Keep service auth PostgreSQL-owned in ConfigMap mode (#1267) #787
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| # | |
| # Licensed under the Apache License, Version 2.0 (the "License"); | |
| # you may not use this file except in compliance with the License. | |
| # You may obtain a copy of the License at | |
| # | |
| # http://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, software | |
| # distributed under the License is distributed on an "AS IS" BASIS, | |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| # See the License for the specific language governing permissions and | |
| # limitations under the License. | |
| # | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # Coverage base reports. | |
| # | |
| # PR head coverage is produced by pr-checks.yaml (ci-internal for backend, | |
| # ui-build for UI) so we don't double-run tests on the self-hosted runner. | |
| # This workflow runs only on push to main (and workflow_dispatch) to refresh | |
| # the Codecov base report that PRs are diffed against. | |
| name: Coverage | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - main | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check-paths: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| backend: ${{ steps.filter.outputs.backend }} | |
| ui: ${{ steps.filter.outputs.ui }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check which paths changed | |
| uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2 | |
| id: filter | |
| with: | |
| token: '' | |
| filters: | | |
| backend: | |
| - '.github/workflows/coverage.yaml' | |
| - 'BUILD' | |
| - 'MODULE.bazel' | |
| - 'bzl/**' | |
| - 'src/**' | |
| - '!src/ui/**' | |
| - 'run/**' | |
| ui: | |
| - '.github/workflows/coverage.yaml' | |
| - 'src/ui/**' | |
| coverage: | |
| needs: [check-paths] | |
| if: needs.check-paths.outputs.backend == 'true' | |
| timeout-minutes: 45 | |
| runs-on: self-hosted | |
| continue-on-error: true | |
| environment: | |
| name: internal-ci | |
| env: | |
| COMPOSE_PROJECT_NAME: cov-${{ github.run_id }} | |
| DOCKER_BUILDKIT: "1" | |
| container: | |
| # python:3.10.18-bullseye pinned to digest for security (amd64) | |
| image: python:3.10.18-bullseye@sha256:4e96d6c7c610e5b2a46ff8a36cc76a159d57a5b865d580eda29d51afdc1a1923 | |
| env: | |
| DOCKER_HOST: "tcp://docker:2375" | |
| DOCKER_TLS_CERTDIR: "" | |
| options: --memory=16g --cpus=4 --memory-swap=16g --pids-limit=4096 -v /var/run/docker.sock:/var/run/docker.sock | |
| services: | |
| docker: | |
| # docker:29.2.1-dind pinned to digest for security | |
| image: docker:29.2.1-dind@sha256:2658fda9e8779b94ea1581f4d25214dac9ed144b407902842e5328cce8f861f5 | |
| env: | |
| DOCKER_TLS_CERTDIR: "" | |
| DOCKER_DRIVER: overlay2 | |
| options: --privileged --memory=4g --cpus=2 | |
| ports: | |
| - 2375:2375 | |
| steps: | |
| - name: Install Docker CLI and dependencies | |
| run: | | |
| apt-get update | |
| apt-get install -y ca-certificates curl gnupg git-lfs | |
| install -m 0755 -d /etc/apt/keyrings | |
| curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc | |
| chmod a+r /etc/apt/keyrings/docker.asc | |
| echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null | |
| apt-get update | |
| apt-get install -y docker-ce-cli | |
| echo "Docker version: $(docker --version)" | |
| echo "Git LFS version: $(git-lfs --version)" | |
| - name: Clean up stale LFS hooks | |
| run: rm -f .git/hooks/pre-push .git/hooks/post-checkout .git/hooks/post-commit .git/hooks/post-merge || true | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| lfs: true | |
| - name: Setup Bazel | |
| uses: bazel-contrib/setup-bazel@4fd964a13a440a8aeb0be47350db2fc640f19ca8 | |
| with: | |
| bazelisk-cache: true | |
| bazelisk-version: 1.27.0 | |
| # Go coverage via rules_go, Python coverage via manual coverage tool wiring in MODULE.bazel. | |
| - name: Run Tests with Coverage | |
| run: | | |
| bazel coverage --config=ci \ | |
| --remote_cache=${{ secrets.BAZEL_REMOTE_CACHE_URL }} \ | |
| --test_env=DOCKER_HOST=tcp://docker:2375 \ | |
| --test_env=TESTCONTAINERS_HOST_OVERRIDE=docker \ | |
| --test_output=errors \ | |
| -- \ | |
| //... | |
| - name: Upload coverage to Codecov | |
| if: always() && !cancelled() | |
| uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: bazel-out/_coverage/_coverage_report.dat | |
| flags: backend | |
| fail_ci_if_error: false | |
| - name: Docker cleanup | |
| if: always() | |
| run: | | |
| docker ps -q | xargs -r docker stop --time=5 || true | |
| docker ps -aq | xargs -r docker rm -f || true | |
| docker volume ls -q | xargs -r docker volume rm -f || true | |
| docker network ls --filter type=custom -q | xargs -r docker network rm || true | |
| - name: Host cleanup | |
| if: always() | |
| env: | |
| DOCKER_HOST: "" | |
| run: | | |
| docker ps -aq -f status=exited -f status=dead --filter "until=5m" 2>/dev/null | xargs -r docker rm -f || true | |
| docker volume prune -f 2>/dev/null || true | |
| docker network prune -f 2>/dev/null || true | |
| docker image prune -f 2>/dev/null || true | |
| ui-coverage: | |
| needs: [check-paths] | |
| if: needs.check-paths.outputs.ui == 'true' | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| lfs: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| package_json_file: src/ui/package.json | |
| - name: Setup Node.js | |
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| node-version-file: src/ui/.nvmrc | |
| cache: pnpm | |
| cache-dependency-path: src/ui/pnpm-lock.yaml | |
| - name: Run Tests with Coverage | |
| working-directory: src/ui | |
| run: | | |
| pnpm install --frozen-lockfile | |
| pnpm test:coverage | |
| - name: Upload UI coverage to Codecov | |
| if: always() && !cancelled() | |
| uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: src/ui/coverage/lcov.info | |
| flags: ui | |
| fail_ci_if_error: false |