ci.yaml

name: CI

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]

env:
  BINK_COMMIT: 3ddb9da3b6e33f5dadd48abdb15ed550bbfe4f31

permissions: {}

concurrency:
  group: ci-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  supported-versions:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Get supported Kubernetes versions
        id: set-matrix
        run: |
          MATRIX=$(curl -s https://endoflife.date/api/kubernetes.json | \
            jq -c '[.[] | select(.eol > (now | strftime("%Y-%m-%d"))) | .cycle][:3]')
          echo "matrix=${MATRIX}" >> "$GITHUB_OUTPUT"

  unit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          cache: true # zizmor: ignore[cache-poisoning]

      - name: Check generated files
        run: |
          make fmt manifests generate
          git diff --exit-code || { echo "Run 'make fmt manifests generate' and commit the results"; exit 1; }

      - name: Unit tests
        run: make unit

      - name: Vet
        run: make vet

      - name: Lint
        run: make lint

  build-bink:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout bink
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: bootc-dev/bink
          ref: ${{ env.BINK_COMMIT }}
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          cache: true # zizmor: ignore[cache-poisoning]

      - name: Install build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libgpgme-dev \
            libbtrfs-dev \
            libdevmapper-dev \
            pkg-config

      - name: Build bink
        run: make build-bink

      - name: Upload bink binary
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bink
          path: bink

  build-operator:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Build operator image
        run: make buildimg

      - name: Save operator image
        run: podman save -o operator-image.tar bootc-operator:dev

      - name: Upload operator image
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: operator-image
          path: operator-image.tar

  e2e:
    runs-on: ubuntu-latest
    needs: [build-bink, build-operator, supported-versions]
    timeout-minutes: 30
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        kube-minor: ${{ fromJson(needs.supported-versions.outputs.matrix) }}
    env:
      BINK_NODE_DISK_IMAGE: ghcr.io/bootc-dev/bink/node:v${{ matrix.kube-minor }}-fedora-44-disk
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Download bink binary
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: bink
          path: /usr/local/bin

      - name: Make bink executable
        run: chmod +x /usr/local/bin/bink

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          cache: true # zizmor: ignore[cache-poisoning]

      - name: Set up KVM
        run: sudo chmod 666 /dev/kvm

      - name: Configure kernel
        run: |
          # Unload AppArmor profiles — the passt profile blocks remount
          # operations needed for passt's self-sandboxing inside containers.
          sudo aa-teardown 2>/dev/null || true
          # Allow unprivileged user namespace creation (needed by passt
          # inside containers).
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

      - name: Enable KSM
        run: |
          sudo sh -c 'echo 1 > /sys/kernel/mm/ksm/run'
          sudo sh -c 'echo 5000 > /sys/kernel/mm/ksm/pages_to_scan'

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y podman

      - name: Start podman socket
        run: systemctl --user start podman.socket

      - name: Download operator image
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: operator-image

      - name: Load operator image
        run: podman load -i operator-image.tar

      - name: Start bink cluster
        run: make start-bink

      - name: Deploy to bink cluster
        run: make deploy-bink

      - name: Gather deploy logs
        if: failure()
        run: make gather-bink

      - name: Run e2e tests
        run: make e2e V=1

      - name: Upload logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-logs-${{ matrix.kube-minor }}
          path: _output/logs/
          if-no-files-found: ignore

  push:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    needs: e2e
    permissions:
      contents: read
      packages: write
    env:
      IMAGE: ghcr.io/${{ github.repository }}
    steps:
      - name: Download operator image
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: operator-image

      - name: Load operator image
        run: podman load -i operator-image.tar

      - name: Push to GHCR
        env:
          ACTOR: ${{ github.actor }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SHA: ${{ github.sha }}
          REF: ${{ github.ref }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          podman login -u "${ACTOR}" -p "${GH_TOKEN}" ghcr.io
          podman push bootc-operator:dev "${IMAGE}":dev
          podman push bootc-operator:dev "${IMAGE}":"${SHA}"

          if [[ "${REF}" == refs/tags/v* ]]; then
            podman push bootc-operator:dev "${IMAGE}":"${REF_NAME}"
          fi

          if [[ "${REF}" == refs/heads/main ]]; then
            podman push bootc-operator:dev "${IMAGE}":latest
          fi