validations.yaml

name: "Validations"

on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main

permissions: {}

jobs:
  Static-Analysis:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Static analysis"
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap

      - name: Run static analysis
        run: make static-analysis

  Unit-Test:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Unit tests"
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          cache-test-fixtures: true

      - name: Run unit tests
        run: make unit

  Quality-Test:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Quality tests"
    runs-on: ubuntu-22.04-4core-16gb
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          submodules: true
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          cache-test-fixtures: true
          python-version: "3.11"

      - name: Run quality tests
        run: make quality
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Archive the provider state
        if: ${{ failure() }}
        run: tar -czvf qg-capture-state.tar.gz -C test/quality --exclude tools --exclude labels .yardstick.yaml .yardstick

      - name: Upload the provider state archive
        if: ${{ failure() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: qg-capture-state
          path: qg-capture-state.tar.gz

      - name: Show instructions to debug
        if: ${{ failure() }}
        run: |
          ARCHIVE_BASENAME=qg-capture-state
          ARCHIVE_NAME=$ARCHIVE_BASENAME.zip

          cat << EOF >> $GITHUB_STEP_SUMMARY
          ## Troubleshooting failed run

          Download the artifact from this workflow run: \`$ARCHIVE_NAME\`

          Then run the following commands to debug:
          \`\`\`bash
          # copy the archive to the tests/quality directory
          cd test/quality
          unzip $ARCHIVE_NAME && tar -xzf $ARCHIVE_BASENAME.tar.gz
          \`\`\`

          Now you can debug the with yardstick:
          \`\`\`bash
          poetry shell
          yardstick result list
          yardstick label explore
          \`\`\`
          EOF


  Integration-Test:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Integration tests"
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          cache-test-fixtures: true

      - name: Restore integration test cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae #v5.0.5
        with:
          path: ${{ github.workspace }}/test/integration/testdata/cache
          key: ${{ runner.os }}-integration-test-cache-${{ hashFiles('test/integration/testdata/cache.fingerprint') }}

      - name: Run integration tests
        run: make integration

  Build-Snapshot-Artifacts:
    name: "Build snapshot artifacts"
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          # why have another build cache key? We don't want unit/integration/etc test build caches to replace
          # the snapshot build cache, which includes builds for all OSs and architectures. As long as this key is
          # unique from the cache-key-prefix in other CI jobs, we should be fine.
          #
          # note: ideally this value should match what is used in release (just to help with build times).
          cache-key-prefix: "snapshot"
          bootstrap-apt-packages: ""

      - name: Build snapshot artifacts
        run: make snapshot

      - name: Upload snapshot artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: snapshot
          path: snapshot/
          retention-days: 30

  Acceptance-Linux:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Acceptance tests (Linux)"
    needs: [Build-Snapshot-Artifacts]
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
        with:
          persist-credentials: false

      # only need go to drive the make-shim into go-make; skip tool install + apt
      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          tools: "false"
          bootstrap-apt-packages: ""

      - name: Download snapshot build
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: snapshot
          path: snapshot

      - name: Restore executable permissions
        run: chmod -R +x snapshot/**/grype

      - name: Restore install.sh test image cache
        id: install-test-image-cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae #v5.0.5
        with:
          path: ${{ github.workspace }}/test/install/cache
          key: ${{ runner.os }}-install-test-image-cache-${{ hashFiles('test/install/cache.fingerprint') }}

      - name: Load test image cache
        if: steps.install-test-image-cache.outputs.cache-hit == 'true'
        run: make install-test-cache-load

      - name: Run install.sh tests (Linux)
        run: make install-test

      - name: (cache-miss) Create test image cache
        if: steps.install-test-image-cache.outputs.cache-hit != 'true'
        run: make install-test-cache-save

  Acceptance-Mac:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Acceptance tests (Mac)"
    needs: [Build-Snapshot-Artifacts]
    runs-on: macos-latest
    permissions:
      contents: read
    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 #v4.1.2

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
        with:
          persist-credentials: false

      # only need go to drive the make-shim into go-make; skip tool install + apt
      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          tools: "false"
          bootstrap-apt-packages: ""

      - name: Download snapshot build
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: snapshot
          path: snapshot

      - name: Restore executable permissions
        run: chmod -R +x snapshot/**/grype

      - name: Restore docker image cache for compare testing
        id: mac-compare-testing-cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae #v5.0.5
        with:
          path: image.tar
          key: ${{ runner.os }}-${{ hashFiles('test/compare/mac.sh') }}

      - name: Run install.sh tests (Mac)
        run: make install-test-ci-mac


  Cli-Linux:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "CLI tests (Linux)"
    needs: [Build-Snapshot-Artifacts]
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
        with:
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          cache-test-fixtures: true

      - name: Restore CLI test-fixture cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae #v5.0.5
        with:
          path: ${{ github.workspace }}/test/cli/testdata/cache
          key: ${{ runner.os }}-cli-test-cache-${{ hashFiles('test/cli/testdata/cache.fingerprint') }}

      - name: Download snapshot build
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: snapshot
          path: snapshot

      - name: Restore executable permissions
        run: chmod -R +x snapshot/**/grype

      - name: Run CLI Tests (Linux)
        run: make cli
        env:
          GRYPE_SNAPSHOT_PREBUILT: "true"
          GRYPE_BINARY_LOCATION: ${{ github.workspace }}/snapshot/linux-build_linux_amd64_v1/grype