Implement fully automated end-to-end CI testing workflow

.github/workflows/e2e_test.yaml

@@ -0,0 +1,191 @@
+name: End-to-End Test
+
+on:
+  pull_request:
+
+jobs:
+  build-charm:
+    name: Build Charm
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Remove Unnecessary Components
+        run: |
+          rm -rf .git
+          rm -rf .github
+
+      - name: Write lxd-profile.yaml
+        run: |
+          cat << EOF > ./lxd-profile.yaml
+          config:
+            security.nesting: true
+            security.privileged: true
+            raw.lxc: |
+              lxc.apparmor.profile=unconfined
+              lxc.mount.auto=proc:rw sys:rw cgroup:rw
+              lxc.cgroup.devices.allow=a
+              lxc.cap.drop=
+          devices:
+            kmsg:
+              path: /dev/kmsg
+              source: /dev/kmsg
+              type: unix-char
+          EOF
+
+      - name: Cache github-runner Charm
+        uses: actions/cache@v3
+        id: cache-charm
+        with:
+          path: github-runner_ubuntu-22.04-amd64.charm
+          key: github-runner-charm-${{ hashFiles('**/*') }}
+
+      - name: Setup LXD
+        if: steps.cache-charm.outputs.cache-hit != 'true'
+        uses: canonical/setup-lxd@main
+
+      - name: Install charmcraft
+        if: steps.cache-charm.outputs.cache-hit != 'true'
+        run: sudo snap install charmcraft --classic
+
+      - name: Pack github-runner Charm
+        if: steps.cache-charm.outputs.cache-hit != 'true'
+        run: charmcraft pack || ( cat ~/.local/state/charmcraft/log/* && exit 1 )
+
+      - name: Upload github-runner Charm
+        uses: actions/upload-artifact@v3
+        with:
+          name: dangerous-test-only-github-runner_ubuntu-22.04-amd64.charm
+          path: github-runner_ubuntu-22.04-amd64.charm
+
+  run-id:
+    name: Generate Run ID
+    runs-on: ubuntu-latest
+    outputs:
+      run-id: ${{ steps.run-id.outputs.run-id }}
+    steps:
+      - name: Generate Run ID
+        id: run-id
+        run: |
+          echo "run-id=e2e-$(LC_ALL=C tr -dc 'a-z' < /dev/urandom | head -c8)" >> $GITHUB_OUTPUT
+
+  deploy-e2e-test-runner:
+    name: Deploy End-to-End Test Runner
+    runs-on: ubuntu-latest
+    needs: [ build-charm, run-id ]
+    steps:
+      - name: Setup Lxd Juju Controller
+        uses: charmed-kubernetes/actions-operator@main
+        with:
+          juju-channel: 3.1/stable
+          provider: lxd
+
+      - name: Install GitHub Cli
+        run: which gh || sudo apt install gh -y
+
+      - name: Create Testing Juju Model
+        run: juju add-model testing
+
+      - name: Set Testing Model Proxy Configuration
+        run: |
+          juju model-config juju-http-proxy=$http_proxy
+          juju model-config juju-https-proxy=$https_proxy
+          juju model-config juju-no-proxy=$no_proxy
+
+      - name: Change Testing Model Logging Level
+        run: juju model-config logging-config="<root>=INFO;unit=DEBUG"
+
+      - name: Download github-runner Charm
+        uses: actions/download-artifact@v3
+        with:
+          name: dangerous-test-only-github-runner_ubuntu-22.04-amd64.charm
+
+      - name: Deploy github-runner Charm
+        run: |
+          cp github-runner_ubuntu-22.04-amd64.charm /home/$USER/github-runner_ubuntu-22.04-amd64.charm
+          juju deploy /home/$USER/github-runner_ubuntu-22.04-amd64.charm \
+            ${{ needs.run-id.outputs.run-id }} \
+            --base [email protected] \
+            --config path=${{ secrets.E2E_TESTING_REPO }} \
+            --config token=${{ secrets.E2E_TESTING_TOKEN }} \
+            --config virtual-machines=1 \
+            --config test-mode=insecure
+
+      - name: Watch github-runner
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        timeout-minutes: 30
+        run: |
+          juju debug-log --replay --tail &
+
+          while :; do
+            JOBS=$(gh api \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            /repos/${{ secrets.E2E_TESTING_REPO }}/actions/runs/$GITHUB_RUN_ID/attempts/$GITHUB_RUN_ATTEMPT/jobs)
+            CONCLUSION=$(echo $JOBS | jq -r '.jobs[] | select(.name == "End-to-End Test") | .conclusion')
+            STATUS=$(echo $JOBS | jq -r '.jobs[] | select(.name == "End-to-End Test") | .status')
+            if [[ $STATUS != "queued" && $STATUS != "in_progress" ]]; then
+              break
+            fi
+            sleep 10
+          done
+          if [[ $STATUS != "completed" || $CONCLUSION != "success" ]]; then
+            echo "test workflow failed with status: $STATUS, conclusion: $CONCLUSION"
+            kill $(jobs -p)
+            exit 1
+          fi
+
+  e2e-test:
+    name: End-to-End Test
+    needs: [ build-charm, run-id ]
+    runs-on: [ self-hosted, linux, x64, "${{ needs.run-id.outputs.run-id }}" ]
+    steps:
+      - name: Echo hello world
+        run: echo "hello world"
+      - name: File permission for /usr/local/bin
+        run: ls -ld /usr/local/bin | grep drwxrwxrwx
+      - name: Test file permission for /usr/local/bin
+        run: touch /usr/local/bin/test_file
+      # "Install microk8s" step will test if the proxies settings are correct.
+      - name: Proxy set in /etc/environment
+        run: cat /etc/environment
+      # "Update apt in python docker container" step will test docker default proxy settings due to
+      # pulling the python image.
+      - name: Proxy set in docker daemon
+        run: |
+          [[ -z "${http_proxy}" && -z "${HTTP_PROXY}" ]] \
+            || sudo cat /etc/systemd/system/docker.service.d/http-proxy.conf | grep HTTP_PROXY
+      # "Update apt in python docker container" step will test docker client default proxy settings.
+      - name: Proxy set in docker client
+        run: |
+          [[ -z "${http_proxy}" && -z "${HTTP_PROXY}" ]] \
+            || cat /home/ubuntu/.docker/config.json | grep httpProxy
+      - name: Install microk8s
+        run: sudo snap install microk8s --classic
+      - name: Wait for microk8s
+        timeout-minutes: 10
+        run: sudo microk8s status --wait-ready
+      - name: Deploy nginx for testing
+        run: sudo microk8s kubectl create deployment nginx --image=nginx
+      - name: Wait for nginx to be ready
+        run: sudo microk8s kubectl rollout status deployment/nginx --timeout=30m
+      - name: Update apt in python docker container
+        run: docker run python:3.10-slim apt update
+      - name: Docker version
+        run: docker version
+      - name: pip version
+        run: python3 -m pip --version
+      - name: npm version
+        run: npm --version
+      - name: shellcheck version
+        run: shellcheck --version
+      - name: jq version
+        run: jq --version
+      - name: yq version
+        run: yq --version
+      - name: install check-jsonschema
+        run: python3 -m pip install check-jsonschema
+      # Test program installed by pip. The directory `~/.local/bin` need to be added to PATH.
+      - name: test check-jsonschema
+        run: check-jsonschema --version

.github/workflows/test.yaml

@@ -1,7 +1,7 @@
 name: Tests
 
 on:
-  pull_request:
+  pull_request: { }
 
 jobs:
   unit-tests:

.gitignore

@@ -5,3 +5,4 @@ placeholders/
 *.charm
 build/
 .coverage
+lxd-profile.*

config.yaml

@@ -52,3 +52,8 @@ options:
     default: 60
     description: >
       Minutes between each check for new versions of the runner binary.
+  test-mode:
+    type: string
+    description: >
+      When set to 'insecure', the charm test mode is activated, which may deactivate some security
+      hardening measures.

src/charm.py

@@ -30,6 +30,7 @@
 from errors import RunnerError, SubprocessError
 from event_timer import EventTimer, TimerDisableError, TimerEnableError
 from github_type import GitHubRunnerStatus
+from runner import LXD_PROFILE_YAML
 from runner_manager import RunnerManager, RunnerManagerConfig
 from runner_type import GitHubOrg, GitHubRepo, ProxySetting, VirtualMachineResources
 from utilities import execute_command, get_env_var, retry
@@ -122,7 +123,10 @@ def __init__(self, *args, **kargs) -> None:
                 class.
         """
         super().__init__(*args, **kargs)
-
+        if LXD_PROFILE_YAML.exists():
+            if self.config.get("test-mode") != "insecure":
+                raise RuntimeError("lxd-profile.yaml detected outside test mode")
+            logger.critical("test mode is enabled")
         self._event_timer = EventTimer(self.unit.name)
 
         self._stored.set_default(
@@ -135,7 +139,9 @@ def __init__(self, *args, **kargs) -> None:
             self.proxies["http"] = http_proxy
         if https_proxy := get_env_var("JUJU_CHARM_HTTPS_PROXY"):
             self.proxies["https"] = https_proxy
-        if no_proxy := get_env_var("JUJU_CHARM_NO_PROXY"):
+        # there's no need for no_proxy if there's no http_proxy or https_proxy
+        no_proxy = get_env_var("JUJU_CHARM_NO_PROXY")
+        if (https_proxy or http_proxy) and no_proxy:
             self.proxies["no_proxy"] = no_proxy
 
         self.service_token = None