shared-run-e2e-tests.yaml

name: Run Operator E2E Tests
on:
  workflow_call:
    inputs:
      operator_type:
        description: The operator type [public, gcp, azure, aws, aks]
        type: string
        default: public
      identity_scope:
        description: The identity scope [UID2, EUID]
        type: string
        default: UID2
      target_environment:
        description: The target environment [mock, integ, prod]
        type: string
        default: mock
      delay_operator_shutdown:
        description: If true, will automatically shut down operators after E2E tests. Defaults to true.
        type: boolean
        default: true

      operator_image_version:
        description: 'Image: Operator image version'
        type: string
        default: latest
      core_image_version:
        description: 'Image: Core image version'
        type: string
        default: latest
      optout_image_version:
        description: 'Image: Optout image version'
        type: string
        default: latest
      e2e_image_version:
        description: 'Image: E2E image version'
        type: string
        default: latest

      operator_branch:
        description: 'Config: Operator branch for config'
        type: string
        default: main
      core_branch:
        description: 'Config: Core branch for config'
        type: string
        default: main
      optout_branch:
        description: 'Config: Optout branch for config'
        type: string
        default: main
      admin_branch:
        description: 'Config: Admin branch for config'
        type: string
        default: main

      gcp_project:
        description: The name of the GCP project
        type: string
      gcp_service_account:
        description: The GCP service account
        type: string
      gcp_workload_identity_provider_id:
        description: The GCP workload identity provider ID
        type: string

      aws_region:
        description: The AWS region
        type: string
      aws_ami:
        description: The AWS AMI ID
        type: string
      aws_pcr0:
        description: The AWS PCR0
        type: string

env:
  REGISTRY: ghcr.io

  E2E_UID2_INTEG_GCP_ARGS_JSON: ${{ secrets.E2E_UID2_INTEG_GCP_ARGS_JSON }}
  E2E_UID2_INTEG_AWS_ARGS_JSON: ${{ secrets.E2E_UID2_INTEG_AWS_ARGS_JSON }}
  E2E_UID2_INTEG_AZURE_ARGS_JSON: ${{ secrets.E2E_UID2_INTEG_AZURE_ARGS_JSON }}
  E2E_UID2_INTEG_GCP_OPERATOR_API_KEY: ${{ secrets.E2E_UID2_INTEG_GCP_OPERATOR_API_KEY }}
  E2E_UID2_INTEG_AWS_OPERATOR_API_KEY: ${{ secrets.E2E_UID2_INTEG_AWS_OPERATOR_API_KEY }}

  E2E_UID2_PROD_GCP_ARGS_JSON: ${{ secrets.E2E_UID2_PROD_GCP_ARGS_JSON }}
  E2E_UID2_PROD_AZURE_ARGS_JSON: ${{ secrets.E2E_UID2_PROD_AZURE_ARGS_JSON }}
  E2E_UID2_PROD_AWS_ARGS_JSON: ${{ secrets.E2E_UID2_PROD_AWS_ARGS_JSON }}
  E2E_UID2_PROD_GCP_OPERATOR_API_KEY: ${{ secrets.E2E_UID2_PROD_GCP_OPERATOR_API_KEY }}
  E2E_UID2_PROD_AWS_OPERATOR_API_KEY: ${{ secrets.E2E_UID2_PROD_AWS_OPERATOR_API_KEY }}

  E2E_EUID_INTEG_AWS_ARGS_JSON: ${{ secrets.E2E_EUID_INTEG_AWS_ARGS_JSON }}
  E2E_EUID_INTEG_AWS_OPERATOR_API_KEY: ${{ secrets.E2E_EUID_INTEG_AWS_OPERATOR_API_KEY }}

  E2E_EUID_PROD_AWS_ARGS_JSON: ${{ secrets.E2E_EUID_PROD_AWS_ARGS_JSON }}
  E2E_EUID_PROD_AWS_OPERATOR_API_KEY: ${{ secrets.E2E_EUID_PROD_AWS_OPERATOR_API_KEY }}

  E2E_UID2_INTEG_AKS_OPERATOR_KEY: ${{ secrets.E2E_UID2_INTEG_AKS_OPERATOR_KEY }}
  E2E_UID2_PROD_AKS_OPERATOR_KEY: ${{ secrets.E2E_UID2_PROD_AKS_OPERATOR_KEY }}

jobs:
  e2e-test:
    name: E2E Test
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: read
      id-token: write
    outputs:
      gcp_instance_name: ${{ steps.start_gcp_private_operator.outputs.gcp_instance_name }}
      azure_container_group_name: ${{ steps.start_azure_private_operator.outputs.azure_container_group_name }}
      aws_stack_name: ${{ steps.start_aws_private_operator.outputs.aws_stack_name }}
    steps:
      - name: Log in to the Docker container registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout full history
        uses: actions/checkout@v4

      - name: Checkout uid2-operator repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.operator_branch }}
          repository: IABTechLab/uid2-operator
          path: uid2-operator

      - name: Checkout uid2-core repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.core_branch }}
          repository: IABTechLab/uid2-core
          path: uid2-core

      - name: Checkout uid2-optout repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.optout_branch }}
          repository: IABTechLab/uid2-optout
          path: uid2-optout

      - name: Checkout uid2-admin repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.admin_branch }}
          repository: IABTechLab/uid2-admin
          path: uid2-admin

      - name: Checkout uid2-shared-actions repo
        uses: actions/checkout@v4
        with:
          ref: v3
          repository: IABTechLab/uid2-shared-actions
          path: uid2-shared-actions

      - name: Checkout uid2-e2e repo
        uses: actions/checkout@v4
        with:
          repository: IABTechLab/uid2-e2e
          path: uid2-e2e

      - name: Create Docker network
        if: ${{ inputs.target_environment == 'mock' }}
        run: |
          docker network create e2e_default

      - name: Set up bore and determine URLs
        id: bore
        if: ${{ inputs.operator_type != 'public' }}
        env:
          BORE_URL: ${{ secrets.BORE_URL }}
          BORE_SECRET: ${{ secrets.BORE_SECRET }}
          IDENTITY_SCOPE: ${{ inputs.identity_scope }}
          TARGET_ENVIRONMENT: ${{ inputs.target_environment }}
        run: |
          bash uid2-shared-actions/scripts/setup_bore.sh

      - name: Prepare GCP metadata
        id: prepare_gcp_metadata
        if: ${{ inputs.operator_type == 'gcp' }}
        uses: IABTechLab/uid2-shared-actions/actions/prepare_gcp_metadata@v3
        with:
          operator_image_version: ${{ inputs.operator_image_version }}
          target_environment: ${{ inputs.target_environment }}
          gcp_service_account: ${{ inputs.gcp_service_account }}
          gcp_workload_identity_provider_id: ${{ inputs.gcp_workload_identity_provider_id }}

      - name: Prepare Azure metadata
        id: prepare_azure_metadata
        if: ${{ inputs.operator_type == 'azure' }}
        uses: IABTechLab/uid2-shared-actions/actions/prepare_azure_metadata@v3
        with:
          operator_image_version: ${{ inputs.operator_image_version }}
          target_environment: ${{ inputs.target_environment }}

      - name: Prepare AWS metadata
        id: prepare_aws_metadata
        if: ${{ inputs.operator_type == 'aws' }}
        uses: IABTechLab/uid2-shared-actions/actions/prepare_aws_metadata@v3
        with:
          identity_scope: ${{ inputs.identity_scope }}
          target_environment: ${{ inputs.target_environment }}
          aws_pcr0: ${{ inputs.aws_pcr0 }}

      - name: Start AKS cluster
        id: start_aks_cluster
        if: ${{ inputs.operator_type == 'aks' }}
        uses: IABTechLab/uid2-shared-actions/actions/start_aks_cluster@v3
        with:
          azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
          run_id: ${{ github.run_id }}

      - name: Get AKS operator key
        id: get_aks_operator_key
        if: ${{ inputs.operator_type == 'aks' }}
        shell: bash
        env:
          IDENTITY_SCOPE: ${{ inputs.identity_scope }}
          TARGET_ENVIRONMENT: ${{ inputs.target_environment }}
          ENCLAVE_PROTOCOL: azure-cc
        run: |
          bash uid2-shared-actions/scripts/get_operator_key.sh

      - name: Prepare AKS metadata
        id: prepare_aks_metadata
        if: ${{ inputs.operator_type == 'aks' }}
        uses: IABTechLab/uid2-shared-actions/actions/prepare_aks_metadata@v3
        with:
          operator_image_version: ${{ inputs.operator_image_version }}
          target_environment: ${{ inputs.target_environment }}
          bore_url_core: ${{ steps.bore.outputs.bore_url_core }}
          bore_url_optout: ${{ steps.bore.outputs.bore_url_optout }}
          operator_key: ${{ steps.get_aks_operator_key.outputs.OPERATOR_KEY }}
          run_id: ${{ github.run_id }}

      - name: Bring up Docker Compose
        id: docker-compose
        if: ${{ inputs.target_environment == 'mock' }}
        env:
          OPERATOR_VERSION: ${{ inputs.operator_image_version }}
          CORE_VERSION: ${{ inputs.core_image_version }}
          OPTOUT_VERSION: ${{ inputs.optout_image_version }}
          E2E_VERSION: ${{ inputs.e2e_image_version }}
          IDENTITY_SCOPE: ${{ inputs.identity_scope }}
          OPERATOR_TYPE: ${{ inputs.operator_type }}
          BORE_URL_CORE: ${{ steps.bore.outputs.bore_url_core }}
          BORE_URL_OPTOUT: ${{ steps.bore.outputs.bore_url_optout }}
          BORE_URL_LOCALSTACK: ${{ steps.bore.outputs.bore_url_localstack }}
        run: |
          bash uid2-shared-actions/scripts/prepare_resources_for_e2e_docker_compose.sh

      - name: Start GCP private operator
        id: start_gcp_private_operator
        if: ${{ inputs.operator_type == 'gcp' }}
        uses: IABTechLab/uid2-shared-actions/actions/start_gcp_private_operator@v3
        with:
          bore_url_core: ${{ steps.bore.outputs.bore_url_core }}
          bore_url_optout: ${{ steps.bore.outputs.bore_url_optout }}
          gcp_project: ${{ inputs.gcp_project }}
          gcp_service_account: ${{ inputs.gcp_service_account }}
          image_hash: ${{ steps.prepare_gcp_metadata.outputs.image_hash }}
          operator_key: ${{ steps.prepare_gcp_metadata.outputs.operator_key }}

      - name: Start Azure private operator
        id: start_azure_private_operator
        if: ${{ inputs.operator_type == 'azure' }}
        uses: IABTechLab/uid2-shared-actions/actions/start_azure_private_operator@v3
        with:
          bore_url_core: ${{ steps.bore.outputs.bore_url_core }}
          bore_url_optout: ${{ steps.bore.outputs.bore_url_optout }}
          template_file: ${{ steps.prepare_azure_metadata.outputs.template_file }}
          parameters_file: ${{ steps.prepare_azure_metadata.outputs.parameters_file }}
          azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
          target_environment: ${{ inputs.target_environment }}

      - name: Start AWS private operator
        id: start_aws_private_operator
        if: ${{ inputs.operator_type == 'aws' }}
        uses: IABTechLab/uid2-shared-actions/actions/start_aws_private_operator@v3
        with:
          bore_url_core: ${{ steps.bore.outputs.bore_url_core }}
          bore_url_optout: ${{ steps.bore.outputs.bore_url_optout }}
          bore_url_localstack: ${{ steps.bore.outputs.bore_url_localstack }}
          aws_region: ${{ inputs.aws_region }}
          aws_ami: ${{ inputs.aws_ami }}
          identity_scope: ${{ inputs.identity_scope }}
          target_environment: ${{ inputs.target_environment }}
          operator_key: ${{ steps.prepare_aws_metadata.outputs.operator_key }}

      - name: Start AKS private operator
        id: start_aks_private_operator
        if: ${{ inputs.operator_type == 'aks' }}
        uses: IABTechLab/uid2-shared-actions/actions/start_aks_private_operator@v3
        with:
          template_file: ${{ steps.prepare_aks_metadata.outputs.template_file }}
          azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
          run_id: ${{ github.run_id }}

      - name: Decide E2E test environment variables
        id: decide_env_var
        shell: bash
        env:
          OPERATOR_TYPE: ${{ inputs.operator_type }}
          IDENTITY_SCOPE: ${{ inputs.identity_scope }}
          TARGET_ENVIRONMENT: ${{ inputs.target_environment }}
          BORE_URL_CORE: ${{ steps.bore.outputs.bore_url_core }}
          BORE_URL_OPTOUT: ${{ steps.bore.outputs.bore_url_optout }}
          GCP_OPERATOR_URL: ${{ steps.start_gcp_private_operator.outputs.uid2_pipeline_e2e_operator_url }}
          AZURE_OPERATOR_URL: ${{ steps.start_azure_private_operator.outputs.uid2_pipeline_e2e_operator_url }}
          AWS_OPERATOR_URL: ${{ steps.start_aws_private_operator.outputs.uid2_pipeline_e2e_operator_url }}
          AKS_OPERATOR_URL: ${{ steps.start_aks_private_operator.outputs.uid2_pipeline_e2e_operator_url }}
        run: |
          bash uid2-shared-actions/scripts/decide_e2e_env.sh

      - name: Run E2E tests
        id: e2e
        uses: IABTechLab/uid2-shared-actions/actions/run_e2e_tests@v3
        with:
          e2e_network: ${{ steps.decide_env_var.outputs.e2e_network }}
          e2e_image_version: ${{ inputs.e2e_image_version }}
          e2e_suites: ${{ steps.decide_env_var.outputs.e2e_suites }}
          e2e_args_json: ${{ steps.decide_env_var.outputs.e2e_args_json }}
          e2e_env: ${{ steps.decide_env_var.outputs.e2e_env }}
          e2e_identity_scope: ${{ inputs.identity_scope }}
          e2e_phone_support: ${{ steps.decide_env_var.outputs.e2e_phone_support }}
          uid2_core_e2e_core_url: ${{ steps.decide_env_var.outputs.uid2_core_e2e_core_url }}
          uid2_core_e2e_optout_url: ${{ steps.decide_env_var.outputs.uid2_core_e2e_optout_url }}
          uid2_pipeline_e2e_core_url: ${{ steps.decide_env_var.outputs.uid2_pipeline_e2e_core_url }}
          uid2_pipeline_e2e_operator_url: ${{ steps.decide_env_var.outputs.uid2_pipeline_e2e_operator_url }}
          uid2_pipeline_e2e_operator_type: ${{ steps.decide_env_var.outputs.uid2_pipeline_e2e_operator_type }}
          uid2_pipeline_e2e_operator_cloud_provider: ${{ steps.decide_env_var.outputs.uid2_pipeline_e2e_operator_cloud_provider }}

      - name: Stop GCP private operator
        if: ${{ always() && !inputs.delay_operator_shutdown && inputs.operator_type == 'gcp' }}
        env:
          GCP_PROJECT: ${{ inputs.gcp_project }}
          SERVICE_ACCOUNT: ${{ inputs.gcp_service_account }}
          GCP_INSTANCE_NAME: ${{ steps.start_gcp_private_operator.outputs.gcp_instance_name }}
        run: |
          bash uid2-shared-actions/scripts/gcp/stop_gcp_enclave.sh

      - name: Stop Azure private operator
        if: ${{ always() && !inputs.delay_operator_shutdown && inputs.operator_type == 'azure' }}
        env:
          AZURE_CONTAINER_GROUP_NAME: ${{ steps.start_azure_private_operator.outputs.azure_container_group_name }}
        run: |
          bash uid2-shared-actions/scripts/azure/stop_azure_enclave.sh

      - name: Stop AWS private operator
        if: ${{ always() && !inputs.delay_operator_shutdown && inputs.operator_type == 'aws' }}
        env:
          AWS_STACK_NAME: ${{ steps.start_aws_private_operator.outputs.aws_stack_name }}
          AWS_REGION: ${{ inputs.aws_region }}
        run: |
            bash uid2-shared-actions/scripts/aws/stop_aws_enclave.sh

      - name: Stop AKS operator
        if: ${{ always() && !inputs.delay_operator_shutdown && inputs.operator_type == 'aks' }}
        env:
          RUN_ID: ${{ github.run_id }}
        run: |
            bash uid2-shared-actions/scripts/aks/stop_aks_enclave.sh

  e2e-test-cleanup:
    name: E2E Test Cleanup (Delayed Operator Shutdown)
    if: ${{ always() && inputs.delay_operator_shutdown && inputs.operator_type != 'public' }}
    needs: [e2e-test]
    runs-on: ubuntu-latest
    environment: 'e2e-test-cleanup'
    permissions:
      contents: write
      packages: read
      id-token: write
    steps:
      - name: Checkout uid2-shared-actions repo
        uses: actions/checkout@v4
        with:
          ref: v3
          repository: IABTechLab/uid2-shared-actions
          path: uid2-shared-actions

      - name: Stop GCP private operator
        if: ${{ inputs.operator_type == 'gcp' }}
        uses: IABTechLab/uid2-shared-actions/actions/stop_gcp_private_operator@v3
        with:
          gcp_project: ${{ inputs.gcp_project }}
          gcp_service_account: ${{ inputs.gcp_service_account }}
          gcp_workload_identity_provider_id: ${{ inputs.gcp_workload_identity_provider_id }}
          gcp_instance_name: ${{ needs.e2e-test.outputs.gcp_instance_name }}

      - name: Stop Azure private operator
        if: ${{ inputs.operator_type == 'azure' }}
        uses: IABTechLab/uid2-shared-actions/actions/stop_azure_private_operator@v3
        with:
          azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
          azure_container_group_name: ${{ needs.e2e-test.outputs.azure_container_group_name }}

      - name: Stop AWS private operator
        if: ${{ inputs.operator_type == 'aws' }}
        uses: IABTechLab/uid2-shared-actions/actions/stop_aws_private_operator@v3
        with:
          aws_stack_name: ${{ needs.e2e-test.outputs.aws_stack_name }}
          aws_region: ${{ inputs.aws_region }}

      - name: Stop AKS private operator
        if: ${{ inputs.operator_type == 'aks' }}
        uses: IABTechLab/uid2-shared-actions/actions/stop_aks_private_operator@v3
        with:
          azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
          run_id: ${{ github.run_id }}