openshift-test.yaml

name: "Test using Replicated's Compatibilty Matrix and chart-testing tool"

on:
  pull_request:
    paths:
      - 'stable/enterprise/Chart.yaml'
      - 'stable/ecs-inventory/Chart.yaml'
      - 'stable/k8s-inventory/Chart.yaml'
      - 'stable/anchore-admission-controller/Chart.yaml'

permissions:
  contents: read

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        cluster: [
          {distribution: "openshift", version: "4.18.0-okd"},
          {distribution: "gke", version: "1.32"},
          {distribution: aks, version: "1.32"},
        ]
    runs-on: ubuntu-22.04
    steps:
    - name: Checkout
      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
      with:
        persist-credentials: false

    - name: Fetch history
      run: git fetch --prune --unshallow

    - name: Shellcheck
      uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0

    - uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
      with:
        python-version: '3.10'

    - name: Set up Helm
      uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
      with:
        version: v3.8.0

    - name: Set up chart-testing
      uses: helm/chart-testing-action@b43128a8b25298e1e7b043b78ea6613844e079b1 # v2.7.0

    - name: Run chart-testing (list-changed)
      id: list-changed
      env:
        BASE_REF: ${{ github.event.pull_request.base.ref }}
      run: |
        changed=$(ct list-changed --config 'ct-config.yaml' --target-branch "$BASE_REF")
        if [[ -n "$changed" ]]; then
          echo "CHANGED=true" >> "$GITHUB_OUTPUT"
        fi

    - name: Run chart-testing (lint)
      id: lint
      run: ct lint --config 'ct-config.yaml'
      if: steps.list-changed.outputs.CHANGED == 'true' && github.event.pull_request.base.ref == 'main'

    - name: Run chart-testing but skip version check (lint)
      id: lintskipversion
      run: ct lint --config 'ct-config.yaml' --check-version-increment=false
      if: steps.list-changed.outputs.CHANGED == 'true' && github.event.pull_request.base.ref != 'main'

    - name: Set up oc client and kubectl
      if: steps.list-changed.outputs.CHANGED == 'true'
      run: |
        wget https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/linux/oc.tar.gz
        sudo tar xzvf oc.tar.gz -C /usr/local/bin
        curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
        chmod +x kubectl
        sudo mv kubectl /usr/local/bin/

    - name: Use Replicated Compatibilty Matrix for cluster creation
      if: steps.list-changed.outputs.CHANGED == 'true'
      id: create-cluster
      uses: replicatedhq/compatibility-actions/create-cluster@77121785951d05387334b773644c356885191f14 # v1
      with:
        api-token: ${{ secrets.ANCHORECI_REPLICATED_API_TOKEN }}
        cluster-name: ${{ github.ref_name }}-${{ matrix.cluster.distribution }}-${{ matrix.cluster.version }}-${{ github.run_id }}
        kubernetes-distribution: ${{ matrix.cluster.distribution }}
        kubernetes-version: ${{ matrix.cluster.version }}
        ttl: 20m
        timeout-minutes: 20
        kubeconfig-path: ./tmp/kubeconfig
        nodes: 2

    - name: check the cluster
      if: steps.list-changed.outputs.CHANGED == 'true'
      id: check-cluster
      run: |
        kubectl get nodes
        kubectl create namespace anchore
        echo "${ANCHORE_LICENSE}" | base64 --decode > /tmp/anchore-license
        kubectl --namespace anchore create secret generic anchore-enterprise-license --from-file=license.yaml=/tmp/anchore-license
        kubectl --namespace anchore create secret docker-registry anchore-enterprise-pullcreds --docker-server=docker.io --docker-username="${DOCKER_USER}" --docker-password="${DOCKER_PASS}"
      env:
        ANCHORE_LICENSE: ${{ secrets.B64_ANCHORE_LICENSE }}
        DOCKER_USER: ${{ secrets.ANCHOREREADONLY_DH_USERNAME }}
        DOCKER_PASS: ${{ secrets.ANCHOREREADONLY_DH_PAT }}
        KUBECONFIG: ./tmp/kubeconfig

    - name: Install CNPG operator
      if: steps.list-changed.outputs.CHANGED == 'true'
      env:
        KUBECONFIG: ./tmp/kubeconfig
        CLUSTER_DISTRIBUTION: ${{ matrix.cluster.distribution }}
      run: |
        helm repo add cnpg https://cloudnative-pg.github.io/charts
        helm repo update
        if [[ "$CLUSTER_DISTRIBUTION" == "openshift" ]]; then
          helm install cnpg cnpg/cloudnative-pg --namespace cnpg-system --create-namespace -f scripts/cnpg/cnpg-openshift-install.yaml --wait
        else
          helm install cnpg cnpg/cloudnative-pg --namespace cnpg-system --create-namespace --wait
        fi

    - name: Deploy CNPG PostgreSQL cluster
      if: steps.list-changed.outputs.CHANGED == 'true'
      run: |
        kubectl apply -f scripts/cnpg/cnpg-cluster.yaml
        kubectl wait --for=condition=Ready cluster/anchore-db -n anchore --timeout=300s
        kubectl --namespace anchore get pods
      env:
        KUBECONFIG: ./tmp/kubeconfig

    - name: Check if anchore-enterprise endpoint is required for admission controller chart
      id: enterprise_required
      env:
        BASE_SHA: ${{ github.event.pull_request.base.sha }}
        HEAD_SHA: ${{ github.sha }}
        HEAD_REF: ${{ github.event.pull_request.head.ref }}
      run: |
        if [[ -n $(git diff --name-only "$BASE_SHA" "$HEAD_SHA" | grep 'anchore-admission-controller') ]]; then
          echo "File in the 'stable/anchore-admission-controller' directory was changed. We need an enterprise deployment"
          echo "::set-output name=changed::true"
        elif [[ -n $(git diff --name-only "$BASE_SHA" "$HEAD_SHA" | grep 'k8s-inventory') ]]; then
          echo "Branch: $HEAD_REF"
          echo "File in the 'stable/k8s-inventory' directory was changed. We need an enterprise deployment"
          echo "::set-output name=changed::true"
        else
          echo "No files in 'stable/anchore-admission-controller' or 'stable/k8s-inventory' directory were changed. Skipping enterprise deployment"
          echo "::set-output name=changed::false"
        fi
      shell: bash

    - name: Deploy enterprise for admission-controller/k8s-inventory testing
      if: steps.enterprise_required.outputs.changed == 'true'
      env:
        KUBECONFIG: ./tmp/kubeconfig
        CLUSTER_DISTRIBUTION: ${{ matrix.cluster.distribution }}
        ANCHORE_LICENSE: ${{ secrets.B64_ANCHORE_LICENSE }}
        DOCKER_USER: ${{ secrets.ANCHOREREADONLY_DH_USERNAME }}
        DOCKER_PASS: ${{ secrets.ANCHOREREADONLY_DH_PAT }}
      run: |
        kubectl create namespace anchore-enterprise
        echo "${ANCHORE_LICENSE}" | base64 --decode > /tmp/anchore-license
        kubectl --namespace anchore-enterprise create secret generic anchore-enterprise-license --from-file=license.yaml=/tmp/anchore-license
        kubectl --namespace anchore-enterprise create secret docker-registry anchore-enterprise-pullcreds --docker-server=docker.io --docker-username="${DOCKER_USER}" --docker-password="${DOCKER_PASS}"

        kubectl apply -f scripts/cnpg/cnpg-cluster-ci-enterprise.yaml
        kubectl wait --for=condition=Ready cluster/anchore-db -n anchore-enterprise --timeout=300s

        helm repo add anchore https://charts.anchore.io || echo "anchore repo already added"
        helm repo add bitnami https://charts.bitnami.com/bitnami || echo "bitnami repo already added"
        helm repo add prometheus-community https://prometheus-community.github.io/helm-charts || echo "prometheus-community repo already added"
        helm repo update

        if [[ "$CLUSTER_DISTRIBUTION" == "openshift" ]]; then
          echo "Installing enterprise on openshift"
          helm install enterprise anchore/enterprise --namespace anchore-enterprise -f stable/anchore-admission-controller/ci/enterprise-openshift-vals.yaml --wait
        else
          echo "Installing enterprise"
          helm install enterprise anchore/enterprise --namespace anchore-enterprise -f stable/anchore-admission-controller/ci/enterprise-vals.yaml --wait
        fi
        kubectl --namespace anchore get pods
        kubectl --namespace anchore-enterprise get pods

    - name: Update to rc image if needed
      if: ${{ github.event.pull_request.base.ref == 'rc5x' || github.ref_name == 'rc5x' }}
      env:
        HEAD_REF: ${{ github.event.pull_request.head.ref }}
        CLUSTER_DISTRIBUTION: ${{ matrix.cluster.distribution }}
      run: |
        echo "Branch: $HEAD_REF"
        echo "Distribution: $CLUSTER_DISTRIBUTION"

        if [[ "$CLUSTER_DISTRIBUTION" == "openshift" ]]; then
          echo "updating openshift-test.yaml with rc image"
          echo 'image: "docker.io/anchore/enterprise-dev:rc"' >> stable/enterprise/ci/openshift-test.yaml
          echo 'ui:' >> stable/enterprise/ci/openshift-test.yaml
          echo '  image: "docker.io/anchore/anchore-on-prem-ui-dev:rc"' >> stable/enterprise/ci/openshift-test.yaml
          echo "Appended to stable/enterprise/ci/openshift-test.yaml"
        else
          echo "updating ci-values.yaml with rc image"
          echo 'image: "docker.io/anchore/enterprise-dev:rc"' >> stable/enterprise/ci/ci-values.yaml
          echo 'ui:' >> stable/enterprise/ci/ci-values.yaml
          echo '  image: "docker.io/anchore/anchore-on-prem-ui-dev:rc"' >> stable/enterprise/ci/ci-values.yaml
          echo "Appended to stable/enterprise/ci/ci-values.yaml"
        fi

    - name: Update to nightly image if needed
      if: ${{ github.event.pull_request.base.ref == 'nightly' || github.ref_name == 'nightly' }}
      env:
        CLUSTER_DISTRIBUTION: ${{ matrix.cluster.distribution }}
      run: |

        if [[ "$CLUSTER_DISTRIBUTION" == "openshift" ]]; then
          echo "updating openshift-test.yaml with nightly image"
          echo 'image: "docker.io/anchore/enterprise-dev:nightly"' >> stable/enterprise/ci/openshift-test.yaml
          echo 'ui:' >> stable/enterprise/ci/openshift-test.yaml
          echo '  image: "docker.io/anchore/anchore-on-prem-ui-dev:nightly"' >> stable/enterprise/ci/openshift-test.yaml
          echo "Appended to stable/enterprise/ci/openshift-test.yaml"
        else
          echo "updating ci-values.yaml with nightly image"
          echo 'image: "docker.io/anchore/enterprise-dev:nightly"' >> stable/enterprise/ci/ci-values.yaml
          echo 'ui:' >> stable/enterprise/ci/ci-values.yaml
          echo '  image: "docker.io/anchore/anchore-on-prem-ui-dev:nightly"' >> stable/enterprise/ci/ci-values.yaml
          echo "Appended to stable/enterprise/ci/ci-values.yaml"
        fi

    - name: Run chart-testing
      if: steps.list-changed.outputs.CHANGED == 'true'
      run: |
        ls -al
        echo ${PWD}
        files_changed="$(git diff --name-only origin/${TARGET_BRANCH} | sort | uniq)"
        charts_dirs_changed="$(echo "$files_changed" | xargs dirname | grep -o "stable/[^/]*" | sort | uniq || true)"
        for chart in ${charts_dirs_changed}; do
          # if distribution is openshift, then echo openshift-test.yaml
          if [[ "$CLUSTER_DISTRIBUTION" == "openshift" ]]; then
            echo "creating openshift-test-values.yaml for ${chart}"
            pushd "${chart}"
            rm -rvf ci/*-values.yaml
            mv ci/openshift-test.yaml ci/openshift-test-values.yaml
            popd
          fi
        done
        changed_charts=$(ct list-changed --config ct-config.yaml --target-branch "$TARGET_BRANCH")
        other_charts=$(echo "$changed_charts" | grep -v 'anchore-admission-controller' || true)
        if echo "$changed_charts" | grep -q 'anchore-admission-controller'; then
          if [[ -n "$other_charts" ]]; then
            echo "Admission controller changed alongside other charts. Installing other charts first, then admission controller."
            ct install --config ct-config.yaml --excluded-charts "anchore-admission-controller" --helm-extra-args "--timeout 600s"
          fi
          ct install --config ct-config.yaml --charts stable/anchore-admission-controller --helm-extra-args "--timeout 600s"
        else
          ct install --config ct-config.yaml --helm-extra-args "--timeout 600s"
        fi
      env:
        KUBECONFIG: ./tmp/kubeconfig
        TARGET_BRANCH: "${{ github.event.pull_request.base.ref }}"
        CLUSTER_DISTRIBUTION: ${{ matrix.cluster.distribution }}

    - name: Remove Cluster
      if: steps.list-changed.outputs.CHANGED == 'true'
      id: remove-cluster
      uses: replicatedhq/replicated-actions/remove-cluster@77121785951d05387334b773644c356885191f14 # v1
      continue-on-error: true # It could be that the cluster is already removed
      with:
        api-token: ${{ secrets.ANCHORECI_REPLICATED_API_TOKEN }}
        cluster-id: ${{ steps.create-cluster.outputs.cluster-id }}