integ.yml

name: Integration Tests

on:
  workflow_call:
    inputs: &inputs
      imageRepo:
        description: 'Repository for the provider image'
        required: true
        type: string
        default: public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws
      imageTagAmd64:
        description: 'Image tag for the amd64 build'
        required: true
        type: string
        default: latest
      imageTagArm64:
        description: 'Image tag for the arm64 build'
        required: true
        type: string
        default: latest
  workflow_dispatch:
    inputs: *inputs

concurrency:
  # Only run one workflow at a time to avoid hitting the network interface quota
  group: integration-tests
  cancel-in-progress: false
  queue: max

permissions:
  id-token: write
  contents: read
  packages: read

jobs:
  integration-tests:
    name: Run Integration Tests
    permissions:
      id-token: write
      contents: read
      packages: read
    strategy:
      fail-fast: false
      matrix:
        runner: [ubuntu-latest, ubuntu-24.04-arm]
        auth_type: [irsa, pod-identity]
        include:
          - os: linux
          - arch: amd64
            arch-short: x64
            runner: ubuntu-latest
          - arch: arm64
            arch-short: arm
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}

    env:
      imageTag: ${{ matrix.arch == 'amd64' && inputs.imageTagAmd64 || inputs.imageTagArm64 }}
    steps:
      - name: Context
        run: echo "Running integration tests for ${{ inputs.imageRepo }}:${{ env.imageTag }}"

      - name: Harden Runner
        uses: step-security/harden-runner@v2.20.0
        with:
          egress-policy: audit

      - name: Setup kubectl
        uses: azure/setup-kubectl@v5

      - name: Setup Helm
        uses: azure/setup-helm@v5.0.1

      - name: Setup eksctl
        run: |
          ARCH=${{ matrix.arch }}
          PLATFORM=$(uname -s)_$ARCH

          curl -sLO "https://github.com/eksctl-io/eksctl/releases/latest/download/eksctl_$PLATFORM.tar.gz"

          curl -sL "https://github.com/eksctl-io/eksctl/releases/latest/download/eksctl_checksums.txt" | grep $PLATFORM | sha256sum --check

          tar -xzf eksctl_$PLATFORM.tar.gz -C /tmp && rm eksctl_$PLATFORM.tar.gz

          sudo install -m 0755 /tmp/eksctl /usr/local/bin && rm /tmp/eksctl

      - run: eksctl version

      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: "3"

      - name: Install Python dependencies
        run: pip install boto3

      - name: Setup Bats and bats libs
        id: setup-bats
        uses: bats-core/bats-action@4.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout
        uses: actions/checkout@v7

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.ROLE_ARN }}
          role-session-name: csi-driver-ci-${{ github.run_id }}-${{ matrix.arch }}
          aws-region: us-west-2
          role-duration-seconds: 14400

      - name: Clean up stale clusters
        run: |
          CLUSTER_NAME=integ-cluster-${{ matrix.arch-short }}-${{ matrix.auth_type }}
          if eksctl get cluster --name "$CLUSTER_NAME" --region us-west-2 2>/dev/null; then
            echo "Found stale cluster $CLUSTER_NAME, deleting..."
            eksctl delete cluster --name "$CLUSTER_NAME" --region us-west-2 --wait
          fi

      - name: Run integ tests
        run: cd tests && ./run-tests.sh ${{ matrix.arch-short }}-${{ matrix.auth_type }}
        env:
          POD_IDENTITY_ROLE_ARN: ${{ secrets.POD_IDENTITY_ROLE_ARN }}
          PRIVREPO: ${{ inputs.imageRepo }}
          PRIVTAG: ${{ env.imageTag }}
          GITHUB_ACTOR: ${{ github.actor }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REGION: us-west-2
          FAILOVERREGION: us-east-2

      - name: Run cleanup
        if: always()
        run: cd tests && ./run-tests.sh clean ${{ matrix.arch-short }}-${{ matrix.auth_type }}
        env:
          REGION: us-west-2
          FAILOVERREGION: us-east-2