chainsaw.yaml

name: Chainsaw

on:
  push:
    paths-ignore:
      - '**.md'
      - '**.svg'
      - '**.drawio'
      - '.spelling'
  pull_request:
    branches:
      - master
    # The specific activity types are listed here to include "labeled" and "unlabeled"
    # (which are not included by default for the "pull_request" trigger).
    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
    paths-ignore:
      - '**.md'
      - '**.svg'
      - '**.drawio'
      - '.spelling'
permissions:
  contents: read

jobs:
  skip-check:
    runs-on: ubuntu-latest
    name: Skip the job?
    outputs:
          should_skip: ${{ steps.skip_check.outputs.should_skip }}
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

    - id: skip_check
      uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1
      with:
        skip_after_successful_duplicate: 'true'
        do_not_skip: '["workflow_dispatch", "schedule"]'

  chainsaw:
    runs-on: ubuntu-24.04
    needs: skip-check
    if: ${{ needs.skip-check.outputs.should_skip != 'true' }} && !contains( github.event.pull_request.labels.*.name, 'renovate')
    steps:
      - name: Checkout
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
        with:
          fetch-depth: 0

      - name: Setup Chainsaw
        uses: kyverno/action-install-chainsaw@f2b47b97dc889c12702113753d713f01ec268de5 # v0.2.12
        with:
          release: v0.2.11

      - name: Check install
        run: chainsaw version

      - name: Setup golang
        uses: actions/setup-go@bfd2fb341f32be7281829126376a12a780ca79fc
        with:
          go-version: 1.22.3

      - name: Build artifacts
        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
        with:
          version: v1.9.2
          args: release --rm-dist --skip-publish --skip-validate --snapshot --skip-sbom --skip-sign
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create edgeDNS k3s Cluster
        uses: AbsaOSS/k3d-action@4e8b3239042be1dc0aed6c5eb80c13b18200fc79
        with:
          cluster-name: "edgedns"
          args: -c k3d/edge-dns.yaml

      - name: Create 1st k3s Cluster
        uses: AbsaOSS/k3d-action@4e8b3239042be1dc0aed6c5eb80c13b18200fc79
        with:
          cluster-name: "test-gslb1"
          args: -c k3d/test-gslb1.yaml

      - name: Create 2nd k3s Cluster
        uses: AbsaOSS/k3d-action@4e8b3239042be1dc0aed6c5eb80c13b18200fc79
        with:
          cluster-name: "test-gslb2"
          args: -c k3d/test-gslb2.yaml

      - name: K8GB deployment
        run: |
          make deploy-test-version list-running-pods
          echo "Cluster 1 (eu):"
          kubectl get no -owide --context=k3d-test-gslb1
          echo "Cluster 2 (us):"
          kubectl get no -owide --context=k3d-test-gslb2

      - name: Run Chainsaw
        run: make chainsaw

      - name: Print debug info
        if: always()
        uses: ./.github/actions/print-chainsaw-debug

      - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
        if: always()
        with:
          name: chainsaw-logs
          path: ${{ github.workspace }}/tmp/chainsaw