main.yml

# Copyright 2021 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: CI

on:
  push:
    branches:
      - main
      - 'release-**'
  pull_request:
    branches:
      - main
      - 'release-**'

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - name: Extract version of Go to use
        run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOVERSION }}

      - name: Build
        run: make -C $GITHUB_WORKSPACE all
      - name: Fuzz-Build
        run: make -C $GITHUB_WORKSPACE fuzz
      - name: Test
        run: go test -v -coverprofile=coverage.txt -covermode=atomic ./...
      - name: Upload Coverage Report
        uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
        with:
          flags: unittests
      - name: Ensure no files were modified as a result of the build
        run: git update-index --refresh && git diff-index --quiet HEAD -- || git diff --exit-code

  container-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - name: Extract version of Go to use
        run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOVERSION }}

      - uses: ko-build/setup-ko@3aebd0597dc1e9d1a26bcfdb7cbeb19c131d3037 # v0.7

      - name: container
        run: |
          make ko-local
          docker run --rm $(cat rekorImagerefs) version
          docker run --rm $(cat cliImagerefs) version
          docker run --rm $(cat indexImagerefs) --version

  e2e:
    runs-on: ubuntu-latest
    needs: build

    steps:
      - name: download minisign
        run: |
          /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
          brew install minisign
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - name: Extract version of Go to use
        run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOVERSION }}
      - name: install gocovmerge
        run: make gocovmerge

      - name: CLI mysql index
        run: ./tests/e2e-test.sh
        env:
          INDEX_BACKEND: mysql
      - name: CLI redis index
        run: ./tests/e2e-test.sh
        env:
          INDEX_BACKEND: redis
      - name: Refactor-e2e mysql index # this will a WIP to move all the tests to respective packages
        run: ./e2e-test.sh
        env:
          INDEX_BACKEND: mysql
      - name: Refactor-e2e redis index # this will a WIP to move all the tests to respective packages
        run: ./e2e-test.sh
        env:
          INDEX_BACKEND: redis
      - name: Upload logs if they exist
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        if: failure()
        with:
          name: E2E Docker Compose logs
          path: /tmp/docker-compose.log
      - name: Upload Coverage Report
        uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
        with:
          files: /tmp/rekor-merged.cov,/tmp/pkg-rekor-merged.cov
          flags: e2etests

  backfill:
    runs-on: ubuntu-latest
    needs: build

    steps:
      - name: download minisign
        run: |
          /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
          brew install minisign
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - name: Extract version of Go to use
        run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOVERSION }}
      - name: Install backfill test dependencies
        run: |
          go install ./cmd/rekor-cli
          sudo add-apt-repository ppa:savoury1/minisign && sudo apt-get update && sudo apt-get install minisign
          sudo apt install redis-tools default-mysql-client -y
      - name: Backfill test redis
        run: ./tests/backfill-test.sh
        env:
          INDEX_BACKEND: redis
      - name: Backfill test mysql
        run: ./tests/backfill-test.sh
        env:
          INDEX_BACKEND: mysql
      - name: Cleanup index test
        run: ./tests/cleanup-index-test.sh
        env:
          INDEX_BACKEND: redis
      - name: Copy index test
        run: ./tests/copy-index-test.sh
      - name: Upload logs if they exist
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        if: failure()
        with:
          name: E2E Docker Compose logs
          path: /tmp/docker-compose.log

  sharding-e2e:
    runs-on: ubuntu-latest
    needs: build

    steps:
      - name: download minisign
        run: |
          /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
          brew install minisign
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - name: Docker Build
        run: docker compose build
      - name: Extract version of Go to use
        run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOVERSION }}

      - name: Sharding Test
        run: ./tests/sharding-e2e-test.sh
      - name: Upload logs if they exist
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        if: failure()
        with:
          name: Sharding E2E Docker Compose logs
          path: /tmp/docker-compose.log

  issue-872-e2e:
    runs-on: ubuntu-latest
    needs: build

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - name: Docker Build
        run: docker compose build
      - name: Extract version of Go to use
        run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOVERSION }}

      - name: Test for Attestation begin returned that was previously persisted in tlog
        run: ./tests/issue-872-e2e-test.sh
      - name: Upload logs if they exist
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        if: failure()
        with:
          name: Docker Compose logs
          path: /tmp/*docker-compose.log

  harness:
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Create git branch
        run: git switch -c harness-test-branch

      - name: Extract version of Go to use
        run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV

      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOVERSION }}
          check-latest: true

      - name: Run test harness
        run: ./tests/rekor-harness.sh

      - name: Upload logs if they exist
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        if: failure()
        with:
          name: E2E Docker Compose logs
          path: /tmp/docker-compose.log