openshift-test.yaml

name: "Test using Replicated's Compatibilty Matrix and chart-testing tool"

on:
  pull_request:
    paths:
      - 'stable/enterprise/Chart.yaml'
      - 'stable/ecs-inventory/Chart.yaml'
      - 'stable/k8s-inventory/Chart.yaml'
      - 'stable/anchore-admission-controller/Chart.yaml'

permissions:
  contents: read

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        cluster: [
          {distribution: "openshift", version: "4.18.0-okd"},
          {distribution: "gke", version: "1.32"},
          {distribution: aks, version: "1.32"},
        ]
    runs-on: ubuntu-22.04
    steps:
    - name: Checkout
      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0

    - name: Fetch history
      run: git fetch --prune --unshallow

    - name: Shellcheck
      uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0

    - uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
      with:
        python-version: '3.10'

    - name: Set up Helm
      uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
      with:
        version: v3.8.0

    - name: Set up chart-testing
      uses: helm/chart-testing-action@b43128a8b25298e1e7b043b78ea6613844e079b1 # v2.7.0

    - name: Run chart-testing (list-changed)
      id: list-changed
      run: |
        changed=$(ct list-changed --config 'ct-config.yaml' --target-branch ${{ github.event.pull_request.base.ref }})
        if [[ -n "$changed" ]]; then
          echo "CHANGED=true" >> "$GITHUB_OUTPUT"
        fi

    - name: Run chart-testing (lint)
      id: lint
      run: ct lint --config 'ct-config.yaml'
      if: steps.list-changed.outputs.CHANGED == 'true' && github.event.pull_request.base.ref == 'main'

    - name: Run chart-testing but skip version check (lint)
      id: lintskipversion
      run: ct lint --config 'ct-config.yaml' --check-version-increment=false
      if: steps.list-changed.outputs.CHANGED == 'true' && github.event.pull_request.base.ref != 'main'

    - name: Set up oc client and kubectl
      if: steps.list-changed.outputs.CHANGED == 'true'
      run: |
        wget https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/linux/oc.tar.gz
        sudo tar xzvf oc.tar.gz -C /usr/local/bin
        curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
        chmod +x kubectl
        sudo mv kubectl /usr/local/bin/

    - name: Use Replicated Compatibilty Matrix for cluster creation
      if: steps.list-changed.outputs.CHANGED == 'true'
      id: create-cluster
      uses: replicatedhq/compatibility-actions/create-cluster@v1
      with:
        api-token: ${{ secrets.ANCHORECI_REPLICATED_API_TOKEN }}
        cluster-name: ${{ github.ref_name }}-${{ matrix.cluster.distribution }}-${{ matrix.cluster.version }}-${{ github.run_id }}
        kubernetes-distribution: ${{ matrix.cluster.distribution }}
        kubernetes-version: ${{ matrix.cluster.version }}
        ttl: 20m
        timeout-minutes: 20
        kubeconfig-path: ./tmp/kubeconfig
        nodes: 2

    - name: check the cluster
      if: steps.list-changed.outputs.CHANGED == 'true'
      id: check-cluster
      run: |
        kubectl get nodes
        kubectl create namespace anchore
        echo "${ANCHORE_LICENSE}" | base64 --decode > /tmp/anchore-license
        kubectl --namespace anchore create secret generic anchore-enterprise-license --from-file=license.yaml=/tmp/anchore-license
        kubectl --namespace anchore create secret docker-registry anchore-enterprise-pullcreds --docker-server=docker.io --docker-username="${DOCKER_USER}" --docker-password="${DOCKER_PASS}"
      env:
        ANCHORE_LICENSE: ${{ secrets.B64_ANCHORE_LICENSE }}
        DOCKER_USER: ${{ secrets.ANCHOREREADONLY_DH_USERNAME }}
        DOCKER_PASS: ${{ secrets.ANCHOREREADONLY_DH_PAT }}
        KUBECONFIG: ./tmp/kubeconfig

    - name: Check if anchore-enterprise endpoint is required for admission controller chart
      id: enterprise_required
      run: |
        if [[ -n $(git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }} | grep 'anchore-admission-controller') ]]; then
          echo "File in the 'stable/anchore-admission-controller' directory was changed. We need an enterprise deployment"
          echo "::set-output name=changed::true"
        elif [[ -n $(git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }} | grep 'k8s-inventory') ]]; then
          echo "Branch: ${{ github.event.pull_request.head.ref }}"
          echo "File in the 'stable/k8s-inventory' directory was changed. We need an enterprise deployment"
          echo "::set-output name=changed::true"
        else
          echo "No files in 'stable/anchore-admission-controller' or 'stable/k8s-inventory' directory were changed. Skipping enterprise deployment"
          echo "::set-output name=changed::false"
        fi
      shell: bash

    - name: Deploy enterprise
      if: steps.enterprise_required.outputs.changed == 'true'
      run: |
        helm repo add anchore https://charts.anchore.io || echo "anchore repo already added"
        helm repo add bitnami https://charts.bitnami.com/bitnami || echo "bitnami repo already added"
        helm repo add prometheus-community https://prometheus-community.github.io/helm-charts || echo "prometheus-community repo already added"
        helm repo update

        if [[ "${{ matrix.cluster.distribution }}" == "openshift" ]]; then
          echo "Installing enterprise on openshift"
          helm install enterprise anchore/enterprise --namespace anchore -f stable/anchore-admission-controller/ci/enterprise-openshift-vals.yaml --wait
        else
          echo "Installing enterprise"
          helm install enterprise anchore/enterprise --namespace anchore -f stable/anchore-admission-controller/ci/enterprise-vals.yaml --wait
        fi
        kubectl --namespace anchore get pods
      env:
        KUBECONFIG: ./tmp/kubeconfig

    - name: Update to rc image if needed
      if: ${{ github.event.pull_request.base.ref == 'rc5x' || github.ref_name == 'rc5x' }}
      run: |
        echo "Branch: ${{ github.event.pull_request.head.ref }}"
        echo "Distribution: ${{ matrix.cluster.distribution }}"

        if [[ "${{ matrix.cluster.distribution }}" == "openshift" ]]; then
          echo "updating openshift-test.yaml with rc image"
          echo 'image: "docker.io/anchore/enterprise-dev:rc"' >> stable/enterprise/ci/openshift-test.yaml
          echo 'ui:' >> stable/enterprise/ci/openshift-test.yaml
          echo '  image: "docker.io/anchore/anchore-on-prem-ui-dev:rc"' >> stable/enterprise/ci/openshift-test.yaml
          echo "Appended to stable/enterprise/ci/openshift-test.yaml"
        else
          echo "updating rc-values.yaml with rc image"
          echo 'image: "docker.io/anchore/enterprise-dev:rc"' >> stable/enterprise/ci/rc-values.yaml
          echo 'ui:' >> stable/enterprise/ci/rc-values.yaml
          echo '  image: "docker.io/anchore/anchore-on-prem-ui-dev:rc"' >> stable/enterprise/ci/rc-values.yaml
          echo "Appended to stable/enterprise/ci/rc-values.yaml"
        fi

    - name: Update to nightly image if needed
      if: ${{ github.event.pull_request.base.ref == 'nightly' || github.ref_name == 'nightly' }}
      run: |

        if [[ "${{ matrix.cluster.distribution }}" == "openshift" ]]; then
          echo "updating openshift-test.yaml with nightly image"
          echo 'image: "docker.io/anchore/enterprise-dev:nightly"' >> stable/enterprise/ci/openshift-test.yaml
          echo 'ui:' >> stable/enterprise/ci/openshift-test.yaml
          echo '  image: "docker.io/anchore/anchore-on-prem-ui-dev:nightly"' >> stable/enterprise/ci/openshift-test.yaml
          echo "Appended to stable/enterprise/ci/openshift-test.yaml"
        else
          echo "updating nightly-values.yaml with nightly image"
          echo 'image: "docker.io/anchore/enterprise-dev:nightly"' >> stable/enterprise/ci/nightly-values.yaml
          echo 'ui:' >> stable/enterprise/ci/nightly-values.yaml
          echo '  image: "docker.io/anchore/anchore-on-prem-ui-dev:nightly"' >> stable/enterprise/ci/nightly-values.yaml
          echo "Appended to stable/enterprise/ci/nightly-values.yaml"
        fi

    - name: Run chart-testing
      if: steps.list-changed.outputs.CHANGED == 'true'
      run: |
        ls -al
        echo ${PWD}
        files_changed="$(git diff --name-only origin/${TARGET_BRANCH} | sort | uniq)"
        charts_dirs_changed="$(echo "$files_changed" | xargs dirname | grep -o "stable/[^/]*" | sort | uniq || true)"
        for chart in ${charts_dirs_changed}; do
          # if ${{ matrix.cluster.distribution }} is openshift, then echo openshift-test.yaml
          if [[ "${{ matrix.cluster.distribution }}" == "openshift" ]]; then
            echo "creating openshift-test-values.yaml for ${chart}"
            pushd "${chart}"
            rm -rvf ci/*-values.yaml
            mv ci/openshift-test.yaml ci/openshift-test-values.yaml
            popd
          fi
        done
        ct install --config ct-config.yaml --helm-extra-args "--timeout 600s"
      env:
        KUBECONFIG: ./tmp/kubeconfig
        TARGET_BRANCH: "${{ github.event.pull_request.base.ref }}"

    - name: Remove Cluster
      if: steps.list-changed.outputs.CHANGED == 'true'
      id: remove-cluster
      uses: replicatedhq/replicated-actions/remove-cluster@v1
      continue-on-error: true # It could be that the cluster is already removed
      with:
        api-token: ${{ secrets.ANCHORECI_REPLICATED_API_TOKEN }}
        cluster-id: ${{ steps.create-cluster.outputs.cluster-id }}