ci.yaml

name: CI

on:
  release:
    types: [published]
  pull_request:
  push:
    branches: [main]
    tags:
      - "v*"

defaults:
  run:
    shell: bash

jobs:
  probe_tests:
    name: Unit tests / ${{ matrix.python }} / ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macOS-13]
        python: ["3.10", "3.11"]
      fail-fast: true
    env:
      OS: ${{ matrix.os }}
      PYTHON: ${{ matrix.python }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python ${{ matrix.python }}
        id: setup-python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python }}
      - name: Install poetry
        uses: snok/install-poetry@v1
        with:
          virtualenvs-create: true
          virtualenvs-in-project: true
          installer-parallel: true
      - name: Load cached venv
        id: cached-poetry-dependencies
        uses: actions/cache@v3
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}
      - name: Install dependencies
        run: |
          poetry install --no-interaction
      - name: Run Tests
        run: |
          source $VENV
          poetry run pytest tests --cov netcheck --cov-report=lcov --cov-report=term
        timeout-minutes: 10
      - name: Coveralls Parallel
        uses: coverallsapp/github-action@master
        with:
          github-token: ${{ secrets.github_token }}
          flag-name: Unittests-${{ matrix.os }}-${{ matrix.python-version }}
          parallel: true
          path-to-lcov: ./coverage.lcov

  probe_coverage:
    name: Probe Code Coverage
    needs: probe_tests
    runs-on: ubuntu-latest
    steps:
      - name: Coveralls Finished
        uses: coverallsapp/github-action@master
        with:
          github-token: ${{ secrets.github_token }}
          parallel-finished: true

  probe_package:
    name: Probe Library Packaging
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v4
        with:
          python-version: "3.11"
      - name: Install poetry
        uses: snok/install-poetry@v1
        with:
          virtualenvs-create: true
          virtualenvs-in-project: true
          installer-parallel: true
      - name: Load cached venv
        id: cached-poetry-dependencies
        uses: actions/cache@v3
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}
      # install dependencies if cache does not exist
      - name: Install dependencies
        if: steps.cached-poetry-dependencies.outputs.cache-hit != 'true'
        run: |
          poetry install --no-interaction --no-root
      - name: Artifact creation
        run: |
          source $VENV
          poetry build
      - name: Save artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: ./dist

  upload_pypi:
    name: Release to PyPi
    needs: [probe_package]
    runs-on: ubuntu-latest

    # upload to PyPI only on release
    if: github.event.release && github.event.action == 'published'
    steps:
      - uses: actions/download-artifact@v4.1.7
        with:
          name: dist
          path: dist

      - uses: pypa/gh-action-pypi-publish@v1.8.11
        with:
          user: __token__
          password: ${{ secrets.PYPI_API_TOKEN }}

  probe_docker:
    name: Build Probe Image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write # needed for signing the images with GitHub OIDC Token
    env:
      IMAGE_NAME: netchecks
      IMAGE_REGISTRY: ghcr.io
      IMAGE_REPOSITORY: hardbyte

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{env.IMAGE_REGISTRY}}/${{env.IMAGE_REPOSITORY}}/${{env.IMAGE_NAME}}
          tags: |
            type=sha
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.IMAGE_REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Build and push
        id: docker_build
        uses: docker/build-push-action@v4
        with:
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  operator_docker:
    name: Build Operator Image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write # needed for signing the images with GitHub OIDC Token
    env:
      IMAGE_NAME: netchecks-operator
      IMAGE_REGISTRY: ghcr.io
      IMAGE_REPOSITORY: hardbyte

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{env.IMAGE_REGISTRY}}/${{env.IMAGE_REPOSITORY}}/${{env.IMAGE_NAME}}
          tags: |
            type=sha
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.IMAGE_REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Build and push
        uses: docker/build-push-action@v3
        with:
          context: operator
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels:
            ${{ steps.meta.outputs.labels }}
            #      - name: Install Cosign
            #        uses: sigstore/cosign-installer@main
            #      - name: Sign the images with GitHub OIDC Token
            #        run: cosign sign --yes ${TAGS}
            #        if: github.event_name != 'pull_request'
            #        env:
            #          TAGS: ${{ steps.meta.outputs.tags }}

  k8s:
    name: Kubernetes Integration Tests
    needs: [probe_docker, operator_docker]
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      KIND_VERSION: v0.18.0
      KIND_CONFIG: .github/kind-config.yaml
      TIMEOUT: 2m
      LOG_TIME: 30m
      cilium_version: 1.14.3
      cilium_cli_version: v0.15.11
      kubectl_version: v1.25.2
      PROBE_IMAGE_NAME: netchecks
      OPERATOR_IMAGE_NAME: netchecks-operator
      IMAGE_REGISTRY: ghcr.io
      IMAGE_REPOSITORY: hardbyte
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@v4
        with:
          python-version: "3.11"
      - name: Install poetry
        uses: snok/install-poetry@v1
        with:
          virtualenvs-create: true
          virtualenvs-in-project: true
          installer-parallel: true
      - name: Load cached venv
        id: cached-poetry-dependencies
        uses: actions/cache@v3
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}
      - name: Install Python Dependencies
        run: |
          cd operator
          poetry install --no-interaction --with dev
      - name: Install kubectl
        run: |
          curl -sLO "https://dl.k8s.io/release/${{ env.kubectl_version }}/bin/linux/amd64/kubectl"
          curl -sLO "https://dl.k8s.io/${{ env.kubectl_version }}/bin/linux/amd64/kubectl.sha256"
          echo "$(cat kubectl.sha256)  kubectl" | sha256sum --check
          sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
          kubectl version --client
      - name: Install cilium CLI binary
        run: |
          curl -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${{ env.cilium_cli_version }}/cilium-linux-amd64.tar.gz{,.sha256sum}
          sha256sum --check cilium-linux-amd64.tar.gz.sha256sum
          sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin
          cilium version --client

      - name: Fetch kind cilium config
        run: |
          curl -LO https://raw.githubusercontent.com/cilium/cilium/1.14.3/Documentation/installation/kind-config.yaml

      - name: Create kind cluster
        uses: helm/kind-action@v1.9.0
        with:
          version: ${{ env.KIND_VERSION }}
          cluster_name: kind
          config: kind-config.yaml

      - name: Install Cilium
        run: |
          cilium install --version ${{ env.cilium_version }}

      - name: Wait for Cilium Operator
        run: |
          cilium status --wait

      - name: Get Cluster Info
        run: |
          kubectl cluster-info
          export KUBE_API=$(kubectl config view -o jsonpath='{.clusters[0].cluster.server}')
          kind get nodes

      - name: Load Netchecks Images into Kind
        run: |
          docker pull ${{env.IMAGE_REGISTRY}}/${{env.IMAGE_REPOSITORY}}/${{env.PROBE_IMAGE_NAME}}:sha-${GITHUB_SHA::7}
          docker pull ${{env.IMAGE_REGISTRY}}/${{env.IMAGE_REPOSITORY}}/${{env.OPERATOR_IMAGE_NAME}}:sha-${GITHUB_SHA::7}
          kind load docker-image ${{env.IMAGE_REGISTRY}}/${{env.IMAGE_REPOSITORY}}/${{env.PROBE_IMAGE_NAME}}:sha-${GITHUB_SHA::7}
          kind load docker-image ${{env.IMAGE_REGISTRY}}/${{env.IMAGE_REPOSITORY}}/${{env.OPERATOR_IMAGE_NAME}}:sha-${GITHUB_SHA::7}
      - name: Prepare Netchecks Operator Helm Chart
        run: |
          helm dependency build operator/charts/netchecks

      - name: Install Netchecks Operator (helm chart)
        run: |
          helm upgrade --install netchecks-operator operator/charts/netchecks -n netchecks --create-namespace

      - name: Uninstall Netchecks Operator
        run: |
          helm uninstall netchecks-operator -n netchecks

      - name: Run Integration Tests (no Cilium)
        run: |
          cd operator
          export NETCHECKS_IMAGE_TAG=sha-${GITHUB_SHA::7}
          poetry run pytest
        timeout-minutes: 10

      #      - name: Enable Hubble Relay
      #        run: |
      #          cilium hubble enable --ui
      #
      #      - name: Relay Port Forward
      #        run: |
      #          cilium hubble port-forward&
      #          sleep 10s
      #          [[ $(pgrep -f "cilium.*hubble.*port-forward|kubectl.*port-forward.*hubble-relay" | wc -l) == 2 ]]

      - name: Run Integration Tests (with Cilium)
        run: |
          cd operator
          export NETCHECKS_IMAGE_TAG=sha-${GITHUB_SHA::7}
          export INCLUDE_CILIUM_TESTS=1
          poetry run pytest -x

        timeout-minutes: 10

      - name: Cleanup
        if: ${{ always() }}
        run: |
          cilium status
          kubectl get pods --all-namespaces -o wide
        shell: bash {0} # Disable default fail-fast behaviour so that all commands run independently