test.yaml

name: "Test using kind and chart-testing tool"

on:
  pull_request:
    paths:
      - 'stable/**'

permissions:
  contents: read

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        kubernetesVersion: ["v1.29.2", "v1.30.0", "v1.31.0", "v1.32.2", "v1.33.1"]
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
      with:
        fetch-depth: 0
        persist-credentials: false

    - name: Shellcheck
      uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0

    - uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
      with:
        python-version: '3.10'

    - name: Set up Helm
      uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
      with:
        version: v3.8.0

    - name: Set up chart-testing
      uses: helm/chart-testing-action@b43128a8b25298e1e7b043b78ea6613844e079b1 # v2.6.0

    - name: Run chart-testing (list-changed)
      id: list-changed
      env:
        BASE_REF: ${{ github.event.pull_request.base.ref }}
      run: |
        changed=$(ct list-changed --config 'ct-config.yaml' --target-branch "$BASE_REF")
        if [[ -n "$changed" ]]; then
          echo "CHANGED=true" >> "$GITHUB_OUTPUT"
        fi
        if echo "$changed" | grep -qE 'anchore-admission-controller|k8s-inventory'; then
          echo "ENTERPRISE_REQUIRED=true" >> "$GITHUB_OUTPUT"
        fi

    - name: Run chart-testing (lint)
      id: lint
      run: ct lint --config 'ct-config.yaml' --target-branch "$BASE_REF"
      env:
        BASE_REF: ${{ github.event.pull_request.base.ref }}
      if: steps.list-changed.outputs.CHANGED == 'true' && github.event.pull_request.base.ref == 'main'

    - name: Run chart-testing but skip version check (lint)
      id: lintskipversion
      run: ct lint --config 'ct-config.yaml' --check-version-increment=false --target-branch "$BASE_REF"
      env:
        BASE_REF: ${{ github.event.pull_request.base.ref }}
      if: steps.list-changed.outputs.CHANGED == 'true' && github.event.pull_request.base.ref != 'main'

    - name: Install kind
      if: steps.list-changed.outputs.CHANGED == 'true'
      uses: helm/kind-action@dda0770415bac9fc20092cacbc54aa298604d140 # v1.8.0
      with:
        node_image: "kindest/node:${{ matrix.kubernetesVersion }}"
        config: kind-config.yaml
        wait: 600s

    - name: Check kind nodes
      if: steps.list-changed.outputs.CHANGED == 'true'
      run: kubectl describe nodes

    - name: Create pullcreds and license secrets
      if: steps.list-changed.outputs.CHANGED == 'true'
      run: |
        kubectl create namespace anchore
        echo "${ANCHORE_LICENSE}" | base64 --decode > /tmp/anchore-license
        kubectl --namespace anchore create secret generic anchore-enterprise-license --from-file=license.yaml=/tmp/anchore-license
        kubectl --namespace anchore create secret docker-registry anchore-enterprise-pullcreds --docker-server=docker.io --docker-username="${DOCKER_USER}" --docker-password="${DOCKER_PASS}"
      env:
        ANCHORE_LICENSE: ${{ secrets.B64_ANCHORE_LICENSE }}
        DOCKER_USER: ${{ secrets.ANCHOREREADONLY_DH_USERNAME }}
        DOCKER_PASS: ${{ secrets.ANCHOREREADONLY_DH_PAT }}

    - name: Install CNPG operator
      if: steps.list-changed.outputs.CHANGED == 'true'
      run: |
        helm repo add cnpg https://cloudnative-pg.github.io/charts
        helm repo update
        helm install cnpg cnpg/cloudnative-pg --namespace cnpg-system --create-namespace --wait

    - name: Deploy CNPG PostgreSQL cluster
      if: steps.list-changed.outputs.CHANGED == 'true'
      run: |
        kubectl apply -f scripts/cnpg/cnpg-cluster.yaml
        kubectl wait --for=condition=Ready cluster/anchore-db -n anchore --timeout=300s
        kubectl --namespace anchore get pods

    - name: Deploy enterprise for admission-controller/k8s-inventory testing
      if: steps.list-changed.outputs.ENTERPRISE_REQUIRED == 'true'
      run: |
        kubectl create namespace anchore-enterprise
        echo "${ANCHORE_LICENSE}" | base64 --decode > /tmp/anchore-license
        kubectl --namespace anchore-enterprise create secret generic anchore-enterprise-license --from-file=license.yaml=/tmp/anchore-license
        kubectl --namespace anchore-enterprise create secret docker-registry anchore-enterprise-pullcreds --docker-server=docker.io --docker-username="${DOCKER_USER}" --docker-password="${DOCKER_PASS}"

        kubectl apply -f scripts/cnpg/cnpg-cluster-ci-enterprise.yaml
        kubectl wait --for=condition=Ready cluster/anchore-db -n anchore-enterprise --timeout=300s

        helm repo add anchore https://charts.anchore.io || echo "anchore repo already added"
        helm repo add bitnami https://charts.bitnami.com/bitnami || echo "bitnami repo already added"
        helm repo add prometheus-community https://prometheus-community.github.io/helm-charts || echo "prometheus-community repo already added"
        helm repo update
        helm install enterprise anchore/enterprise --namespace anchore-enterprise -f stable/anchore-admission-controller/ci/enterprise-vals.yaml --wait
        kubectl --namespace anchore-enterprise get pods
      env:
        ANCHORE_LICENSE: ${{ secrets.B64_ANCHORE_LICENSE }}
        DOCKER_USER: ${{ secrets.ANCHOREREADONLY_DH_USERNAME }}
        DOCKER_PASS: ${{ secrets.ANCHOREREADONLY_DH_PAT }}

    - name: Update to rc image if needed
      if: ${{ github.event.pull_request.base.ref == 'rc5x' || github.ref_name == 'rc5x'  }}
      env:
        HEAD_REF: ${{ github.event.pull_request.head.ref }}
      run: |
        echo "Branch: $HEAD_REF"
        echo 'image: "docker.io/anchore/enterprise-dev:rc"' >> stable/enterprise/ci/ci-values.yaml
        echo 'ui:' >> stable/enterprise/ci/ci-values.yaml
        echo '  image: "docker.io/anchore/anchore-on-prem-ui-dev:rc"' >> stable/enterprise/ci/ci-values.yaml
        echo "Appended to stable/enterprise/ci/ci-values.yaml"

    - name: Update to nightly image if needed
      if: ${{ github.event.pull_request.base.ref == 'nightly' || github.ref_name == 'nightly' }}
      env:
        HEAD_REF: ${{ github.event.pull_request.head.ref }}
      run: |
        echo "Branch: $HEAD_REF"
        echo 'image: "docker.io/anchore/enterprise-dev:nightly"' >> stable/enterprise/ci/ci-values.yaml
        echo 'ui:' >> stable/enterprise/ci/ci-values.yaml
        echo '  image: "docker.io/anchore/anchore-on-prem-ui-dev:nightly"' >> stable/enterprise/ci/ci-values.yaml
        echo "Appended to stable/enterprise/ci/ci-values.yaml"

    - name: Run chart-testing
      if: steps.list-changed.outputs.CHANGED == 'true'
      env:
        BASE_REF: ${{ github.event.pull_request.base.ref }}
      run: |
        changed_charts=$(ct list-changed --config ct-config.yaml --target-branch "$BASE_REF")
        other_charts=$(echo "$changed_charts" | grep -v 'anchore-admission-controller' || true)
        if echo "$changed_charts" | grep -q 'anchore-admission-controller'; then
          if [[ -n "$other_charts" ]]; then
            echo "Admission controller changed alongside other charts. Installing other charts first, then admission controller."
            ct install --config ct-config.yaml --target-branch "$BASE_REF" --excluded-charts "anchore-admission-controller" --helm-extra-args "--timeout 600s"
          fi
          ct install --config ct-config.yaml --target-branch "$BASE_REF" --charts stable/anchore-admission-controller --helm-extra-args "--timeout 600s"
        else
          ct install --config ct-config.yaml --target-branch "$BASE_REF" --helm-extra-args "--timeout 600s"
        fi