e2e

Support both public and private VolumeGroupSnapshot APIs #6828

Workflow file for this run

	# SPDX-FileCopyrightText: The RamenDR authors
	# SPDX-License-Identifier: Apache-2.0

	# yamllint disable rule:line-length
	---
	# Security of pull_request_target with forked PR checkout
	#
	# This workflow uses pull_request_target to ensure the workflow file always
	# comes from the base branch (main) and cannot be modified by a PR author.
	# This is required to enforce the authorization check - using pull_request
	# would allow a fork PR to remove the check and run arbitrary code on
	# self-hosted runners.
	#
	# The test job checks out and executes PR code (allow-unsafe-pr-checkout)
	# in the pull_request_target security context. This is considered safe
	# because of the following controls and restrictions:
	#
	# Risk \| Mitigation
	# ------------------+--------------------------------------------------
	# Unauthorized PRs \| The auth job verifies the PR author is listed in
	# \| the OWNERS file (from the base branch) before
	# \| the test job runs any PR code.
	# GITHUB_TOKEN \| Scoped to read-only (permissions: contents: read).
	# \| For fork PRs, pull_request also enforces read-only,
	# \| so there is no additional exposure.
	# Repo secrets \| Not used by this workflow. Do NOT add secrets
	# \| without reviewing the security implications.
	# Actions cache \| Not used by this workflow. Do NOT add actions/cache
	# \| since pull_request_target can write to the default
	# \| branch cache, enabling cache poisoning attacks.
	name: e2e

	on:
	pull_request_target:
	types: [opened, synchronize, reopened]

	permissions:
	contents: read

	env:
	# Limit number of drenv workers.
	MAX_WORKERS: 4
	BUILD_ID: ${{ github.run_id }}-${{ github.run_attempt }}

	# Cancel the in-progress workflow when PR is refreshed.
	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
	cancel-in-progress: true

	jobs:
	auth:
	runs-on: ubuntu-24.04
	steps:
	- name: Checkout base branch
	uses: actions/checkout@v6

	- name: Install PyYAML
	run: pip install pyyaml

	- name: Check e2e authorization
	shell: python3 {0}
	run: \|
	import yaml, sys

	with open("OWNERS") as f:
	users = yaml.safe_load(f)["e2e"]

	author = "${{ github.event.pull_request.user.login }}"

	if author not in users:
	print(f"::warning::User {author} is not in the e2e group. "
	"Add yourself to the OWNERS file to run the e2e workflow.")
	sys.exit(1)

	test:
	needs: auth
	runs-on: [self-hosted, e2e-rdr]

	steps:
	- name: Checkout PR
	uses: actions/checkout@v6
	with:
	ref: ${{ github.event.pull_request.head.sha }}
	allow-unsafe-pr-checkout: true # See security section above

	- name: Build ramen-operator container
	run: make docker-build

	- name: Create virtual environment
	run: \|
	hack/make-venv .venv

	- name: Setup drenv
	working-directory: test
	run: \|
	echo test/drenv.log >> "$GITHUB_WORKSPACE/artifacts.txt"
	source ../venv
	drenv setup envs/regional-dr.yaml

	- name: Delete clusters
	if: always()
	working-directory: test
	run: \|
	source ../venv
	drenv delete envs/regional-dr.yaml

	- name: Setup libvirt
	run: test/scripts/setup-libvirt

	- name: Start clusters
	uses: nick-fields/retry@v4
	with:
	timeout_minutes: 20
	max_attempts: 3
	command: \|
	cd test
	source ../venv
	drenv start --max-workers ${{ env.MAX_WORKERS }} envs/regional-dr.yaml

	- name: Deploy ramen
	run: \|
	source venv
	ramendev deploy test/envs/regional-dr.yaml

	- name: Configure ramen
	uses: nick-fields/retry@v4
	with:
	timeout_seconds: 120
	max_attempts: 3
	command: \|
	source venv
	ramendev config test/envs/regional-dr.yaml

	- name: Prepare e2e config
	working-directory: e2e
	run: cat config.yaml.sample ~/.config/drenv/rdr/config.yaml > config.yaml

	- name: Run e2e validation
	working-directory: e2e
	run: \|
	echo e2e/validation.log >> "$GITHUB_WORKSPACE/artifacts.txt"
	./run.sh -test.run TestValidation -logfile validation.log

	- name: Run e2e dr tests
	working-directory: e2e
	run: \|
	echo e2e/dr.log >> "$GITHUB_WORKSPACE/artifacts.txt"
	./run.sh -test.run TestDR -logfile dr.log

	- name: Gather environment data
	if: always()
	working-directory: test
	# Gathering typically takes less than 15 seconds.
	timeout-minutes: 3
	run: \|
	echo test/gather.rdr >> "$GITHUB_WORKSPACE/artifacts.txt"
	source ../venv
	drenv gather --directory gather.rdr envs/regional-dr.yaml

	# Tar manually to work around github limitations with special characters (:)
	# in file names, and getting much smaller archives compared with zip (6m vs
	# 12m). This is also useful to collect all files in one archive.
	# https://github.com/actions/upload-artifact/issues/546
	- name: Archive artifacts
	if: always()
	run: \|
	tar --create \
	--gzip \
	--file e2e.${{ env.BUILD_ID }}.tar.gz \
	--transform "s\|^\|e2e.${{ env.BUILD_ID }}/\|" \
	--files-from artifacts.txt

	- name: Upload artifacts
	if: always()
	uses: actions/upload-artifact@v7
	with:
	name: e2e.${{ env.BUILD_ID }}
	path: e2e.${{ env.BUILD_ID }}.tar.gz
	compression-level: 0
	retention-days: 15

	- name: Delete clusters
	if: always()
	working-directory: test
	run: \|
	source ../venv
	drenv delete envs/regional-dr.yaml

	- name: Cleanup drenv
	if: always()
	working-directory: test
	run: \|
	source ../venv
	drenv cleanup envs/regional-dr.yaml

Navigation Menu

Uh oh!

Support both public and private VolumeGroupSnapshot APIs #6828

Workflow file

Support both public and private VolumeGroupSnapshot APIs #6828

Uh oh!

Workflow file for this run