pr_build.yaml

name: PR Build
on:
  pull_request: {}
  workflow_dispatch: {}
env:
  GO_VERSION: 1.21.8
permissions:
  contents: read

jobs:
  cache-deps:
    name: cache-deps (linux)
    runs-on: ubuntu-20.04
    timeout-minutes: 30

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Setup dep cache
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
      - name: Pull go deps
        run: go mod download

  lint:
    name: lint (linux)
    runs-on: ubuntu-20.04
    needs: cache-deps
    timeout-minutes: 30

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Load cached deps
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
      - name: Setup build tool cache
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: .build
          key: ${{ runner.os }}-tools-${{ hashFiles('.go-version','Makefile') }}
      - name: Lint
        run: make lint
      - name: Tidy check
        run: make tidy-check
      - name: Generate check
        run: make generate-check
      - name: Shell check
        run: shellcheck .github/workflows/scripts/*.sh

  unit-test:
    strategy:
      matrix:
        OS: [ubuntu-20.04, macos-latest]
    runs-on: ${{ matrix.OS }}
    needs: cache-deps
    timeout-minutes: 30

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Load cached deps
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
      - name: Run unit tests
        run: ./.github/workflows/scripts/run_unit_tests.sh

  unit-test-race-detector:
    name: unit-test (linux with race detection)
    runs-on: ubuntu-20.04
    needs: cache-deps
    timeout-minutes: 30

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Load cached deps
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
      - name: Run unit tests
        run: ./.github/workflows/scripts/run_unit_tests_under_race_detector.sh

  artifacts:
    name: artifacts (linux)
    runs-on: ubuntu-20.04
    needs: [cache-deps, images]
    timeout-minutes: 30

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Install regctl
        uses: regclient/actions/regctl-installer@b6614f5f56245066b533343a85f4109bdc38c8cc # main
      - name: Download archived images
        uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
        with:
          name: images
          path: .
      - name: Expand archived images
        run: |
          tar xvf images.tar.gz
      - name: Build artifacts
        run: ./.github/workflows/scripts/build_artifacts.sh ${{ runner.os }}
      - name: Archive artifacts
        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4
        with:
          name: binaries-linux
          path: ./artifacts/

  images:
    name: images (linux)
    runs-on: ubuntu-20.04
    needs: [cache-deps]
    timeout-minutes: 30

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Load cached deps
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
      - name: Load cached build tools
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: .build
          key: ${{ runner.os }}-tools-${{ hashFiles('.go-version','Makefile') }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@0d103c3126aa41d772a8362f6aa67afac040f80c # v3.1.0
      - name: Build images
        run: make images-no-load
      - name: Export images
        run: tar -czvf images.tar.gz *-image.tar
      - name: Archive images
        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4
        with:
          name: images
          path: images.tar.gz

  images-windows:
    name: images (windows)
    runs-on: windows-2022
    needs: artifacts-windows
    timeout-minutes: 45

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Load cached executables
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ./bin/
          key: ${{ runner.os }}-executables-${{ hashFiles('**/*.exe') }}
      - name: Build images
        run: make images-windows
      - name: Export images
        run: |
          docker save spire-server-windows:latest-local spire-agent-windows:latest-local oidc-discovery-provider-windows:latest-local -o images-windows.tar
          gzip images-windows.tar
      - name: Archive images
        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4
        with:
          name: images-windows
          path: images-windows.tar.gz

  build-matrix:
    name: Build matrix
    runs-on: ubuntu-20.04
    needs: [cache-deps]
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - id: set-matrix
        name: Collect versions
        run: |
          json_array=$(bash ./.github/workflows/scripts/find_k8s.sh)
          echo "test=$json_array" >> $GITHUB_OUTPUT
          echo "Collected tests: $json_array"

    outputs:
      test: ${{ steps.set-matrix.outputs.test }}
  

  integration:
    name: integration (linux)
    runs-on: ubuntu-20.04
    needs: [cache-deps, images]
    timeout-minutes: 45

    permissions:
      contents: read

    strategy:
      fail-fast: false
      matrix:
        num_runners: [5]
        runner_id: [1, 2, 3, 4, 5]
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          # The "upgrade" integration test needs the history to ensure
          # that the version number in the source code has been bumped as
          # expected. This action does not fetch tags unless we supply a
          # fetch depth of zero.
          fetch-depth: 0
      - name: Setup go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Install regctl
        uses: regclient/actions/regctl-installer@b6614f5f56245066b533343a85f4109bdc38c8cc # main
      - name: Load cached deps
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
      - name: Load cached build tools
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: .build
          key: ${{ runner.os }}-tools-${{ hashFiles('.go-version','Makefile') }}
      - name: Download archived images
        uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
        with:
          name: images
          path: .
      - name: Load archived images
        run: |
          tar xvf images.tar.gz
          make load-images
      - name: Run integration tests
        env:
          NUM_RUNNERS: ${{ matrix.num_runners }}
          THIS_RUNNER: ${{ matrix.runner_id }}
          TERM: dumb
          CICD_TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
        run: ./.github/workflows/scripts/split.sh | xargs ./test/integration/test.sh



  integration-k8s:
    name: integration-k8s
    runs-on: ubuntu-20.04
    needs: [cache-deps, images, build-matrix]
    timeout-minutes: 45

    permissions:
      contents: read

    strategy:
      fail-fast: false
      matrix:
         num_runners: [1]
         runner_id: [1]
         #Test elements should be added as [KubeCTLVersion, K8s-image, KindVersion]
         test: ${{ fromJson(needs.build-matrix.outputs.test) }}
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          # The "upgrade" integration test needs the history to ensure
          # that the version number in the source code has been bumped as
          # expected. This action does not fetch tags unless we supply a
          # fetch depth of zero.
          fetch-depth: 0
      - name: Setup go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Install regctl
        uses: regclient/actions/regctl-installer@b6614f5f56245066b533343a85f4109bdc38c8cc # main
      - name: Load cached deps
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
      - name: Load cached build tools
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: .build
          key: ${{ runner.os }}-tools-${{ hashFiles('.go-version','Makefile') }}
      - name: Download archived images
        uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
        with:
          name: images
          path: .
      - name: Load archived images
        run: |
          tar xvf images.tar.gz
          make load-images
      - name: Run k8s integration
        env:
          NUM_RUNNERS: ${{ matrix.num_runners }}
          THIS_RUNNER: ${{ matrix.runner_id }}
          KUBECTLVERSION: ${{ matrix.test[0] }}
          K8SIMAGE: ${{ matrix.test[1] }}
          KINDVERSION: ${{ matrix.test[2] }}
          TERM: dumb
          CICD_TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
        run: ./.github/workflows/scripts/split_k8s.sh | xargs ./test/integration/test-k8s.sh


  integration-windows:
    name: integration (windows)
    runs-on: windows-2022
    needs: images-windows
    timeout-minutes: 45

    permissions:
      contents: read

    defaults:
      run:
        shell: msys2 {0}
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Load cached deps
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
      - name: Load cached build tools
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: .build
          key: ${{ runner.os }}-tools-${{ hashFiles('.go-version','Makefile') }}
      - name: Install msys2
        uses: msys2/setup-msys2@cc11e9188b693c2b100158c3322424c4cc1dadea # v2.22.0
        with:
          msystem: MINGW64
          update: true
          path-type: inherit
          install: >-
            git base-devel mingw-w64-x86_64-toolchain unzip
      - name: Download archived images
        uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
        with:
          name: images-windows
          path: .
      - name: Load archived images
        run: docker load -i images-windows.tar.gz
      - name: Run integration tests
        # Run all tests for now
        run: make integration-windows

  cache-deps-windows:
    name: cache-deps (windows)
    runs-on: windows-2022
    timeout-minutes: 45

    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Setup dep cache
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
      - name: Pull go deps
        run: go mod download

  lint-windows:
    name: lint (windows)
    runs-on: windows-2022
    needs: cache-deps-windows
    timeout-minutes: 45

    permissions:
      contents: read

    defaults:
      run:
        shell: msys2 {0}
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Load cached deps
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
      - name: Setup build tool cache
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: .build
          key: ${{ runner.os }}-tools-${{ hashFiles('.go-version','Makefile') }}
      - name: Install msys2
        uses: msys2/setup-msys2@cc11e9188b693c2b100158c3322424c4cc1dadea # v2.22.0
        with:
          msystem: MINGW64
          update: true
          install: >-
            git base-devel mingw-w64-x86_64-toolchain unzip
      - name: Lint
        run: make lint-code
      - name: Tidy check
        run: make tidy-check
      - name: Generate check
        run: make generate-check

  unit-test-windows:
    name: unit-test (windows)
    runs-on: windows-2022
    needs: cache-deps-windows
    timeout-minutes: 45

    permissions:
      contents: read

    defaults:
      run:
        shell: msys2 {0}
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Load cached deps
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
      - name: Install msys2
        uses: msys2/setup-msys2@cc11e9188b693c2b100158c3322424c4cc1dadea # v2.22.0
        with:
          msystem: MINGW64
          update: true
          install: >-
            git base-devel mingw-w64-x86_64-toolchain unzip
      - name: Run unit tests
        run: ./.github/workflows/scripts/run_unit_tests.sh

  artifacts-windows:
    name: artifacts (windows)
    runs-on: windows-2022
    needs: cache-deps-windows
    timeout-minutes: 45

    permissions:
      contents: read

    defaults:
      run:
        shell: msys2 {0}
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Load cached deps
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
      - name: Load cached build tools
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: .build
          key: ${{ runner.os }}-tools-${{ hashFiles('.go-version','Makefile') }}
      - name: Install msys2
        uses: msys2/setup-msys2@cc11e9188b693c2b100158c3322424c4cc1dadea # v2.22.0
        with:
          msystem: MINGW64
          update: true
          install: >-
            git base-devel mingw-w64-x86_64-toolchain zip unzip
      - name: Build binaries
        run: make build
      - name: Setup executables cache
        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
        with:
          path: ./bin/
          key: ${{ runner.os }}-executables-${{ hashFiles('**/*.exe') }}
      - name: Build artifacts
        run: ./.github/workflows/scripts/build_artifacts.sh ${{ runner.os }}
      - name: Archive artifacts
        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4
        with:
          name: binaries-windows
          path: ./artifacts/

  success:
    runs-on: ubuntu-20.04
    needs: [lint, unit-test, unit-test-race-detector, artifacts, integration, lint-windows, unit-test-windows, artifacts-windows, integration-windows]
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Declare victory!
        run: echo "# Successful" >> $GITHUB_STEP_SUMMARY