conformance-kpr-aks.yaml

name: Conformance KPR AKS (ci-kpr-aks)

# Any change in triggers needs to be reflected in the concurrency group.
on:
  workflow_dispatch:
    inputs:
      PR-number:
        description: "Pull request number."
        required: true
      context-ref:
        description: "Context in which the workflow runs. If PR is from a fork, will be the PR target branch (general case). If PR is NOT from a fork, will be the PR branch itself (this allows committers to test changes to workflows directly from PRs)."
        required: true
      SHA:
        description: "SHA under test (head of the PR branch)."
        required: true
      base-SHA:
        description: "SHA of the base branch (target branch of the PR)."
        required: false
      extra-args:
        description: "[JSON object] Arbitrary arguments passed from the trigger comment via regex capture group. Parse with 'fromJson(inputs.extra-args).argName' in workflow."
        required: false
        default: '{}'
  # Run every 12 hours
  schedule:
    - cron:  '0 4/12 * * *'

# By specifying the access of one of the scopes, all of those that are not
# specified are set to 'none'.
permissions:
  # To read actions state with cilium/workflow-telemetry-action
  actions: read
  # To be able to access the repository with actions/checkout
  contents: read
  # To allow retrieving information from the PR API
  pull-requests: read
  # To be able to set commit status
  statuses: write
  # To be able to request the JWT from GitHub's OIDC provider
  id-token: write

concurrency:
  # Structure:
  # - Parent concurrency group name to avoid deadlock with child workflows
  # - Workflow name
  # - Event type
  # - A unique identifier depending on event type:
  #   - schedule: SHA
  #   - workflow_dispatch: PR number
  #
  # This structure ensures a unique concurrency group name is generated for each
  # type of testing, such that re-runs will cancel the previous run.
  group: |
    parent
    ${{ github.workflow }}
    ${{ github.event_name }}
    ${{
      (github.event_name == 'push' && github.sha) ||
      (github.event_name == 'schedule' && github.sha) ||
      (github.event_name == 'workflow_dispatch' && github.event.inputs.PR-number)
    }}
  cancel-in-progress: true

jobs:
  echo-inputs:
    if: ${{ github.event_name == 'workflow_dispatch' }}
    name: Echo Workflow Dispatch Inputs
    runs-on: ubuntu-24.04
    steps:
      - name: Echo Workflow Dispatch Inputs
        run: |
          echo '${{ tojson(inputs) }}'

  commit-status-start:
    name: Commit Status Start
    runs-on: ubuntu-24.04
    steps:
      - name: Set initial commit status
        uses: cilium/actions/set-commit-status@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e # main
        with:
          sha: ${{ inputs.SHA || github.sha }}

  wait-for-images:
    name: Wait for images
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Checkout context ref (trusted)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.context-ref || github.sha }}
          persist-credentials: false

      - name: Wait for images
        uses: ./.github/actions/wait-for-images
        with:
          SHA: ${{ inputs.SHA || github.sha }}
          images: cilium-ci operator-generic-ci hubble-relay-ci
          login-host: ${{ vars.DOCKER_READ_HOST }}
          login-username: ${{ vars.DOCKER_READ_USERNAME }}
          login-password: ${{ secrets.DOCKER_READ_PASSWORD }}
          auth-required: ${{ vars.DOCKER_AUTH_REQUIRED }}

  conformance-aks-kpr:
    name: Conformance AKS with KPR
    needs: wait-for-images
    uses: ./.github/workflows/conformance-aks.yaml
    secrets: inherit
    with:
      PR-number: ${{ inputs.PR-number || github.ref_name }}
      UID: 1
      context-ref: ${{ inputs.context-ref || github.sha }}
      SHA: ${{ inputs.SHA || github.sha }}
      extra-args: '{"kpr": true, "bpf-masq-v4": true, "advanced-features": true}'

  conformance-aks-kpr-ipsec:
    name: Conformance AKS with KPR + IPsec
    needs: wait-for-images
    uses: ./.github/workflows/conformance-aks.yaml
    secrets: inherit
    with:
      PR-number: ${{ inputs.PR-number || github.ref_name }}
      UID: 2
      context-ref: ${{ inputs.context-ref || github.sha }}
      SHA: ${{ inputs.SHA || github.sha }}
      extra-args: '{"kpr": true, "bpf-masq-v4": true, "advanced-features": true, "ipsec": true}'

  conformance-aks-kpr-wireguard:
    name: Conformance AKS with KPR + WireGuard
    needs: wait-for-images
    uses: ./.github/workflows/conformance-aks.yaml
    secrets: inherit
    with:
      PR-number: ${{ inputs.PR-number || github.ref_name }}
      UID: 3
      context-ref: ${{ inputs.context-ref || github.sha }}
      SHA: ${{ inputs.SHA || github.sha }}
      extra-args: '{"kpr": true, "bpf-masq-v4": true, "advanced-features": true, "wireguard": true}'

  merge-upload-and-status:
    name: Merge Upload and Status
    if: ${{ always() }}
    needs: [conformance-aks-kpr, conformance-aks-kpr-ipsec, conformance-aks-kpr-wireguard]
    uses: ./.github/workflows/common-post-jobs.yaml
    secrets: inherit
    with:
      context-ref: ${{ inputs.context-ref || github.sha }}
      sha: ${{ inputs.SHA || github.sha }}
      success: ${{ (needs.conformance-aks-kpr.result == 'success' && needs.conformance-aks-kpr-ipsec.result == 'success' && needs.conformance-aks-kpr-wireguard.result == 'success') }}