tests.yml

name: Tests
on:
  schedule:
    - cron: '0 0 * * 0' # Weekly on Sunday at 00:00 UTC
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

env:
  CGO_CFLAGS: -I/home/runner/go/deps/dqlite/include/
  CGO_LDFLAGS: -L/home/runner/go/deps/dqlite/.libs/
  LD_LIBRARY_PATH: /home/runner/go/deps/dqlite/.libs/
  CGO_LDFLAGS_ALLOW: (-Wl,-wrap,pthread_create)|(-Wl,-z,now)
  # Use the github.workspace variable to adapt the cover directory path based on the used runner.
  GOCOVERDIR: ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && format('{0}/cover', github.workspace) || '' }}

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    # Make sure bash is always invoked with `-eo pipefail`
    # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
    shell: bash

jobs:
  changes:
    if: ${{ github.repository_owner == 'canonical' }}
    name: Changes
    runs-on: ubuntu-slim
    outputs:
      except_docs: ${{ steps.check.outputs.changes }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Check for changes
        uses: ./.github/actions/check-changes
        id: check
        with:
          glob: ":!doc/*"

  code-tests:
    if: ${{ (needs.changes.outputs.except_docs == 'true' || github.event_name == 'schedule') && github.repository_owner == 'canonical' }}
    name: Code
    runs-on: ubuntu-22.04
    needs: [changes]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # A non-shallow clone is needed for the Differential ShellCheck
          fetch-depth: 0
          persist-credentials: false

      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: 'go.mod'

      - name: Check compatibility with min Go version
        run: |
          set -eux
          GOMIN="$(sed -n 's/^GOMIN=\([0-9.]\+\)$/\1/p' Makefile)"
          go mod tidy -go="${GOMIN}"

      - name: Dependency Review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        if: github.event_name == 'pull_request'

      - id: ShellCheck
        name: Differential ShellCheck
        uses: redhat-plumbers-in-action/differential-shellcheck@d965e66ec0b3b2f821f75c8eff9b12442d9a7d1e # v5.5.6
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          strict-check-on-push: true
        if: github.event_name == 'pull_request'

      - name: Upload artifact with ShellCheck defects in SARIF format
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: Differential ShellCheck SARIF
          path: ${{ steps.ShellCheck.outputs.sarif }}
        if: github.event_name == 'pull_request'

      - name: Install MicroCloud build dependencies
        uses: ./.github/actions/install-builddeps

      - name: Build
        run: |
          make deps
          make build-test

      - name: Run static analysis
        run: make check-static

      - name: Make GOCOVERDIR
        run: mkdir -p "${GOCOVERDIR}"
        if: env.GOCOVERDIR != ''

      - name: Unit tests
        run: |
          set -eux
          make check-unit

      - name: Upload coverage data
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-unit
          path: ${{env.GOCOVERDIR}}
        if: env.GOCOVERDIR != ''

      - name: Prepare dqlite dependencies for system tests
        run: |
          # Include dqlite libs in dependencies for system tests.
          mkdir /home/runner/go/bin/dqlite
          mv ~/go/deps/dqlite/include /home/runner/go/bin/dqlite/include
          mv ~/go/deps/dqlite/.libs /home/runner/go/bin/dqlite/libs

      - name: Upload system test dependencies
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: system-test-deps
          path: |
            /home/runner/go/bin/microcloud
            /home/runner/go/bin/microcloudd
            /home/runner/go/bin/dqlite
          retention-days: 1

  system-tests-core:
    env:
      DEBUG: "1"
      SKIP_VM_LAUNCH: "1"
      SNAPSHOT_RESTORE: "1"
    if: ${{ github.repository_owner == 'canonical' }}
    name: System (core)
    runs-on: ubuntu-24.04
    needs: code-tests
    strategy:
      fail-fast: false
      matrix:
        # Test suites that will be combined with the set versions.
        # Define this first in the matrix so that it's readable
        # after GitHub as formed the name for the respective check.
        suite:
          - "add_interactive"
          - "add_services"
          - "cluster_manager"
          - "e2e"
          - "instances"
          - "interactive"
          - "interactive_combinations"
          - "mismatch"
          - "non_ha"
          - "preseed"
          - "recover"
          - "remove_cluster"
          - "reuse_cluster"
          - "terraform_demo"
        # Set of versions to use for the matrix tests.
        os: ["24.04"]
        microceph: ["tentacle/edge"]
        microovn: ["latest/edge"]
        lxd:
          # Both LXD 5.21 and 6 are supported.
          - "5.21/edge"
          - "6/edge"
        microcloud: ["latest/edge"]
        exclude:
          # Exclude LXD 6 for regular development pipelines to speed up the result cycle.
          # But launch the LXD 6 tests both for schedules and manual workflow dispatch.
          - lxd: ${{ github.event_name != 'schedule' && github.event_name != 'workflow_dispatch' && '6/edge' }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: System test
        uses: ./.github/actions/system-test
        with:
          setup_testbed: ${{ matrix.suite != 'terraform_demo' }}
          setup_terraform: ${{ matrix.suite == 'e2e' || matrix.suite == 'terraform_demo' }}
          collect_coverage: ${{ matrix.suite != 'terraform_demo' }}

  system-tests-upgrade:
    env:
      DEBUG: "1"
      SKIP_VM_LAUNCH: "1"
      SNAPSHOT_RESTORE: "1"
    if: ${{ github.repository_owner == 'canonical' }}
    name: System (upgrade)
    runs-on: ubuntu-24.04
    needs: code-tests
    strategy:
      fail-fast: false
      matrix:
        suite: ["upgrade"]
        os:
          - "22.04"
          - "24.04"
        microceph:
          - "squid/stable"
        microovn: ["24.03/stable"]
        lxd: ["5.21/stable"]
        microcloud: ["2/candidate"]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: System test
        uses: ./.github/actions/system-test

  tics:
    name: Tiobe TICS
    runs-on: ubuntu-22.04
    needs: [system-tests-core, system-tests-upgrade]
    env:
      CGO_CFLAGS: "-I/home/runner/go/bin/dqlite/include/"
      CGO_LDFLAGS: "-L/home/runner/go/bin/dqlite/libs/"
      LD_LIBRARY_PATH: "/home/runner/go/bin/dqlite/libs/"
      CGO_LDFLAGS_ALLOW: "(-Wl,-wrap,pthread_create)|(-Wl,-z,now)"
    if: ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && github.ref_name == 'main' && github.repository_owner == 'canonical' }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: 'go.mod'

      - name: Download coverage data
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: coverage-*
          path: ${{env.GOCOVERDIR}}
          merge-multiple: true

      - name: Extract coverage data
        run: |
          find "${GOCOVERDIR}"/micro*/cover/ -type f -exec mv {} "${GOCOVERDIR}" \;
          rm -rf "${GOCOVERDIR}"/micro*
          ls -la "${GOCOVERDIR}"

      - name: Download system test dependencies
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: system-test-deps
          merge-multiple: true
          path: /home/runner/go/bin

      - name: Install MicroCloud build dependencies
        uses: ./.github/actions/install-builddeps

      - name: Install dependencies
        run: |
          go install github.com/afunix/gocov/gocov@latest
          go install github.com/b-dean/gocov-xml@v1.2.1-bdd.0 # XXX: Using this repo is a temporary workaround until https://github.com/AlekSi/gocov-xml/pull/20 is merged. See https://github.com/AlekSi/gocov-xml/pull/20#issuecomment-3275134132 for more details.
          go install honnef.co/go/tools/cmd/staticcheck@latest

      - name: Convert coverage files
        run: |
          go tool covdata textfmt -i="${GOCOVERDIR}" -o "${GOCOVERDIR}"/coverage.out
          gocov convert "${GOCOVERDIR}"/coverage.out > "${GOCOVERDIR}"/coverage.json
          gocov-xml < "${GOCOVERDIR}"/coverage.json > "${GOCOVERDIR}"/coverage-go.xml
          go tool covdata percent -i="${GOCOVERDIR}"

      - name: Run TICS
        uses: tiobe/tics-github-action@333078bc527399e5916a166bd1a3a788be5a01a9 # v3.12.0
        with:
          mode: qserver
          project: microcloud
          viewerUrl: https://canonical.tiobe.com/tiobeweb/TICS/api/cfg?name=GoProjects
          branchdir: ${{ github.workspace }}
          ticsAuthToken: ${{ secrets.TICSAUTHTOKEN }}
          installTics: true
          calc: ALL
          tmpdir: /tmp/tics

  doc-tests:
    name: Documentation
    uses: canonical/documentation-workflows/.github/workflows/documentation-checks.yaml@aaeaf091e8f55145184ad897cb9834f224bd31de # main
    with:
      working-directory: './doc'
      makefile: 'Makefile'
      python-version: '3.12'

  snap:
    name: Trigger snap build
    runs-on: ubuntu-24.04
    needs: [code-tests, system-tests-core, system-tests-upgrade, doc-tests]
    if: ${{ github.repository_owner == 'canonical' && github.event_name == 'push' && github.actor != 'dependabot[bot]' }}
    env:
      SSH_AUTH_SOCK: /tmp/ssh_agent.sock
      LATEST_MAJOR_VERSION: 3
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # A non-shallow clone is needed for the push to Launchpad.
          fetch-depth: 0
          persist-credentials: false

      # XXX: from this point onwards in this **specific job**, the private SSH key is
      #      available through the SSH_AUTH_SOCK environment variable.
      - uses: canonical/lxd/.github/actions/lp-snap-build@main # zizmor: ignore[unpinned-uses]
        with:
          repo: "git+ssh://lxdbot@git.launchpad.net/~microcloud-snap/microcloud"
          ssh-key: ${{ secrets.LAUNCHPAD_LXD_BOT_KEY }} # zizmor: ignore[secrets-outside-env]

      - name: Trigger Launchpad snap build
        run: |
          set -eux
          set -o pipefail

          # Record current commit hash.
          localRev="$(git rev-parse HEAD)"

          # Extract a strict major.minor[.patch] version.
          version="$(sed -nE 's/^const RawVersion = "([0-9]+\.[0-9]+(\.[0-9]+)?)"$/\1/p' "${GITHUB_WORKSPACE}/version/version.go")"

          if [ -z "${version}" ]; then
            echo "ERROR: Invalid version format in version/version.go. Expected format: n.n or n.n.n" >&2
            exit 1
          fi

          # Code branch                              Launchpad branch
          # main                                  -> latest-edge
          # vX-edge                               -> vX-edge
          # release-${LATEST_MAJOR_VERSION}.Y(.Z) -> latest-candidate
          # release-X.Y(.Z)                       -> vX-candidate
          if [ "${GITHUB_REF_NAME}" = "main" ]; then
            BRANCH="latest-edge"
          elif [[ "${GITHUB_REF_NAME}" =~ ^v[0-9]+-edge$ ]]; then
            BRANCH="${GITHUB_REF_NAME}"
          elif [[ "${GITHUB_REF_NAME}" =~ ^release-${LATEST_MAJOR_VERSION}\.[0-9]+(\.[0-9]+)?$ ]]; then
            BRANCH="latest-candidate"
          elif [[ "${GITHUB_REF_NAME}" =~ ^release-([0-9]+)\.[0-9]+(\.[0-9]+)?$ ]]; then
            BRANCH="v${BASH_REMATCH[1]}-candidate"
          else
            echo "ERROR: Unsupported GITHUB_REF_NAME pattern: ${GITHUB_REF_NAME}" >&2
            exit 1
          fi

          # Determine snap version and grade based on edge or candidate.
          grade="devel"
          if [[ "${BRANCH}" == *"-candidate" ]]; then
            versionString="${version}-${localRev:0:7}"
            grade="stable"
          else
            versionString="git-${localRev:0:7}"
          fi

          cd "${GITHUB_WORKSPACE}/snap"

          # Fail unless exactly one `version: git` line exists, then replace it.
          match_count="$(grep -cxF 'version: git' snapcraft.yaml || true)"
          if [ "${match_count}" -ne 1 ]; then
            echo "ERROR: Expected exactly one 'version: git' line in snapcraft.yaml, found ${match_count}" >&2
            exit 1
          fi

          sed -i -e "s/^version: git$/version: ${versionString}/" snapcraft.yaml

          if [ "${grade}" = "stable" ]; then
            # Fail unless exactly one `grade: devel` line exists, then replace it.
            match_count="$(grep -cxF 'grade: devel' snapcraft.yaml || true)"
            if [ "${match_count}" -ne 1 ]; then
              echo "ERROR: Expected exactly one 'grade: devel' line in snapcraft.yaml, found ${match_count}" >&2
              exit 1
            fi

            sed -i -e "s/^grade: devel$/grade: stable/" snapcraft.yaml
          fi

          git add snapcraft.yaml
          git commit --quiet -s -m "Automatic upstream build (${BRANCH})" -m "Upstream commit: ${localRev} (version: ${versionString})"
          git show

          # Pack all objects and generate a bitmap index
          # right before the push so that pack generation benefits from full bitmap coverage.
          git config --local pack.useBitmaps true
          git gc --prune=now

          git push --quiet --force launchpad HEAD:"${BRANCH}"

          # Unload the SSH key from the agent now that the push is done, to
          # prevent accidental usage in any subsequent steps within this job.
          ssh-add -D