metal-QEMU-TDX-GPU') && 'none' || 'k3s' }}
      TEST_NAME: ${{ inputs.test-name }}
      CONTRAST_GHCR_READ: ${{ secrets.CONTRAST_GHCR_READ }}
      DEBUG_SHELL: ${{ inputs.debug-shell }}
      SET: >-
        ${{
          (inputs.test-name == 'badaml-sandbox' && 'badaml-sandbox') ||
          (inputs.test-name == 'badaml-vuln' && 'badaml-vuln') ||
          (inputs.test-name == 'runtime-rs-tmp' && 'runtime-rs') ||
          'base'
        }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup_nix
        if: (!inputs.self-hosted)
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN_IN || secrets.GITHUB_TOKEN }}
          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1.2.1
      - name: Log in to ghcr.io Container registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN_IN || secrets.GITHUB_TOKEN }}
      - name: Create justfile.env
        run: |
          cat <<EOF > justfile.env
          container_registry=${{ env.container_registry }}
          default_platform=${PLATFORM}
          node_installer_target_conf_type=${NODE_INSTALLER_TARGET_CONF_TYPE}
          debug=${DEBUG_SHELL}
          namespace_suffix="-ci"
          set="${SET}"
          EOF
      - name: Build and push container images
        run: |
          just coordinator initializer port-forwarder openssl service-mesh-proxy memdump debugshell node-installer
      - name: Build and push the (impure) containerd-reproducer image
        if: env.TEST_NAME == 'containerd-11644-reproducer'
        run: |
          just containerd-reproducer
      - name: Get credentials for CI cluster
        if: (!inputs.self-hosted)
        run: |
          just get-credentials
      - name: E2E Test
        run: |
          nix build ".#${SET}.scripts.get-logs"
          nix run ".#${SET}.scripts.get-logs" start workspace/just.namespace &
          just e2e "${TEST_NAME}"
      - name: Check for skipped
        id: skipped
        if: always()
        run: |
          if [[ -f workspace/just.namespace ]]; then
            echo "skipped=false" >> "$GITHUB_OUTPUT"
          else
            echo "skipped=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Download logs
        if: always() && steps.skipped.outputs.skipped == 'false'
        run: |
          nix run ".#${SET}.scripts.get-logs" download workspace/just.namespace
      - name: Upload logs
        if: always() && steps.skipped.outputs.skipped == 'false'
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: e2e_pod_logs-${{ inputs.platform }}-${{ inputs.test-name }}${{ inputs.debug-shell && '-debug-shell' || '' }}
          path: workspace/logs
          if-no-files-found: error
      - name: Notify teams channel of failure
        if: failure() && github.event_name == 'schedule' && github.run_attempt == 1
        uses: ./.github/actions/post_to_teams
        with:
          webhook: ${{ secrets.TEAMS_CI_WEBHOOK }}
          title: "${{ inputs.test-name }} failed"
          message: "e2e test ${{ inputs.test-name }} failed"
          additionalFields: '[{"title": "Platform", "value": "${{ inputs.platform }}"},{"title": "Job ID", "value": "${{ github.job }}"}]'
      - name: Cleanup
        if: always() && !inputs.skip-undeploy
        run: |
          just undeploy