Icu 18817 backup

.github/workflows/test.yml

@@ -8,10 +8,22 @@ on:
     types: [opened, synchronize, reopened]
   workflow_dispatch:
     inputs:
+      run_acceptance:
+        description: "Run acceptance tests"
+        type: boolean
+        default: false
       k8s_versions:
         description: "Optional explicit Kubernetes versions (comma-separated, e.g. v1.31.0,v1.30.0). Leave blank to use the K8S_MATRIX_VERSIONS repository variable."
         required: false
         default: ""
+      run_crc_acceptance:
+        description: "Run OpenShift acceptance tests against an external OCP/CRC cluster (requires OCP_SERVER and OCP_TOKEN secrets)"
+        type: boolean
+        default: false
+      ocp_storage_class:
+        description: "OpenShift storage class override for CRC/OCP cluster (e.g. crc-csi-hostpath-provisioner)"
+        type: string
+        required: false
 
 permissions:
   contents: read
@@ -217,3 +229,100 @@ jobs:
         if: always()
         run: make acceptance-cleanup
 
+  # ---------------------------------------------------------------------------
+  # OpenShift acceptance test using MicroShift AIO — same pattern as
+  # acceptance-test uses KIND. A throwaway OCP cluster starts inside Docker on
+  # the GitHub runner. No external OCP cluster, CRC, or OCP_SERVER/OCP_TOKEN
+  # secrets are required.
+  # ---------------------------------------------------------------------------
+  openshift-acceptance-test:
+    name: OpenShift Acceptance Test (MicroShift)
+    runs-on: ubuntu-latest
+    needs: [unit-test, security]
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' &&
+       github.base_ref == 'main' &&
+       github.event.pull_request.draft == false)
+    env:
+      BOUNDARY_ADDR: ${{ secrets.BOUNDARY_ADDR }}
+      BOUNDARY_AUTH_METHOD_ID: ${{ secrets.BOUNDARY_AUTH_METHOD_ID }}
+      BOUNDARY_CLUSTER_ID: ${{ secrets.BOUNDARY_CLUSTER_ID }}
+      BOUNDARY_LOGIN_NAME: ${{ secrets.BOUNDARY_LOGIN_NAME }}
+      BOUNDARY_PASSWORD: ${{ secrets.BOUNDARY_PASSWORD }}
+      BOUNDARY_TARGET_ID: ${{ secrets.BOUNDARY_TARGET_ID }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup Helm
+        run: make setup-helm
+
+      - name: Install Boundary CLI
+        run: |
+          wget -O - https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
+          sudo apt update && sudo apt install -y boundary
+          boundary version
+
+      - name: Setup MicroShift acceptance environment
+        run: make microshift-setup
+
+      - name: Run OpenShift acceptance test
+        run: make microshift-full
+
+      - name: Cleanup
+        if: always()
+        run: make microshift-cleanup
+
+  # ---------------------------------------------------------------------------
+  # CRC / external OCP cluster acceptance test — manual trigger only.
+  # Requires OCP_SERVER and OCP_TOKEN repository secrets pointing to a running
+  # OCP or CRC cluster. Trigger via workflow_dispatch with run_crc_acceptance=true.
+  # ---------------------------------------------------------------------------
+  crc-acceptance-test:
+    name: OpenShift Acceptance Test (CRC/OCP)
+    runs-on: ubuntu-latest
+    needs: [unit-test, security]
+    if: github.event_name == 'workflow_dispatch' && github.event.inputs.run_crc_acceptance == 'true'
+    env:
+      BOUNDARY_ADDR: ${{ secrets.BOUNDARY_ADDR }}
+      BOUNDARY_AUTH_METHOD_ID: ${{ secrets.BOUNDARY_AUTH_METHOD_ID }}
+      BOUNDARY_CLUSTER_ID: ${{ secrets.BOUNDARY_CLUSTER_ID }}
+      BOUNDARY_LOGIN_NAME: ${{ secrets.BOUNDARY_LOGIN_NAME }}
+      BOUNDARY_PASSWORD: ${{ secrets.BOUNDARY_PASSWORD }}
+      BOUNDARY_TARGET_ID: ${{ secrets.BOUNDARY_TARGET_ID }}
+      OCP_STORAGE_CLASS: ${{ github.event.inputs.ocp_storage_class }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install oc CLI
+        run: |
+          curl -Lo /tmp/oc.tar.gz https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable/openshift-client-linux.tar.gz
+          sudo tar -xzf /tmp/oc.tar.gz -C /usr/local/bin oc
+          oc version --client
+
+      - name: Setup Helm
+        run: make setup-helm
+
+      - name: Install Boundary CLI
+        run: |
+          wget -O - https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
+          sudo apt update && sudo apt install -y boundary
+          boundary version
+
+      - name: Login to OpenShift cluster
+        run: |
+          oc login "${{ secrets.OCP_SERVER }}" \
+            --token="${{ secrets.OCP_TOKEN }}" \
+            --insecure-skip-tls-verify=true
+
+      - name: Run OpenShift acceptance tests
+        run: make openshift-acceptance-full
+
+      - name: Cleanup
+        if: always()
+        run: make openshift-acceptance-cleanup
+