preview.yml

name: Pull request preview

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read

concurrency:
  group: preview-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  preview:
    name: Ephemeral kind preview
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    env:
      PR_NUMBER: ${{ github.event.pull_request.number }}
      CLUSTER_NAME: sgsc-pr-${{ github.event.pull_request.number }}
      KUBECONFIG: ${{ github.workspace }}/.local/sgsc-pr-${{ github.event.pull_request.number }}.kubeconfig
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Install checksum-verified tools
        run: make tools
      - name: Create isolated preview cluster
        run: ./scripts/preview-cluster.sh create
      - name: Build and deploy pull request revision
        run: make deploy-local
      - name: Start preview access tunnel
        run: |
          kubectl -n sgsc-dev port-forward service/frontend 8081:8080 > /tmp/preview-port-forward.log 2>&1 &
          echo "PORT_FORWARD_PID=$!" >> "$GITHUB_ENV"
      - name: Run post-reconciliation smoke test
        run: make smoke-k8s
      - name: Capture preview evidence
        if: always()
        run: |
          mkdir -p artifacts/preview
          kubectl -n sgsc-dev get all -o wide > artifacts/preview/resources.txt 2>&1 || true
          kubectl -n sgsc-dev get events --sort-by=.metadata.creationTimestamp > artifacts/preview/events.txt 2>&1 || true
          kubectl kustomize environments/dev > artifacts/preview/rendered.yaml
          cp /tmp/preview-port-forward.log artifacts/preview/ 2>/dev/null || true
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: always()
        with:
          name: preview-${{ github.event.pull_request.number }}-evidence
          path: artifacts/preview/
          retention-days: 14
      - name: Deterministic cleanup
        if: always()
        env:
          CONFIRM: sgsc-pr-${{ github.event.pull_request.number }}
        run: ./scripts/preview-cluster.sh delete