.reusable-integration-test.yml

name: integration-test

permissions: {}

on:
  workflow_call:
    inputs:
      build_registry:
        description: "Workflow build registry used for testing"
        type: string
      repo_owner:
        description: 'Name of repository owner, e.g. "inputs.repo_owner" for ghcr.io'
        type: string
      build_image_repository:
        description: "Workflow build image used for testing, excluding the tag i.e. registry + repository"
        type: string
      build_tag:
        description: "Tag of build image used for testing"
        type: string
      skip:
        description: "Want to skip running certain jobs 'none', 'non-required', 'all'?"
        type: string
        default: "none"

env:
  IMAGEPULLSECRET: dockerconfigjson-ghcr

jobs:
  integration-test:
    name: functional
    runs-on: ubuntu-latest
    if: inputs.skip != 'all'
    permissions:
      packages: read
    env:
      IMAGE: ${{ inputs.build_image_repository }}
      TAG: ${{ inputs.build_tag }}
    strategy:
      fail-fast: false
      matrix:
        integration-test-arg:
          [
            "basic",
            "autofix",
            "audit",
          ]
    steps:
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Login with registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ inputs.build_registry }}
          username: ${{ inputs.repo_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Install yq
        run: |
          sudo snap install yq
      - uses: ./.github/actions/k8s-version-config
        name: Setup k8s cluster
        with:
          k8s-version: v1.25
      - name: Run test
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_TEST_APP_TOKEN }}
        run: |
          bash tests/integration/main.sh "${{ matrix.integration-test-arg }}"
      - name: Display semgr8s configuration
        if: always()
        run: |
          echo "::group::values.yaml"
          yq e '... comments=""' charts/semgr8s/values.yaml
          echo "::endgroup::"
      - name: Display k8s state if integration test failed
        if: failure()
        run: |
          kubectl describe deployments.apps -n semgr8ns -lapp.kubernetes.io/name=semgr8s
          kubectl describe pods -n semgr8ns -lapp.kubernetes.io/name=semgr8s
      - name: Display logs if integration test failed
        if: failure()
        run: |
          kubectl logs -n semgr8ns -lapp.kubernetes.io/name=semgr8s --prefix=true --tail=-1

  optional-integration-test:
    name: optional
    runs-on: ubuntu-latest
    if: |
      inputs.skip != 'non-required' &&
      inputs.skip != 'all'
    permissions:
      packages: read
    env:
      IMAGE: ${{ inputs.build_image_repository }}
      TAG: ${{ inputs.build_tag }}
    strategy:
      fail-fast: false
      matrix:
        integration-test-arg:
          [
            "remote_rules",
            "semgrep_login",
          ]
    steps:
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Login with registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ inputs.build_registry }}
          username: ${{ inputs.repo_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Install yq
        run: |
          sudo snap install yq
      - uses: ./.github/actions/k8s-version-config
        name: Setup k8s cluster
        with:
          k8s-version: v1.25
      - name: Run test
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_TEST_APP_TOKEN }}
        run: |
          bash tests/integration/main.sh "${{ matrix.integration-test-arg }}"
      - name: Display semgr8s configuration
        if: always()
        run: |
          echo "::group::values.yaml"
          yq e '... comments=""' charts/semgr8s/values.yaml
          echo "::endgroup::"
      - name: Display k8s state if integration test failed
        if: failure()
        run: |
          kubectl describe deployments.apps -n semgr8ns -lapp.kubernetes.io/name=semgr8s
          kubectl describe pods -n semgr8ns -lapp.kubernetes.io/name=semgr8s
      - name: Display logs if integration test failed
        if: failure()
        run: |
          kubectl logs -n semgr8ns -lapp.kubernetes.io/name=semgr8s --prefix=true --tail=-1

  k8s-versions:
    name: k8s versions
    runs-on: ubuntu-latest
    if: inputs.skip != 'all'
    permissions:
      packages: read
    env:
      IMAGE: ${{ inputs.build_image_repository }}
      TAG: ${{ inputs.build_tag }}
    strategy:
      fail-fast: false
      matrix:
        k8s-version: [
            "v1.27",
            "v1.28",
            "v1.29",
            "v1.30",
          ]
    steps:
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Login with registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ inputs.build_registry }}
          username: ${{ inputs.repo_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Install yq
        run: |
          sudo snap install yq
      - uses: ./.github/actions/k8s-version-config
        name: Setup k8s cluster
        with:
          k8s-version: ${{ matrix.k8s-version }}
      - name: Run basic tests
        run: |
          bash tests/integration/main.sh "basic"
      - name: Display k8s state and logs if integration test failed
        if: failure()
        run: |
          kubectl describe deployments.apps -n semgr8ns -lapp.kubernetes.io/name=semgr8s
          kubectl describe pods -n semgr8ns -lapp.kubernetes.io/name=semgr8s
          kubectl logs -n semgr8ns -lapp.kubernetes.io/name=semgr8s --prefix=true --tail=-1
      - name: Display semgr8s configuration
        if: always()
        run: |
          echo "::group::values.yaml"
          yq e '... comments=""' charts/semgr8s/values.yaml
          echo "::endgroup::"

  optional-k8s-versions:
    name: optional k8s versions
    runs-on: ubuntu-latest
    if: |
      inputs.skip != 'non-required' &&
      inputs.skip != 'all'
    permissions:
      packages: read
    env:
      IMAGE: ${{ inputs.build_image_repository }}
      TAG: ${{ inputs.build_tag }}
    strategy:
      fail-fast: false
      matrix:
        k8s-version: [
            "v1.20",
            "v1.21",
            "v1.22",
            "v1.23",
            "v1.24",
            "v1.25",
            "v1.26",
          ]
    steps:
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Login with registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ${{ inputs.build_registry }}
          username: ${{ inputs.repo_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Install yq
        run: |
          sudo snap install yq
      - uses: ./.github/actions/k8s-version-config
        name: Setup k8s cluster
        with:
          k8s-version: ${{ matrix.k8s-version }}
      - name: Run basic tests
        run: |
          bash tests/integration/main.sh "basic"
      - name: Display k8s state and logs if integration test failed
        if: failure()
        run: |
          kubectl describe deployments.apps -n semgr8ns -lapp.kubernetes.io/name=semgr8s
          kubectl describe pods -n semgr8ns -lapp.kubernetes.io/name=semgr8s
          kubectl logs -n semgr8ns -lapp.kubernetes.io/name=semgr8s --prefix=true --tail=-1
      - name: Display semgr8s configuration
        if: always()
        run: |
          echo "::group::values.yaml"
          yq e '... comments=""' charts/semgr8s/values.yaml
          echo "::endgroup::"