Continuous-Testing.yaml

name: Continuous image testing

on:
  schedule:
    - cron: "0 1 * * *"

jobs:
  prepare-test-matrix:
    runs-on: self-hosted-linux-amd64-noble-private-endpoint-small
    name: Prepare released image revisions to be tested
    outputs:
      released-revisions-matrix: ${{ steps.prepare-test-matrix.outputs.released-revisions-matrix }}
      last-scan: ${{ steps.last-scan.outputs.date }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
        with:
          python-version: "3.10"
      - run: pip install -r src/tests/requirements.txt

      - name: Fetch _releases.json
        uses: ./.github/actions/fetch-releases-json
        with:
          image-name: '*'

      - name: Prepare test matrix
        id: prepare-test-matrix
        env:
          OS_AUTH_URL: ${{ secrets.SWIFT_OS_AUTH_URL_PS7 }}
          OS_USERNAME: ${{ secrets.SWIFT_OS_USERNAME_PS7 }}
          OS_PASSWORD: ${{ secrets.SWIFT_OS_PASSWORD_PS7 }}
          OS_PROJECT_NAME: ${{ secrets.SWIFT_OS_TENANT_NAME_PS7 }}
          OS_STORAGE_URL: ${{ secrets.SWIFT_OS_STORAGE_URL_PS7 }}
          SWIFT_CONTAINER_NAME: ${{ vars.SWIFT_CONTAINER_NAME }}
        run: python3 -m src.tests.get_released_revisions --oci-images-path "$PWD/oci"

      - name: Infer date of last scan
        id: last-scan
        run: |
          # This is scheduled to run every day, so let's look at the previous
          # 26 hours, roughly
          set -e
          if [[ "$RUNNER_DEBUG" == "1" ]]; then
            set -x
          fi
          last_scan="$(date --date='26 hours ago' +'%Y-%m-%dT%H:%M:00Z')"
          echo "date=$last_scan" >> "$GITHUB_OUTPUT"

  run-tests:
    name: Run tests for released images
    needs: [prepare-test-matrix]
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.prepare-test-matrix.outputs.released-revisions-matrix) }}
    uses: ./.github/workflows/Vulnerability-Scan.yaml
    with:
      oci-image-name: "${{ matrix.source-image }}"
      oci-image-path: "oci/${{ matrix.name }}"
      trivyignore-path: ${{ matrix.ignored-vulnerabilities == '' && format('oci/{0}/.trivyignore', matrix.name) || '' }}
      ignored-vulnerabilities: ${{ matrix.ignored-vulnerabilities }}
      date-last-scan: ${{ needs.prepare-test-matrix.outputs.last-scan }}
      create-issue: true
    secrets: inherit