upgrade.yaml

name: upgrade
on:
  push:
    paths:
      - "manifest_staging/charts/**"

  pull_request:
    paths:
      - "manifest_staging/charts/**"

permissions:
  contents: read

env:
  BASE_RELEASE: 3.9.2
  BASE_BRANCH: release-3.9

jobs:
  helm_upgrade:
    name: "[Helm] Upgrade test"
    runs-on: ubuntu-22.04
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        HELM_VERSION: ["3.14.1"]
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
        with:
          egress-policy: audit

      - name: Check out code into the Go module directory
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332

      - name: Bootstrap e2e
        run: |
          mkdir -p $GITHUB_WORKSPACE/bin
          echo "$GITHUB_WORKSPACE/bin" >> $GITHUB_PATH
          make e2e-bootstrap KUBERNETES_VERSION=${{ env.KUBERNETES_VERSION }}
        env:
          KUBERNETES_VERSION: 1.24.4

      - name: Deploy Helm release
        run: |
          make e2e-helm-upgrade-init HELM_VERSION=${{ matrix.HELM_VERSION }} BASE_RELEASE=${{ env.BASE_RELEASE }} LOG_LEVEL=DEBUG

      - name: Run e2e after install
        run: |
          # running tests matching the base release
          git clone https://github.com/open-policy-agent/gatekeeper.git -b ${{ env.BASE_BRANCH }} --sparse --depth 1 /tmp/gatekeeper-tests-${{ env.BASE_BRANCH }}
          cd /tmp/gatekeeper-tests-${{ env.BASE_BRANCH }}
          git sparse-checkout set test/bats
          bats -t test/bats/test.bats

      - name: Save logs
        if: ${{ always() }}
        run: |
          kubectl logs -n gatekeeper-system -l control-plane=controller-manager --tail=-1 > logs-${{ matrix.HELM_VERSION }}-controller-pre-upgrade.json
          kubectl logs -n gatekeeper-system -l control-plane=audit-controller --tail=-1 > logs-${{ matrix.HELM_VERSION }}-audit-pre-upgrade.json

      - name: Cleanup
        run: |
          kubectl delete ns gatekeeper-test-playground gatekeeper-excluded-namespace || true
          kubectl delete constrainttemplates --all || true
          kubectl delete configs --all || true

      - name: Upgrade Helm version
        run: |
          make docker-buildx \
            IMG=gatekeeper-e2e:latest

          make docker-buildx-crds \
            CRD_IMG=gatekeeper-crds:latest 

          make e2e-build-load-externaldata-image

          kind load docker-image --name kind \
            gatekeeper-e2e:latest \
            gatekeeper-crds:latest

          make e2e-helm-upgrade \
            HELM_VERSION=${{ matrix.HELM_VERSION }} \
            HELM_REPO=gatekeeper-e2e \
            HELM_CRD_REPO=gatekeeper-crds \
            HELM_RELEASE=latest \
            LOG_LEVEL=DEBUG

      - name: Run e2e after upgrade
        run: |
          make test-e2e

      - name: Save logs
        if: ${{ always() }}
        run: |
          kubectl logs -n gatekeeper-system -l control-plane=controller-manager --tail=-1 > logs-${{ matrix.HELM_VERSION }}-controller-post-upgrade.json
          kubectl logs -n gatekeeper-system -l control-plane=audit-controller --tail=-1 > logs-${{ matrix.HELM_VERSION }}-audit-post-upgrade.json
          kubectl logs -n gatekeeper-system -l run=dummy-provider --tail=-1 > logs-${{ matrix.HELM_VERSION }}-dummy-provider-post-upgrade.json

      - name: Upload artifacts
        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
        if: ${{ always() }}
        with:
          name: logs
          path: |
            logs-*.json