ci.yml

name: CI

on:
  push:
    branches:
      - main
      - release-*
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+*"
  pull_request:
    branches:
      - "**"
  schedule:
    - cron: "0 4 * * *" # run every day at 4am UTC

defaults:
  run:
    shell: bash

concurrency:
  group: ${{ github.ref_name }}-ci
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  vars:
    name: Checks and variables
    runs-on: ubuntu-22.04
    outputs:
      go_path: ${{ steps.vars.outputs.go_path }}
      min_k8s_version: ${{ steps.vars.outputs.min_k8s_version }}
      k8s_latest: ${{ steps.vars.outputs.k8s_latest }}
      helm_changes: ${{ steps.filter.outputs.charts }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: 0

      - name: Setup Golang Environment
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          go-version: stable
          cache-dependency-path: |
            go.sum
            .github/.cache/buster-for-vars

      - name: Check for changes
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: filter
        with:
          filters: |
            charts:
            - charts/nginx-gateway-fabric/**/*

      - name: Output Variables
        id: vars
        run: |
          echo "go_path=$(go env GOPATH)" >> $GITHUB_OUTPUT
          echo "min_k8s_version=v1.25.16" >> $GITHUB_OUTPUT
          echo "k8s_latest=$(grep -m1 'FROM kindest/node' <tests/Dockerfile | awk -F'[:]' '{print $2}')" >> $GITHUB_OUTPUT

      - name: Check if go.mod and go.sum are up to date
        run: go mod tidy && git diff --exit-code -- go.mod go.sum

      - name: Check if go.mod and go.sum are up to date in tests
        run: go mod tidy && git diff --exit-code -- go.mod go.sum
        working-directory: tests

      - name: Check if all the generated files are up to date
        run: make generate-all && git diff --exit-code

  unit-tests:
    name: Unit Tests
    runs-on: ubuntu-22.04
    needs: vars
    steps:
      - name: Checkout Repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup Golang Environment
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          go-version: stable
          cache-dependency-path: |
            go.sum
            .github/.cache/buster-for-unit-tests

      - name: Run Tests
        run: make unit-test

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Upload Coverage Report
        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
        with:
          name: cover-${{ github.run_id }}.html
          path: ${{ github.workspace }}/cover.html
        if: always()

  njs-unit-tests:
    name: NJS Unit Tests
    runs-on: ubuntu-22.04
    needs: vars
    steps:
      - name: Checkout Repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup Node.js Environment
        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
        with:
          node-version-file: .nvmrc

      - name: Run tests
        run: npm --prefix ${{ github.workspace }}/internal/mode/static/nginx/modules install-ci-test

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  binary:
    name: Build Binary
    runs-on: ubuntu-22.04
    needs: [vars, unit-tests, njs-unit-tests]
    permissions:
      contents: write # for goreleaser/goreleaser-action and lucacome/draft-release to create/update releases
      id-token: write # for goreleaser/goreleaser-action to sign artifacts
      issues: write # for goreleaser/goreleaser-action to close milestone
    steps:
      - name: Checkout Repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: 0

      - name: Setup Golang Environment
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          go-version: stable
          cache-dependency-path: |
            go.sum
            .github/.cache/buster-for-binary

      - name: Create/Update Draft
        uses: lucacome/draft-release@8a63d32c79a171ae6048e614a8988f0ac3ed56d4 # v1.1.0
        with:
          minor-label: "enhancement"
          major-label: "change"
          publish: ${{ github.ref_type == 'tag' }}
          collapse-after: 20
          notes-header: |
            *Below is the auto-generated changelog, which includes all PRs that went into the release.
            For a shorter version that highlights only important changes, see [CHANGELOG.md](https://github.com/nginxinc/nginx-gateway-fabric/blob/{{version}}/CHANGELOG.md).*
        if: ${{ github.event_name == 'push' && github.ref != 'refs/heads/main' }}

      - name: Download Syft
        uses: anchore/sbom-action/download-syft@d94f46e13c6c62f59525ac9a1e147a99dc0b9bf5 # v0.17.0
        if: github.ref_type == 'tag'

      - name: Install Cosign
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
        if: github.ref_type == 'tag'

      - name: Build binary
        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
        with:
          version: latest
          args: ${{ github.ref_type == 'tag' && 'release' || 'build --snapshot' }} --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GOPATH: ${{ needs.vars.outputs.go_path }}
          AZURE_STORAGE_ACCOUNT: ${{ secrets.AZURE_STORAGE_ACCOUNT }}
          AZURE_STORAGE_KEY: ${{ secrets.AZURE_STORAGE_KEY }}
          AZURE_BUCKET_NAME: ${{ secrets.AZURE_BUCKET_NAME }}
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_COMMUNITY }}
          TELEMETRY_ENDPOINT: oss.edge.df.f5.com:443
          TELEMETRY_ENDPOINT_INSECURE: "false"

      - name: Cache Artifacts
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: ${{ github.workspace }}/dist
          key: nginx-gateway-fabric-${{ github.run_id }}-${{ github.run_number }}

  build-oss:
    name: Build OSS images
    needs: [vars, binary]
    strategy:
      fail-fast: false
      matrix:
        image: [ngf, nginx]
        platforms: ["linux/arm64, linux/amd64"]
    uses: ./.github/workflows/build.yml
    with:
      image: ${{ matrix.image }}
      platforms: ${{ matrix.platforms }}
    permissions:
      contents: read # for docker/build-push-action to read repo content
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      packages: write # for docker/build-push-action to push to GHCR
      id-token: write # for docker/login to login to NGINX registry
    secrets: inherit

  build-plus:
    name: Build Plus images
    needs: [vars, binary]
    uses: ./.github/workflows/build.yml
    with:
      image: plus
      platforms: "linux/arm64, linux/amd64"
    permissions:
      contents: read # for docker/build-push-action to read repo content
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      packages: write # for docker/build-push-action to push to GHCR
      id-token: write # for docker/login to login to NGINX registry
    secrets: inherit

  functional-tests:
    name: Functional tests
    needs: [vars, build-oss, build-plus]
    strategy:
      fail-fast: false
      matrix:
        image: [nginx, plus]
        k8s-version:
          [
            "${{ needs.vars.outputs.min_k8s_version }}",
            "${{ needs.vars.outputs.k8s_latest }}",
          ]
    uses: ./.github/workflows/functional.yml
    with:
      image: ${{ matrix.image }}
      k8s-version: ${{ matrix.k8s-version }}
    permissions:
      contents: read

  conformance-tests:
    name: Conformance tests
    needs: [vars, build-oss, build-plus]
    strategy:
      fail-fast: false
      matrix:
        image: [nginx, plus]
        k8s-version:
          [
            "${{ needs.vars.outputs.min_k8s_version }}",
            "${{ needs.vars.outputs.k8s_latest }}",
          ]
        enable-experimental: [true, false]
    uses: ./.github/workflows/conformance.yml
    with:
      image: ${{ matrix.image }}
      k8s-version: ${{ matrix.k8s-version }}
      enable-experimental: ${{ matrix.enable-experimental }}
    permissions:
      contents: write

  helm-tests:
    name: Helm Tests
    needs: [vars, build-oss, build-plus]
    strategy:
      fail-fast: false
      matrix:
        image: [nginx, plus]
        k8s-version:
          [
            "${{ needs.vars.outputs.min_k8s_version }}",
            "${{ needs.vars.outputs.k8s_latest }}",
          ]
    uses: ./.github/workflows/helm.yml
    with:
      image: ${{ matrix.image }}
      k8s-version: ${{ matrix.k8s-version }}
    secrets: inherit
    if: ${{ needs.vars.outputs.helm_changes == 'true' || github.event_name == 'schedule' }}

  publish-helm:
    name: Package and Publish Helm Chart
    runs-on: ubuntu-22.04
    needs: [vars, helm-tests]
    if: ${{ github.event_name == 'push' && ! startsWith(github.ref, 'refs/heads/release-') }}
    permissions:
      contents: read
      packages: write # for helm to push to GHCR
    steps:
      - name: Checkout Repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Login to GitHub Container Registry
        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Package
        id: package
        run: |
          output=$(helm package ${{ github.ref_type != 'tag' && '--app-version edge --version 0.0.0-edge' || '' }} charts/nginx-gateway-fabric)
          echo "path=$(basename -- $(echo $output | cut -d: -f2))" >> $GITHUB_OUTPUT

      - name: Push to GitHub Container Registry
        run: |
          helm push ${{ steps.package.outputs.path }} oci://ghcr.io/nginxinc/charts