integration.yaml

name: Integration Tests

on:
  push:
    paths-ignore:
      - 'docs/**'
    branches:
      - main
      - autoupdate/strict
      - autoupdate/moonray
      - 'release-[0-9]+.[0-9]+'
      - 'autoupdate/release-[0-9]+.[0-9]+-strict'
      - 'autoupdate/sync/**'
  pull_request:
    paths-ignore:
      - 'docs/**'

permissions:
  contents: read

jobs:
  build:
    name: Build
    runs-on: ubuntu-20.04

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit
      - name: Checking out repo
        uses: actions/checkout@v4
      - name: Install lxd
        run: |
          sudo snap refresh lxd --channel 5.21/stable
          sudo lxd init --auto
          sudo usermod --append --groups lxd $USER
          sg lxd -c 'lxc version'
      - name: Install snapcraft
        run: |
          sudo snap install snapcraft --classic
      - name: Build snap
        run: |
          sg lxd -c 'snapcraft --use-lxd'
          mv k8s_*.snap k8s.snap
      - name: Uploading snap
        uses: actions/upload-artifact@v4
        with:
          name: k8s.snap
          path: k8s.snap

  test-branches:
    name: Test Branch Management
    runs-on: ubuntu-20.04
    steps:
      - name: Check out code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.8'
      - name: Install tox
        run: pip install tox
      - name: Run branch_management tests
        run: |
          tox -c tests/branch_management -e test

  test-integration:
    name: Test ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: ["ubuntu:20.04", "ubuntu:22.04", "ubuntu:24.04"]
    runs-on: ubuntu-20.04
    needs: build

    steps:
      - name: Check out code
        uses: actions/checkout@v4
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.8'
      - name: Install tox
        run: pip install tox
      - name: Install lxd
        run: |
          sudo snap refresh lxd --channel 5.21/stable
          sudo lxd init --auto
          sudo usermod --append --groups lxd $USER
          sg lxd -c 'lxc version'
      - name: Download snap
        uses: actions/download-artifact@v4
        with:
          name: k8s.snap
          path: build
      - name: Run end to end tests
        run: |
          export TEST_SNAP="$PWD/build/k8s.snap"
          export TEST_SUBSTRATE=lxd
          export TEST_LXD_IMAGE=${{ matrix.os }}
          export TEST_INSPECTION_REPORTS_DIR="$HOME/inspection-reports"
          cd tests/integration && sg lxd -c 'tox -e integration'
      - name: Prepare inspection reports
        if: failure()
        run: |
          tar -czvf inspection-reports.tar.gz -C $HOME inspection-reports
          echo "artifact_name=inspection-reports-${{ matrix.os }}" | sed 's/:/-/g' >> $GITHUB_ENV
      - name: Upload inspection report artifact
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.artifact_name }}
          path: inspection-reports.tar.gz

  security-scan:
    permissions:
      contents: read  # for actions/checkout to fetch code
      security-events: write  # for github/codeql-action/upload-sarif to upload SARIF results
    name: Security scan
    runs-on: ubuntu-20.04
    needs: build
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit
      - name: Checking out repo
        uses: actions/checkout@v4
      - name: Fetch snap
        uses: actions/download-artifact@v4
        with:
          name: k8s.snap
          path: build
      - name: Setup Trivy vulnerability scanner
        run: |
          mkdir -p sarifs
          VER=$(curl --silent -qI https://github.com/aquasecurity/trivy/releases/latest | awk -F '/' '/^location/ {print  substr($NF, 1, length($NF)-1)}');
          wget https://github.com/aquasecurity/trivy/releases/download/${VER}/trivy_${VER#v}_Linux-64bit.tar.gz
          tar -zxvf ./trivy_${VER#v}_Linux-64bit.tar.gz
      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: "fs"
          ignore-unfixed: true
          format: "sarif"
          output: "trivy-k8s-repo-scan--results.sarif"
          severity: "MEDIUM,HIGH,CRITICAL"
      - name: Gather Trivy repo scan results
        run: |
          cp trivy-k8s-repo-scan--results.sarif ./sarifs/
      - name: Run Trivy vulnerability scanner on the snap
        run: |
          cp build/k8s.snap .
          unsquashfs k8s.snap
          ./trivy rootfs ./squashfs-root/ --format sarif > sarifs/snap.sarif
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: "sarifs"