Pr/jrajahalme/drop privileges #374
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI run integration tests | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| # By specifying the access of one of the scopes, all of those that are not specified are set to 'none'. | |
| permissions: | |
| # To be able to access the repository with actions/checkout | |
| contents: read | |
| jobs: | |
| proxylib: | |
| timeout-minutes: 360 | |
| name: Run unit tests for proxylib | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Install Go | |
| uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 | |
| with: | |
| # renovate: datasource=golang-version depName=go | |
| go-version: 1.20.5 | |
| - name: Checkout code | |
| uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 | |
| with: | |
| persist-credentials: false | |
| - name: Check module vendoring | |
| run: | | |
| go mod tidy | |
| go mod vendor | |
| test -z "$(git status --porcelain)" || (echo "please run 'go mod tidy && go mod vendor', and submit your changes"; exit 1) | |
| - name: Run unit tests | |
| run: | | |
| make -C proxylib test | |
| tests: | |
| timeout-minutes: 360 | |
| name: Run integration tests on amd64 | |
| runs-on: ubuntu-latest-64-cores-256gb | |
| steps: | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1 | |
| - name: Login to quay.io | |
| uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 | |
| with: | |
| registry: quay.io | |
| username: ${{ secrets.QUAY_ENVOY_USERNAME_DEV }} | |
| password: ${{ secrets.QUAY_ENVOY_PASSWORD_DEV }} | |
| - name: Enable Docker IPv6 | |
| run: | | |
| modprobe -v ipv6 | |
| sudo sed -i -e '1s!^{!\{ "ipv6": true, "fixed-cidr-v6": "fd00::/80",!' /etc/docker/daemon.json || echo '{ "ipv6": true, "fixed-cidr-v6": "fd00::/80" }' | sudo tee /etc/docker/daemon.json | |
| sudo systemctl restart docker | |
| - name: Cache Docker layers | |
| uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1 | |
| with: | |
| path: /tmp/buildx-cache | |
| key: docker-cache-tests | |
| restore-keys: docker-cache-master | |
| - name: Checkout PR Source Code | |
| uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| persist-credentials: false | |
| - name: Prep for build | |
| run: | | |
| echo "${{ github.event.pull_request.head.sha }}" >SOURCE_VERSION | |
| echo "ENVOY_VERSION=$(cat ENVOY_VERSION)" >> $GITHUB_ENV | |
| echo "BAZEL_VERSION=$(cat .bazelversion)" >> $GITHUB_ENV | |
| echo "BUILDER_DOCKER_HASH=$(git ls-tree --full-tree HEAD -- ./Dockerfile.builder.tests | awk '{ print $3 }')" >> $GITHUB_ENV | |
| - name: Checking if cilium-envoy-builder image exists | |
| id: cilium-builder-tests-tag-in-repositories | |
| shell: bash | |
| run: | | |
| if docker buildx imagetools inspect quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:test-${{ env.BAZEL_VERSION }}-${{ env.BUILDER_DOCKER_HASH }} &>/dev/null; then | |
| echo exists="true" >> $GITHUB_OUTPUT | |
| else | |
| echo exists="false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: PR Multi-arch build & push of Builder image (dev) | |
| uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4.1.1 | |
| if: steps.cilium-builder-tests-tag-in-repositories.outputs.exists == 'false' | |
| id: docker_build_builder_tests_ci | |
| with: | |
| provenance: false | |
| context: . | |
| file: ./Dockerfile.builder.tests | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:test-${{ env.BAZEL_VERSION }}-${{ env.BUILDER_DOCKER_HASH }} | |
| - name: Run integration tests on amd64 | |
| uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4.1.1 | |
| id: docker_tests_ci | |
| with: | |
| provenance: false | |
| context: . | |
| file: ./Dockerfile.tests | |
| platforms: linux/amd64 | |
| build-args: | | |
| BUILDER_BASE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:test-${{ env.BAZEL_VERSION }}-${{ env.BUILDER_DOCKER_HASH }} | |
| ARCHIVE_IMAGE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder:test-main-archive-latest | |
| BAZEL_BUILD_OPTS=--remote_upload_local_results=false | |
| BAZEL_TEST_OPTS=--test_timeout=300 --local_test_jobs=1 | |
| cache-from: type=local,src=/tmp/buildx-cache | |
| push: false |