build_and_test.yaml

name: Build and Test
on:
  pull_request:
    branches:
      - "main"
      # Release branches are like "release/v0.1", "release/v0.2", etc. where we backport the changes to non EOL versions.
      # The branch will be created from the main branch after the initial release tag is cut. For example, when we cut v0.8.0 release,
      # we will create a branch "release/v0.8" from the main branch. For rc release, we simply iterate on main branch.
      #
      # See RELEASES.md for more details.
      - "release/**"

  push:
    branches:
      - "main"
      - "release/**"

concurrency:
  # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-concurrency-to-cancel-any-in-progress-job-or-run
  group: ${{ github.ref }}-${{ github.workflow }}-${{ github.actor }}-${{ github.event_name }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: write
  id-token: write

jobs:
  changes:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - uses: dorny/paths-filter@f3ceefdc7ef57bc2d8560787d4b6c33e44044cec
        id: changes
        with:
          filters: |
            code:
              - '!**/*.md'
              - '!docs/**'
              - '!site/**'
              - '!netlify.toml'
          predicate-quantifier: every # Make the filters be AND-ed
          token: "" # don't use github api
    outputs:
      code: ${{ steps.changes.outputs.code }}

  unittest:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    name: Unit Test
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v5
        with:
          cache: false
          go-version-file: go.mod
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
            ~/go/bin
          key: unittest-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}-${{ matrix.os }}
      - run: make test-coverage GO_TEST_ARGS='-race'
      - name: Upload coverage to Codecov
        if: matrix.os == 'ubuntu-latest'
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2
        with:
          fail_ci_if_error: true
          files: ./out/go-test-coverage.out
          name: codecov-envoy-ai-gateway
          verbose: true
          # https://github.com/codecov/codecov-action/issues/1594#issuecomment-2394913029
          use_oidc: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) }}

  test_crdcel:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    name: CRD CEL Validation Test
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v5
        with:
          cache: false
          go-version-file: go.mod
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
            ~/go/bin
          key: controller-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}-${{ matrix.os }}
      - run: make test-crdcel

  test_controller:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    name: Controller Test
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v5
        with:
          cache: false
          go-version-file: go.mod
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
            ~/go/bin
          key: controller-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}-${{ matrix.os }}
      - run: make test-controller

  test_data_plane:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    name: Data Plane Test (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v5
        with:
          cache: false
          go-version-file: go.mod
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
            ~/go/bin
          key: data-plane-tests-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
      - env:
          TEST_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_BEDROCK_USER_AWS_ACCESS_KEY_ID }}
          TEST_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_BEDROCK_USER_AWS_SECRET_ACCESS_KEY }}
          TEST_OPENAI_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_OPENAI_API_KEY }}
          TEST_GEMINI_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_GEMINI_API_KEY }}
          TEST_COHERE_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_COHERE_API_KEY }}
          TEST_GROQ_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_GROQ_API_KEY }}
          TEST_GROK_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_GROK_API_KEY }}
          TEST_SAMBANOVA_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_SAMBANOVA_API_KEY }}
          TEST_DEEPINFRA_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_DEEPINFRA_API_KEY }}
        run: make test-data-plane

  test_data_plane_mcp:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    name: Data Plane MCP Test (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v5
        with:
          cache: false
          go-version-file: go.mod
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
            ~/go/bin
          key: data-plane-tests-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
      - run: make test-data-plane-mcp
        env:
          TEST_GITHUB_ACCESS_TOKEN: ${{ secrets.TEST_GITHUB_ACCESS_TOKEN }}

  test_e2e:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    # Not all the cases in E2E require secrets, so we run for all the events.
    name: E2E Test (Envoy Gateway ${{ matrix.name }})
    # TODO: make it possible to run this job on macOS as well, which is a bit tricky due to the nested
    # virtualization is not supported on macOS runners.
    # E.g. Use https://github.com/douglascamata/setup-docker-macos-action  per the comment in
    # https://github.com/actions/runner-images/issues/17#issuecomment-1971073406
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: latest
            envoy_gateway_version: v0.0.0-latest
          - name: v1.8.1
            envoy_gateway_version: v1.8.1
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v5
        with:
          cache: false
          go-version-file: go.mod
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
        with:
          path: |
            ~/.cache/go-build
            ~/.cache/golangci-lint
            ~/go/pkg/mod
            ~/go/bin
          key: e2e-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
      - env:
          EG_VERSION: ${{ matrix.envoy_gateway_version }}
          TEST_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_BEDROCK_USER_AWS_ACCESS_KEY_ID }}
          TEST_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_BEDROCK_USER_AWS_SECRET_ACCESS_KEY }}
          TEST_OPENAI_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_OPENAI_API_KEY }}
          TEST_ANTHROPIC_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_ANTHROPIC_API_KEY }}
          TEST_GEMINI_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_GEMINI_API_KEY }}
          TEST_COHERE_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_COHERE_API_KEY }}
        run: make test-e2e

  test_e2e_upgrade:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    name: E2E Test for Upgrades (k8s ${{ matrix.k8s-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        k8s-version:
          - v1.35.0
          - v1.34.3
          - v1.33.4
          - v1.32.8
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v5
        with:
          cache: false
          go-version-file: go.mod
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
        with:
          path: |
            ~/.cache/go-build
            ~/.cache/golangci-lint
            ~/go/pkg/mod
            ~/go/bin
          key: e2e-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
      - run: make test-e2e-upgrade
        env:
          # We only need to test the upgrade from the latest stable version of EG.
          EG_VERSION: v1.8.1
          K8S_VERSION: ${{ matrix.k8s-version }}

  test_e2e_inference_extension:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    name: E2E Test for Inference Extensions
    # TODO: make it possible to run this job on macOS as well, which is a bit tricky due to the nested
    # virtualization is not supported on macOS runners.
    # E.g. Use https://github.com/douglascamata/setup-docker-macos-action  per the comment in
    # https://github.com/actions/runner-images/issues/17#issuecomment-1971073406
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v5
        with:
          cache: false
          go-version-file: go.mod
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
        with:
          path: |
            ~/.cache/go-build
            ~/.cache/golangci-lint
            ~/go/pkg/mod
            ~/go/bin
          key: e2e-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
      - run: make test-e2e-inference-extension
        env:
          EG_VERSION: v1.8.1

  test_e2e_namespaced:
    needs: changes
    if: ${{ needs.changes.outputs.code == 'true' }}
    name: E2E Test for Namespaced Controller
    # TODO: make it possible to run this job on macOS as well, which is a bit tricky due to the nested
    # virtualization is not supported on macOS runners.
    # E.g. Use https://github.com/douglascamata/setup-docker-macos-action  per the comment in
    # https://github.com/actions/runner-images/issues/17#issuecomment-1971073406
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v5
        with:
          cache: false
          go-version-file: go.mod
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
        with:
          path: |
            ~/.cache/go-build
            ~/.cache/golangci-lint
            ~/go/pkg/mod
            ~/go/bin
          key: e2e-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
      - run: make test-e2e-namespaced
        env:
          # We only need to test with the latest stable version of EG, since these e2e tests
          # do not depend on the EG version.
          EG_VERSION: v1.8.1

  test_e2e_aigw:
    needs: changes
    name: E2E Test for aigw CLI
    if: ${{ needs.changes.outputs.code == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v5
        with:
          cache: false
          go-version-file: go.mod
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
        with:
          path: |
            ~/.cache/go-build
            ~/.cache/golangci-lint
            ~/go/pkg/mod
            ~/go/bin
          key: e2e-aigw-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
      - name: Start Ollama server
        run: |
          curl -fsSL https://ollama.com/install.sh | sh && sudo systemctl stop ollama
          nohup ollama serve > ollama.log 2>&1 &
          timeout 30 sh -c 'until nc -z localhost 11434; do sleep 1; done'
          grep _MODEL .env.ollama | cut -d= -f2 | xargs -I{} ollama pull {}
        env:
          OLLAMA_CONTEXT_LENGTH: 131072 # Larger context for goose
          OLLAMA_HOST: 0.0.0.0
      # Download Envoy via func-e using implicit default version `aigw` would
      # otherwise need to download during test runs.
      - name: Download Envoy via func-e
        run: go tool -modfile=tools/go.mod func-e run --version
        env:
          FUNC_E_DATA_HOME: ~/.local/share/aigw
      - name: Install Goose
        env:
          GOOSE_VERSION: v1.10.0
          OS: Linux
        run: |
          curl -fsSL https://github.com/block/goose/releases/download/stable/download_cli.sh | CONFIGURE=false bash
      - env:
          TEST_GITHUB_ACCESS_TOKEN: ${{ secrets.TEST_GITHUB_ACCESS_TOKEN }}
        run: make test-e2e-aigw
      - if: failure()
        run: cat ollama.log || true

  docker_push:
    # Docker builds are verified in test_e2e job, so we only need to push the images when the event is a push event.
    if: github.event_name == 'push'
    name: Push Docker Images
    needs: [ci-required]
    uses: ./.github/workflows/docker_build_job.yaml
    secrets: inherit

  helm_push:
    name: Push Helm chart
    # Only push the Helm chart to the GHR when merged into the main branch.
    if: github.event_name == 'push'
    needs: [docker_push]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - name: Login into DockerHub
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}
      - run: |
          make helm-push HELM_CHART_VERSION=v0.0.0-latest
          make helm-push HELM_CHART_VERSION=0.0.0-latest
          make helm-push HELM_CHART_VERSION=v0.0.0-${{ github.sha }} TAG=${{ github.sha }}
          make helm-push HELM_CHART_VERSION=0.0.0-${{ github.sha }} TAG=${{ github.sha }}

  # Aggregate all the required jobs and make it easier to customize CI required jobs
  ci-required:
    runs-on: ubuntu-latest
    needs:
      - unittest
      - test_crdcel
      - test_controller
      - test_e2e
      - test_e2e_upgrade
      - test_e2e_inference_extension
      - test_data_plane
      - test_data_plane_mcp
      - test_e2e_aigw
    # We need this to run always to force-fail (and not skip) if any needed
    # job has failed. Otherwise, a skipped job will not fail the workflow.
    if: always()
    steps:
      - run: |
          echo "CI required checks completed"
          if [ "${{
              contains(needs.*.result, 'failure') ||
              contains(needs.*.result, 'cancelled')
            }}" == "true" ]; then
            echo "Some required jobs have failed or were cancelled or skipped."
            exit 1
          fi