integration_test.yaml

# Copyright 2025 Canonical Ltd.
# See LICENSE file for licensing details.

name: Integration tests

on:
  workflow_call:
    inputs:
      bootstrap-options:
        description: |
          Additional options to pass to juju bootstrap, excluding constraints.
          See https://github.com/charmed-kubernetes/actions-operator#usage for details.
        type: string
      builder-runner-label:
        description: Label for building the charm
        type: string
        default: ubuntu-latest
      build-context:
        description: The directory to use as the build context for charmbuild
        type: string
        default: "."
      charmcraft-channel:
        description: Charmcraft channel to use for the integration test
        type: string
        default: latest/stable
      channel:
        description: Actions operator provider channel as per https://github.com/charmed-kubernetes/actions-operator#usage
        type: string
        default: latest/stable
      charm-directory:
        type: string
        description: The directory for the charm under the working-directory
        default: "."
      extra-arguments:
        description: Additional arguments to pass to the integration test execution
        type: string
      juju-channel:
        description: Actions operator juju channel as per https://github.com/charmed-kubernetes/actions-operator#usage
        type: string
        default: 2.9/stable
      build-lxd-channel:
        description: Snap channel to install LXD from in the build job via canonical/setup-lxd.
        type: string
        default: "latest/candidate"
      identifier:
        type: string
        description: >-
          Identifier for the integration test job: This is used to distinguish between multiple integration test jobs
          running within the same workflow. It is recommended to set this identifier to the job name.
        default: ""
      modules:
        description: List of testing modules to run the tests in JSON format, i.e. '["foo", "bar"]'. Each element will be passed to pytest through tox as -k argument
        type: string
        default: '[""]'
      pre-build-script:
        description: Path to the bash script to be run before the build step
        type: string
      pre-run-script:
        description: Path to the bash script to be run before the integration tests
        type: string
      provider:
        description: Actions operator provider as per https://github.com/charmed-kubernetes/actions-operator#usage
        type: string
        default: microk8s
      rockcraft-channel:
        description: Rockcraft channel to use for the integration test
        type: string
        default: latest/stable
      rockcraft-enable-security-nesting:
        description: Set security.nesting=true on the rockcraft lxc project to allow for nested containers.
        type: boolean
        default: false
      microk8s-addons:
        description: Microk8s provider add-ons override. A minimum set of addons (the defaults) must be enabled.
        type: string
        default: "dns ingress rbac storage"
      python-version:
        type: string
        required: false
        description: Python version to use when installing tox
        default: ""
      runs-on:
        type: string
        description: Image of the GitHub hosted runner to run the test job. This cannot be combined with self-hosted-runner=true.
      self-hosted-runner:
        type: boolean
        description: Whether to use self-hosted runners to run the jobs.
        default: false
      self-hosted-runner-arch:
        type: string
        description: Architecture to use on self-hosted runners to run the jobs.
        default: "x64"
      self-hosted-runner-image:
        type: string
        description: Image of the requested runner. Supports only 'jammy' or 'noble'.
        default: "noble"
      self-hosted-runner-label:
        type: string
        description: Label for selecting the self-hosted runners.
        default: "large"
      series:
        description: List of series to run the tests in JSON format, i.e. '["jammy", "focal"]'. Each element will be passed to pytest through tox as --series argument
        type: string
        default: '[""]'
      setup-devstack-swift:
        description: Use setup-devstack-swift action to prepare a swift server for testing.
        type: boolean
        default: false
      test-timeout:
        description: Timeout in minutes for the integration test.
        type: number
        default: 360
      test-tox-env:
        description: The tox environment name for the integration test.
        type: string
        default: "integration"
      tmate-debug:
        description: Use tmate debugging session on integration test failure.
        type: boolean
        default: false
      tmate-timeout:
        description: Timeout in minutes to keep tmate debugging session.
        type: number
        default: 30
      trivy-exit-code:
        description: Exit code when specified vulnerabilities are found.
        type: string
        default: '1'
      trivy-fs-enabled:
        type: boolean
        description: Whether Trivy testing of type fs is enabled. KEPT FOR COMPATIBILITY.
        default: false
      trivy-image-config:
        type: string
        description: Trivy YAML configuration for image testing that is checked in as part of the repo
      trivy-severity-config:
        type: string
        description: Trivy severity configuration for image testing
        default: "CRITICAL,HIGH"
      upload-image:
        type: string
        description: >-
          Can be either 'artifact' or 'registry', which determines the method by which images used 
          in integration tests are uploaded. If set to 'artifact', the images will be uploaded as GitHub 
          action artifacts. If set to 'registry', the images will be uploaded to ghcr. 
          If this parameter is not specified, the default behavior is to use 'artifact' for pull requests 
          originating from forked repositories, and 'registry' for all other cases.
        default: ""
      use-canonical-k8s:
        type: boolean
        description: (Experimental) Whether to use canonical k8s instead of microk8s
        default: false
      with-uv:
        type: boolean
        description: Whether to use tox with uv
        required: false
        default: false
      working-directory:
        type: string
        description: The working directory for jobs
        default: "./"

env:
  REGISTRY: ghcr.io
  OWNER: ${{ github.repository_owner }}

jobs:
  plan:
    name: Plan
    runs-on: ${{ inputs.builder-runner-label }}
    outputs:
      plan: ${{ steps.plan.outputs.plan }}
      has-code-changes: ${{ steps.changes.outputs.has_code_changes }}
    steps:
      - name: Validate input
        run: |
          # exit if runs-on and self-hosted-runner is both set
            if [ -n "${{ inputs.runs-on }}" ] && [ "${{ inputs.self-hosted-runner }}" = "true" ]; then
                echo "::error Both runs-on and self-hosted-runner cannot be set at the same time."
                exit 1
            fi
      - uses: actions/checkout@v7.0.1
        with:
            fetch-depth: 0
      - uses: canonical/operator-workflows/internal/plan@main
        id: plan
        with:
          identifier: ${{ inputs.identifier }}
          upload-image: ${{ inputs.upload-image }}
          working-directory: ${{ inputs.working-directory }}

      - name: Find changes
        id: changes
        run: |
          has_code_changes=True
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            REMOTE=$(git remote show)
            CHANGED_FILES=$(git diff --name-only "$REMOTE/${{ github.event.pull_request.base.ref }}" "${{ github.event.pull_request.head.sha }}")
            IGNORED_PATTERNS="\.md$|\.rst$|\.custom_wordlist\.txt$|^LICENSE$"
            CODE_FILE_CHANGES=$(echo "$CHANGED_FILES" | grep -Ev "$IGNORED_PATTERNS" | wc -l)
            has_code_changes=$([[ $CODE_FILE_CHANGES -eq "0" ]] && echo 'False' || echo 'True')
          fi
          echo "has_code_changes=$has_code_changes" >> $GITHUB_OUTPUT

  build:
    name: Build ${{ matrix.build.type }} (${{ matrix.build.name }})
    needs: [ plan ]
    if: ${{ needs.plan.outputs.has-code-changes == 'True' && toJSON(fromJSON(needs.plan.outputs.plan).build) != '[]' }}
    runs-on: ${{ inputs.builder-runner-label }}
    strategy:
      matrix:
        build: ${{ fromJSON(needs.plan.outputs.plan).build }}
    steps:
      - uses: canonical/setup-lxd@v1
        with:
          channel: ${{ inputs.build-lxd-channel }}
      - name: Set LXC security nesting
        if: ${{ inputs.rockcraft-enable-security-nesting }}
        run: |
          lxc profile set default security.nesting true
      - uses: actions/checkout@v7.0.1
      - name: Pre-build script
        if: ${{ inputs.pre-build-script != '' }}
        run: bash -xe ${{ inputs.pre-build-script }}
      - name: Install charmcraft
        if: ${{ matrix.build.type == 'charm' }}
        run: sudo snap install charmcraft --channel ${{ inputs.charmcraft-channel }} --classic
        shell: bash
      - name: Detect pip --break-system-packages support
        if: ${{ matrix.build.type == 'charm' }}
        shell: bash
        run: |
          PIP_BREAK_FLAG='' # Guard against older versions of pip that don't have --break-system-packages
          if python3 -m pip install --help 2>/dev/null | grep -q -- '--break-system-packages'; then
            PIP_BREAK_FLAG='--break-system-packages'
          fi
          echo "PIP_BREAK_FLAG=${PIP_BREAK_FLAG}" >> "${GITHUB_ENV}"
      - name: Install get-workflow-version-action dependencies (self-hosted runners)
        if: ${{ matrix.build.type == 'charm' }}
        shell: bash
        run: |
          if ! dpkg -s python3-venv &> /dev/null; then
            sudo apt-get update
            sudo apt-get install -y python3-venv
          fi
          if ! command -v pipx &> /dev/null; then
            if apt-cache show pipx &> /dev/null; then
              sudo apt-get install -y pipx
            else
              python3 -m pip install --upgrade ${PIP_BREAK_FLAG} pip
              python3 -m pip install --user ${PIP_BREAK_FLAG} pipx
              python3 -m pipx ensurepath
              echo "${HOME}/.local/bin" >> "${GITHUB_PATH}"
            fi
          fi
      - name: Get workflow version
        id: workflow-version
        if: ${{ matrix.build.type == 'charm' }}
        uses: canonical/get-workflow-version-action@v1.0.4
        with:
          repository-name: canonical/operator-workflows
          file-name: integration_test.yaml
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Install charmbuild
        if: ${{ matrix.build.type == 'charm' }}
        run: |
          # upgrade setuptools & wheel package to avoid UNKNOWN charmbuild installation
          python3 -m pip install --upgrade ${PIP_BREAK_FLAG} pip setuptools wheel
          python3 -m pip install ${PIP_BREAK_FLAG} git+https://github.com/canonical/operator-workflows@${{ steps.workflow-version.outputs.sha }}#subdirectory=charmbuild
        shell: bash
      - name: Install rockcraft
        if: ${{ matrix.build.type == 'rock' }}
        run: sudo snap install rockcraft --channel ${{ inputs.rockcraft-channel }} --classic
        shell: bash
      - uses: canonical/operator-workflows/internal/build@main
        id: build
        with:
          build-plan: ${{ toJSON(matrix.build) }}
          build-context: ${{ inputs.build-context }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

  plan-scan:
    name: Plan Image Scanning
    runs-on: ${{ inputs.builder-runner-label }}
    needs: [ build, plan ]
    outputs:
      scans: ${{ steps.plan-scan.outputs.scans }}
    steps:
      - uses: canonical/operator-workflows/internal/plan-scan@main
        id: plan-scan
        with:
          plan: ${{ needs.plan.outputs.plan }}

  scan:
    name: Scan Image (${{ matrix.scan.file }})
    runs-on: ${{ inputs.builder-runner-label }}
    needs: [ build, plan-scan ]
    if: ${{ needs.plan-scan.outputs.scans != '[]' }}
    strategy:
      matrix:
        scan: ${{ fromJSON(needs.plan-scan.outputs.scans) }}
    steps:
      - uses: actions/checkout@v7.0.1
      - name: Change directory
        run: |
          TEMP_DIR=$(mktemp -d)
          cp -rp ./${{ inputs.working-directory }}/. $TEMP_DIR
          rm -rf .* * || :
          cp -rp $TEMP_DIR/. .
          rm -rf $TEMP_DIR
          ls -lah
      - uses: actions/download-artifact@v8.0.1
        if: matrix.scan.artifact != ''
        with:
          name: ${{ matrix.scan.artifact }}
      - if: endsWith( matrix.scan.file, '.rock')
        run: |
          sudo snap install rockcraft --channel ${{ inputs.rockcraft-channel }} --classic
          rockcraft.skopeo copy oci-archive:${{ matrix.scan.file }} docker-archive:${{ matrix.scan.file }}.tar
          mv ${{ matrix.scan.file }}.tar ${{ matrix.scan.file }}
      - uses: docker/login-action@v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - if: matrix.scan.image != ''
        run: |
          docker image pull ${{ matrix.scan.image }}
          docker image save -o ${{ matrix.scan.file }} ${{ matrix.scan.image }}
      - name: Run Github Trivy Image Action (temporarily disabled)
        if: ${{ false }}
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          input: ${{ matrix.scan.file }}
          trivy-config: ${{ inputs.trivy-image-config }}
          exit-code: ${{ inputs.trivy-exit-code }}
          severity: ${{ inputs.trivy-severity-config }}
        env:
          TRIVY_DISABLE_VEX_NOTICE: true
      - name: Check trivyignore
        if: matrix.scan.image != ''
        run: |
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.69.2
          if [ -f ".trivyignore" ]
          then
            ignored_cves=$(trivy image "$ROCK_IMAGE" \
              --severity "CRITICAL,HIGH" \
              --show-suppressed \
              -q -f json \
              | jq -r '.Results[].ExperimentalModifiedFindings[]? 
                      | select(.Status == "ignored") 
                      | .Finding.VulnerabilityID' \
              | sort -u)
            # Loop through .trivyignore and check if each CVE is still ignored
            line=0
            while read -r CVE; do
              line=$(( line + 1 ))
              [[ "$CVE" =~ ^#.*$ || -z "$CVE" ]] && continue
              if ! grep -q -F "$CVE" <<< "$ignored_cves"; then
                echo "$CVE" >> unused_cves.txt
              fi
            done < .trivyignore

            # If unused CVEs found, post PR comment
            if [ -s unused_cves.txt ]; then
              {
                echo "### Unused entries in .trivyignore"
                echo "Image: $ROCK_IMAGE"
                echo ""
                echo "The following CVEs are in \`.trivyignore\` but not ignored by Trivy anymore:"
                echo ""
                cat unused_cves.txt | sed 's/^/- /'
              } > pr_comment.md

              gh pr comment ${{ github.event.number }} --repo ${{ github.repository }} --body-file pr_comment.md || true
            fi
          fi
        env:
          TRIVY_USERNAME: ${{ github.actor }}
          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          ROCK_IMAGE: ${{ matrix.scan.image }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  integration-test:
    name: Integration tests
    uses: ./.github/workflows/integration_test_run.yaml
    needs: [ plan ]
    if: always() && needs.plan.result == 'success' && needs.plan.outputs.has-code-changes == 'True'
    secrets: inherit
    with:
      bootstrap-options: ${{ inputs.bootstrap-options }}
      channel: ${{ inputs.channel }}
      extra-arguments: ${{ inputs.extra-arguments }}
      juju-channel: ${{ inputs.juju-channel }}
      microk8s-addons: ${{ inputs.microk8s-addons }}
      modules: ${{ inputs.modules }}
      owner: ${{ github.repository_owner }}
      plan: ${{ needs.plan.outputs.plan }}
      pre-run-script: ${{ inputs.pre-run-script }}
      provider: ${{ inputs.provider }}
      python-version: ${{ inputs.python-version }}
      use-canonical-k8s: ${{ inputs.use-canonical-k8s }}
      runs-on: ${{ inputs.runs-on || 'ubuntu-24.04' }}
      self-hosted-runner-arch: ${{ inputs.self-hosted-runner-arch }}
      self-hosted-runner-image: ${{ inputs.self-hosted-runner-image }}
      self-hosted-runner-label: ${{ inputs.self-hosted-runner-label }}
      self-hosted-runner: ${{ inputs.self-hosted-runner }}
      series: ${{ inputs.series }}
      setup-devstack-swift: ${{ inputs.setup-devstack-swift }}
      test-timeout: ${{ inputs.test-timeout }}
      test-tox-env: ${{ inputs.test-tox-env }}
      tmate-debug: ${{ inputs.tmate-debug }}
      tmate-timeout: ${{ inputs.tmate-timeout }}
      with-uv: ${{ inputs.with-uv }}
      working-directory: ${{ inputs.working-directory }}
  required_status_checks:
    name: Required Integration Test Status Checks
    runs-on: ${{ inputs.builder-runner-label }}
    needs:
      - build
      - integration-test
      - scan
    if: always() && !cancelled()
    timeout-minutes: 5
    steps:
      - run: |
          [ '${{ needs.scan.result }}' = 'skipped' ] || [ '${{ needs.scan.result }}' = 'success' ] || (echo scan failed && false)
          [ '${{ needs.build.result }}' = 'skipped' ] || [ '${{ needs.build.result }}' = 'success' ] || (echo build failed && false)
          [ '${{ needs.integration-test.result }}' = 'skipped' ] || [ '${{ needs.integration-test.result }}' = 'success' ] || (echo integration-test failed && false)