ci-cd.yaml

name: Continous Integration and Demo Deployment
concurrency: ci-${{ github.ref }}
on:
  push:
    tags-ignore:
      - '*'
    branches:
      - 'main'
  pull_request:
  release:
    types: [published]
  workflow_dispatch:

env:
  PACKAGE_NAME: trento
  OBS_USER: ${{ secrets.OBS_USER }}
  OBS_PASS: ${{ secrets.OBS_PASS }}
  OBS_PROJECT: ${{ secrets.OBS_PROJECT}}
  TARGET_PROJECT: ${{ secrets.TARGET_PROJECT}}
  FOLDER: packaging/suse
  REPOSITORY: ${{ github.repository }}

jobs:
  test-binary:
    runs-on: ubuntu-20.04
    services:
      postgres:
        image: bitnami/postgresql:14.1.0-debian-10-r30
        env:
          POSTGRESQL_USERNAME: postgres
          POSTGRESQL_PASSWORD: postgres
          POSTGRESQL_DATABASE: trento_test
        ports:
          - 5432:5432
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-go@v2
        with:
          go-version: 1.16
      - uses: actions/setup-node@v2
        with:
          node-version: "15"
      - uses: actions/cache@v2
        id: go-cache
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-
      - uses: actions/cache@v2
        id: npm-cache
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-
      - name: get git tags
        run: git fetch --prune --unshallow --tags
      - name: install-mockery
        run: go install github.com/vektra/mockery/v2
      - name: test
        run: make test
      - name: static analysis
        run: make vet-check
      - name: coding styles
        run: make fmt-check
      - name: frontend lint and coding style check
        run: make web-check

  test-checks:
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v2.3.1
        with:
          python-version: 3.7
      - uses: actions/cache@v2
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-python-${{ hashFiles('requirements.dev.txt') }}
      - name: install python dependencies
        run: pip install -r requirements.dev.txt
      - name: ansible playbooks and roles lint check
        run: |
          ansible-lint -vv -x role-name,risky-shell-pipe,no-tabs -w yaml \
            runner/ansible/* runner/ansible/roles/* \
            runner/ansible/roles/checks/* runner/ansible/vars/*
      - name: trento checks ID sanity test
        run: python3 hack/id_checker.py

  test-e2e:
    needs: build-static-binary
    runs-on: ubuntu-20.04
    container: cypress/browsers:node16.5.0-chrome94-ff93
    services:
      postgres:
        image: bitnami/postgresql:14.1.0-debian-10-r30
        env:
          POSTGRESQL_USERNAME: postgres
          POSTGRESQL_PASSWORD: postgres
          POSTGRESQL_DATABASE: trento
        ports:
          - 5432:5432
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Download trento binary
        uses: actions/download-artifact@v2
        with:
          name: trento-binaries
          path: /tmp
      - name: Prepare Trento binary and Photofinish for e2e testing
        run: |
          set -x
          wget -P /tmp https://github.com/trento-project/photofinish/releases/download/v1.0.2/photofinish
          chmod +x /tmp/photofinish
          tar -C /tmp/ -xzf /tmp/trento-amd64.tgz
      - name: Cypress run
        uses: cypress-io/github-action@v2
        env:
          cypress_db_host: postgres
          cypress_db_port: 5432
          cypress_trento_binary: /tmp/trento
          cypress_photofinish_binary: /tmp/photofinish
        with:
          start: /tmp/trento web serve --log-level=error --db-host=postgres
          working-directory: test/e2e
          headless: true
          wait-on-timeout: 30
          config: baseUrl=http://localhost:8080,chromeWebSecurity=false
      - name: Upload cypress test videos
        uses: actions/upload-artifact@v2
        if: failure()
        with:
          name: e2e-videos
          path: test/e2e/cypress/videos/


  build-and-push-container-images:
    runs-on: ubuntu-20.04
    if: github.event_name == 'release' || (github.event_name == 'push' && github.ref_name == 'main') || github.event_name == 'workflow_dispatch'
    needs: [test-binary, test-checks, test-e2e]
    strategy:
      matrix:
        image:
          - trento-web
          - trento-runner
    permissions:
      contents: read
      packages: write
    env:
      REGISTRY: ghcr.io
      IMAGE_REPOSITORY: ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}
      IMAGE_TAG: "${{ (github.event_name == 'release' && github.event.release.tag_name) || (github.event_name == 'push' && github.ref_name == 'main' && 'rolling') || github.sha }}"
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0
      - uses: docker/setup-buildx-action@v1
      - name: Log in to the Container registry
        uses: docker/login-action@42d299face0c5c43a0487c477f595ac9cf22f1a7
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@e5622373a38e60fb6d795a4421e56882f2d7a681
        with:
          images: ${{ env.IMAGE_REPOSITORY }}
      - name: Build and push container image
        uses: docker/build-push-action@v2
        with:
          context: .
          push: true
          target: ${{ matrix.image }}
          tags: ${{ env.IMAGE_REPOSITORY }}:${{ env.IMAGE_TAG }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-and-export-container-images:
    runs-on: ubuntu-20.04
    needs: [test-binary, test-checks, test-e2e]
    strategy:
      matrix:
        image:
          - trento-web
          - trento-runner
    permissions:
      contents: read
      packages: write
    env:
      REGISTRY: ghcr.io
      IMAGE_REPOSITORY: ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}
      IMAGE_TAG: "${{ (github.event_name == 'release' && github.event.release.tag_name) || (github.event_name == 'push' && github.ref_name == 'main' && 'rolling') || github.sha }}"
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0
      - uses: docker/setup-buildx-action@v1
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@e5622373a38e60fb6d795a4421e56882f2d7a681
        with:
          images: ${{ env.IMAGE_REPOSITORY }}
      - name: Create image artifact
        uses: docker/build-push-action@v2
        with:
          context: .
          push: false
          target: ${{ matrix.image }}
          tags: ${{ env.IMAGE_REPOSITORY }}:${{ env.IMAGE_TAG }}
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=docker,dest=/tmp/${{ matrix.image }}.tar
      - name: Upload artifact
        uses: actions/upload-artifact@v2
        with:
          name: ${{ matrix.image }}
          path: /tmp/${{ matrix.image }}.tar

  smoke-test-container-images:
    runs-on: ubuntu-20.04
    needs: build-and-export-container-images
    strategy:
      matrix:
        image:
          - trento-web
          - trento-runner
    env:
      REGISTRY: ghcr.io
      IMAGE_REPOSITORY: ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}
      IMAGE_TAG: "${{ (github.event_name == 'release' && github.event.release.tag_name) || (github.event_name == 'push' && github.ref_name == 'main' && 'rolling') || github.sha }}"
    steps:
      - uses: docker/setup-buildx-action@v1
      - name: Download artifact
        uses: actions/download-artifact@v2
        with:
          name: ${{ matrix.image }}
          path: /tmp
      - name: Load image
        run: docker load --input /tmp/${{ matrix.image }}.tar
      - name: Test CLI
        run: docker run --rm ${{ env.IMAGE_REPOSITORY }}:${{ env.IMAGE_TAG }} version

  test-helm-charts:
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0
      - uses: azure/setup-helm@v2.0
        with:
          version: v3.4.0
      - uses: actions/setup-python@v2.3.1
        with:
          python-version: 3.7
      - name: Set up chart-testing
        uses: helm/chart-testing-action@v2.2.0
      - name: Lint
        run: ct lint --config=ct.yaml --lint-conf=helmlintconf.yaml

  build-static-binary:
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v2
        with:
          go-version: 1.16
      - uses: actions/setup-node@v2
        with:
          node-version: "15"
      - uses: actions/cache@v2
        id: go-cache
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-
      - uses: actions/cache@v2
        id: npm-cache
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-
      - name: build
        run: make -j4 cross-compiled
      - name: compress
        run: |
          set -x
          find ./build -maxdepth 1 -mindepth 1 -type d -exec sh -c 'tar -zcf build/trento-$(basename {}).tgz -C {} trento -C $(pwd) packaging/systemd/trento-agent.service' \;
      - uses: actions/upload-artifact@v2
        with:
          name: trento-binaries
          path: |
                  build/trento-amd64.tgz
                  build/trento-arm64.tgz
                  build/trento-ppc64le.tgz
                  build/trento-s390x.tgz

  release-rolling:
    needs: [test-binary, test-checks, test-e2e]
    if: (github.event_name == 'push' && github.ref == 'refs/heads/main')
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/download-artifact@v2
        with:
          name: trento-binaries
      - uses: "marvinpinto/action-automatic-releases@v1.2.1"
        with:
          repo_token: "${{ secrets.GITHUB_TOKEN }}"
          automatic_release_tag: "rolling"
          prerelease: true
          title: "Cutting Edge"
          files: |
            trento-amd64.tgz
            trento-arm64.tgz
            trento-ppc64le.tgz
            trento-s390x.tgz

  # This job doesn't actually make release, but rather reacts to a manual one, made via the GitHub UI.
  # In the future, we might want to reuse the same mechanism of the rolling ones to automate everything here as well.
  release-tag:
    needs: [test-binary, test-checks, test-e2e]
    if: github.event.release
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/download-artifact@v2
        with:
          name: trento-binaries
      - uses: AButler/upload-release-assets@v2.0
        with:
          files: "trento-*"
          repo-token: ${{ secrets.GITHUB_TOKEN }}

  deploy-server:
    runs-on: [ self-hosted, trento-gh-runner ]
    needs: [ smoke-test-container-images, build-and-push-container-images, test-helm-charts, release-rolling ]
    if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'workflow_dispatch'
    environment: AZURE_DEMO
    env:
      TRENTO_SERVER_HOST: ${{ secrets.TRENTO_SERVER_HOST }}
      TRENTO_USER: ${{ secrets.TRENTO_USER }}
      TRENTO_REPO_OWNER: ${{ github.repository_owner }}
    steps:
      - uses: actions/checkout@v2
      - name: Install SSH key
        uses: shimataro/ssh-key-action@v2
        with:
          key: ${{ secrets.SSH_KEY }}
          name: id_rsa
          known_hosts: unnecessary
          if_key_exists: replace
          config: ${{ secrets.SSH_CONFIG }}
      - name: deploy trento services on K3S cluster
        run: ssh "$TRENTO_USER@$TRENTO_SERVER_HOST" "TRENTO_REPO_OWNER=$TRENTO_REPO_OWNER sudo --preserve-env=PATH,TRENTO_REPO_OWNER bash -s" -- < ./install-server.sh -r -p ~/.ssh/id_rsa

  deploy-agents:
    runs-on: [ self-hosted, trento-gh-runner ]
    needs: [ deploy-server ]
    if: github.ref_name == 'main'
    environment: AZURE_DEMO
    env:
      TRENTO_AGENT_HOSTS: ${{ secrets.TRENTO_AGENT_HOSTS }}
      TRENTO_USER: ${{ secrets.TRENTO_USER }}
      TRENTO_SERVER_HOST: ${{ secrets.TRENTO_SERVER_HOST }}
      TRENTO_REPO_OWNER: ${{ github.repository_owner }}
    steps:
      - uses: actions/checkout@v2
      - name: install and enable agents
        run: |
          set -ex
          for target_host in ${TRENTO_AGENT_HOSTS//,/ }
          do
            ssh "$TRENTO_USER@$target_host" "TRENTO_REPO_OWNER=$TRENTO_REPO_OWNER sudo --preserve-env=PATH,TRENTO_REPO_OWNER bash -s" -- < ./install-agent.sh "--rolling" "--use-tgz" "--ssh-address" "$target_host" "--server-ip" "$TRENTO_SERVER_HOST"
            ssh "$TRENTO_USER@$target_host" "sudo systemctl enable --now trento-agent.service"
          done

  obs-commit:
    needs: [test-binary, test-checks, test-e2e]
    runs-on: ubuntu-20.04
    if: github.ref == 'refs/heads/main' || github.event_name == 'release'
    container:
      image: ghcr.io/trento-project/continuous-delivery:master
      env:
        GITHUB_OAUTH_TOKEN:  ${{ secrets.GITHUB_TOKEN }}
    steps:
    - uses: actions/checkout@v2
      with:
        fetch-depth: 0
    - name: configure OSC
    # OSC credentials must be configured beforehand as the HOME variables cannot be changed from /github/home
    # that is used to run osc commands
      run: |
        /scripts/init_osc_creds.sh
        mkdir -p $HOME/.config/osc
        cp /root/.config/osc/oscrc $HOME/.config/osc
    - name: Prepare trento.changes file
    # The .changes file is updated only in release creation. This current task should be improved
    # in order to add the current rolling release notes
      if: github.event_name == 'release'
      run: |
        osc checkout $OBS_PROJECT trento trento.changes
        mv trento.changes $FOLDER
        VERSION=$(./hack/get_version_from_git.sh)
        TAG=$(echo $VERSION | cut -f1 -d+)
        hack/gh_release_to_obs_changeset.py $REPOSITORY -a shap-staff@suse.de -t $TAG -f $FOLDER/trento.changes
    - name: prepare _service file
      run: |
        VERSION=$(./hack/get_version_from_git.sh)
        sed -i 's~%%REVISION%%~${{ github.sha }}~' $FOLDER/_service && \
        sed -i 's~%%REPOSITORY%%~${{ github.repository }}~' $FOLDER/_service && \
        sed -i 's~%%VERSION%%~'"${VERSION}"'~' $FOLDER/_service
    - name: commit changes into OBS
      run: cp $FOLDER/_service . && /scripts/upload.sh

  obs-submit:
    needs: obs-commit
    runs-on: ubuntu-20.04
    if: github.event.release
    container:
      image: ghcr.io/trento-project/continuous-delivery:master
    steps:
    - uses: actions/checkout@v2
      with:
        fetch-depth: 0
    - name: configure OSC
      run: |
        /scripts/init_osc_creds.sh
        mkdir -p $HOME/.config/osc
        cp /root/.config/osc/oscrc $HOME/.config/osc
    - name: prepare _service file
      run: |
        VERSION=$(./hack/get_version_from_git.sh)
        sed -i 's~%%REVISION%%~${{ github.sha }}~' $FOLDER/_service && \
        sed -i 's~%%REPOSITORY%%~${{ github.repository }}~' $FOLDER/_service && \
        sed -i 's~%%VERSION%%~'"${VERSION}"'~' $FOLDER/_service
    - name: submit package
      run: cp $FOLDER/_service . && /scripts/submit.sh