nightly-spread.yaml

name: Nightly spread executions

# See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onschedule
on:
  schedule:
    # usual nightly run, google tests, and experimental features
    - cron: '0 2 * * *'
    # spread run from json fundamental, non-fundamental, and nested
    - cron: '0 3 * * *'
    # from current
    - cron: '0 6 * * *'
  workflow_dispatch:
    inputs:
      job:
        type: choice
        description: Job to run
        options:
          - spread-nightly
          - spread-nightly-google
          - spread-test-build-from-current
          - spread-test-experimental
          - spread-test-openstack
          - spread-test-with-kernels
          - spread-master-fundamental
          - spread-master-not-fundamental
          - spread-master-nested

# Granted at workflow level so the reusable spread-tests.yaml `run-spread`
# job (which declares `pull-requests: read` for `gh pr view`) can be called
# from a private repo. Reusable workflows cannot elevate caller scopes; an
# explicit `permissions:` block also resets unlisted scopes to `none`, so
# `contents`, `packages` and `actions` are listed to preserve defaults
# (checkout, image pulls, cross-run artifact downloads).
permissions:
  contents: read
  packages: read
  pull-requests: read
  actions: read

jobs:

  spread-nightly:
    if: ${{ github.event.schedule == '0 2 * * *' || (github.event_name == 'workflow_dispatch' && inputs.job == 'spread-nightly') }}
    uses: ./.github/workflows/spread-tests.yaml
    secrets: inherit
    with:
      runs-on: '["self-hosted", "spread-enabled"]'
      group: openstack
      backend: openstack
      systems: 'ALL'
      tasks: 'tests/nightly/...'
      rules: ''
      use-snapd-snap-from-master: true

  spread-nightly-google:
    if: ${{ github.event.schedule == '0 2 * * *' || (github.event_name == 'workflow_dispatch' && inputs.job == 'spread-nightly-google') }}
    uses: ./.github/workflows/spread-tests.yaml
    secrets: inherit
    with:
      runs-on: '["self-hosted", "spread-enabled"]'
      group: ${{ matrix.group }}
      backend: ${{ matrix.backend }}
      systems: ${{ matrix.systems }}
      tasks: ${{ matrix.tasks }}
      rules: ''
      use-snapd-snap-from-master: true
      skip-tests: 'ubuntu-14.04-64 ubuntu-core-16-64'
    strategy:
      fail-fast: false
      matrix:
        include:
          - group: jammy
            backend: google
            systems: 'ubuntu-22.04-64'
            tasks: 'tests/main/apparmor-prompting-integration-tests tests/main/interfaces-requests-activates-handlers'
          - group: google
            backend: google
            systems: 'ALL'
            tasks: 'tests/main/microk8s-smoke tests/main/download-timeout tests/main/snap-network-errors tests/main/snapd-snap:lxd tests/main/apparmor-prompting-support tests/main/proxy'
          - group: google-core
            backend: google-core
            systems: 'ALL'
            tasks: 'tests/main/microk8s-smoke tests/main/download-timeout tests/main/snap-network-errors tests/main/snapd-snap:lxd tests/main/apparmor-prompting-support tests/main/proxy'
          - group: google-distro
            backend: google-distro
            systems: 'ALL'
            tasks: 'tests/main/microk8s-smoke tests/main/download-timeout tests/main/snap-network-errors tests/main/snapd-snap:lxd tests/main/apparmor-prompting-support tests/main/proxy'
          - group: google-arm
            backend: google-distro
            systems: 'ubuntu-22.04-arm-64 ubuntu-core-24-arm-64'
            tasks: 'tests/main/microk8s-smoke tests/main/download-timeout tests/main/snap-network-errors tests/main/snapd-snap:lxd tests/main/apparmor-prompting-support tests/main/proxy'

  spread-test-build-from-current:
    if: ${{ github.event.schedule == '0 6 * * *' || (github.event_name == 'workflow_dispatch' && inputs.job == 'spread-test-build-from-current') }}
    uses: ./.github/workflows/spread-tests.yaml
    secrets: inherit
    with:
      runs-on: '["self-hosted", "spread-enabled"]'
      group: ${{ matrix.group }}
      backend: ${{ matrix.backend }}
      systems: ${{ matrix.systems }}
      tasks: 'tests/...'
      rules: ''
      use-snapd-snap-from-master: true
      spread-env: "SPREAD_SNAPD_DEB_FROM_REPO=false SPREAD_MODIFY_CORE_SNAP_FOR_REEXEC=0 SPREAD_SNAP_REEXEC=0"
    strategy:
      fail-fast: false
      matrix:
        include:
          - group: openstack
            backend: openstack
            systems: 'ubuntu-18.04-64 ubuntu-20.04-64 ubuntu-22.04-64 ubuntu-24.04-64 debian-12-64 debian-sid-64'

  spread-test-experimental:
    if: ${{ github.event.schedule == '0 2 * * *' || (github.event_name == 'workflow_dispatch' && inputs.job == 'spread-test-experimental') }}
    uses: ./.github/workflows/spread-tests.yaml
    secrets: inherit
    with:
      runs-on: '["self-hosted", "spread-enabled"]'
      group: openstack
      backend: openstack
      systems: 'ubuntu-20.04-64 ubuntu-22.04-64 ubuntu-24.04-64 ubuntu-core-24-64'
      tasks: 'tests/...'
      rules: ''
      use-snapd-snap-from-master: true
      spread-experimental-features: gate-auto-refresh-hook

  read-systems:
    runs-on: ubuntu-latest
    outputs:
      fundamental-systems: ${{ steps.read-systems.outputs.fundamental-systems }}
      non-fundamental-systems: ${{ steps.read-systems.outputs.non-fundamental-systems }}
      nested-systems: ${{ steps.read-systems.outputs.nested-systems }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Read matrix file
        id: read-systems
        shell: bash
        run: |
          echo "fundamental-systems=$(jq -c . ./.github/workflows/data-fundamental-systems.json)" >> $GITHUB_OUTPUT
          echo "non-fundamental-systems=$(jq -c . ./.github/workflows/data-non-fundamental-systems.json)" >> $GITHUB_OUTPUT
          echo "nested-systems=$(jq -c . ./.github/workflows/data-nested-systems.json)" >> $GITHUB_OUTPUT

  spread-master-fundamental:
    if: ${{ github.event.schedule == '0 3 * * *' || (github.event_name == 'workflow_dispatch' && inputs.job == 'spread-master-fundamental') }}
    uses: ./.github/workflows/spread-tests.yaml
    name: "spread master ${{ matrix.group }}"
    needs: [read-systems]
    secrets: inherit
    with:
      # Github doesn't support passing sequences as parameters.
      # Instead here we create a json array and pass it as a string.
      # Then in the spread workflow it turns it into a sequence
      # using the fromJSON expression.
      runs-on: '${{ matrix.runs-on }}'
      group: ${{ matrix.group }}
      backend: ${{ matrix.backend }}
      systems: ${{ matrix.systems }}
      tasks: ${{ matrix.tasks }}
      rules: ${{ matrix.rules }}
      is-fundamental: true
      use-snapd-snap-from-master: true
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.read-systems.outputs.fundamental-systems) }}

  spread-master-not-fundamental:
    if: ${{ github.event.schedule == '0 3 * * *' || (github.event_name == 'workflow_dispatch' && inputs.job == 'spread-master-not-fundamental') }}
    uses: ./.github/workflows/spread-tests.yaml
    name: "spread master ${{ matrix.group }}"
    needs: [read-systems]
    secrets: inherit
    with:
      # Github doesn't support passing sequences as parameters.
      # Instead here we create a json array and pass it as a string.
      # Then in the spread workflow it turns it into a sequence
      # using the fromJSON expression.
      runs-on: '${{ matrix.runs-on }}'
      group: ${{ matrix.group }}
      backend: ${{ matrix.backend }}
      systems: ${{ matrix.systems }}
      tasks: ${{ matrix.tasks }}
      rules: ${{ matrix.rules }}
      use-snapd-snap-from-master: true
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.read-systems.outputs.non-fundamental-systems) }}

  spread-master-nested:
    if: ${{ github.event.schedule == '0 3 * * *' || (github.event_name == 'workflow_dispatch' && inputs.job == 'spread-master-nested') }}
    uses: ./.github/workflows/spread-tests.yaml
    name: "spread master ${{ matrix.group }}"
    needs: [read-systems]
    secrets: inherit
    with:
      # Github doesn't support passing sequences as parameters.
      # Instead here we create a json array and pass it as a string.
      # Then in the spread workflow it turns it into a sequence
      # using the fromJSON expression.
      runs-on: '${{ matrix.runs-on }}'
      group: ${{ matrix.group }}
      backend: ${{ matrix.backend }}
      systems: ${{ matrix.systems }}
      tasks: ${{ matrix.tasks }}
      rules: ${{ matrix.rules }}
      use-snapd-snap-from-master: true
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.read-systems.outputs.nested-systems) }}

  spread-test-with-kernels:
    if: ${{ github.event.schedule == '0 6 * * *' || (github.event_name == 'workflow_dispatch' && inputs.job == 'spread-test-with-kernels') }}
    uses: ./.github/workflows/spread-tests.yaml
    secrets: inherit
    with:
      runs-on: '["self-hosted", "spread-enabled"]'
      group: ${{ matrix.group }}
      backend: ${{ matrix.backend }}
      systems: ${{ matrix.systems }}
      tasks: >
        tests/main/security-apparmor
        tests/main/apparmor-prompting-support
        tests/main/seccomp-statx
        tests/main/security-seccomp
        tests/main/cgroup-devices-v1
        tests/main/cgroup-devices-v2
        tests/main/interfaces-block-devices
        tests/main/interfaces-firewall-control
        tests/main/interfaces-fuse-support
        tests/main/interfaces-gpio-control
        tests/main/interfaces-kernel-module-load
        tests/main/interfaces-mount-control
        tests/main/interfaces-mount-observe
        tests/main/interfaces-netlink-audit
        tests/main/interfaces-network-control
        tests/main/interfaces-network-observe
        tests/main/interfaces-raw-input
        tests/main/interfaces-raw-usb
        tests/main/interfaces-udev
        tests/main/mount-dir-detect-check
        tests/main/mount-ns
        tests/main/snap-confine-caps
        tests/main/snap-confine-tmp-mount
        tests/main/snap-gpio-helper
        tests/main/snap-remove-not-mounted
        tests/main/snap-seccomp-syscalls
        tests/main/security-device-cgroups
        tests/main/security-udev-input-subsystem
        tests/main/lxd-snapfuse
        tests/main/user-mounts
      rules: ''
      use-snapd-snap-from-master: true
      spread-env: "SPREAD_UPDATE_UBUNTU_KERNEL_PATTERN=${{ matrix.kernel }}"
    strategy:
      fail-fast: false
      matrix:
        include:
          # Xenial is not needed as it is already being tested with kernel 4.4.0-210-generic
          - group: bionic-4.15
            backend: openstack
            systems: 'ubuntu-18.04-64'
            kernel: '4\.15.*-generic'
            support: '2030-04-30'
          - group: bionic-5.4
            backend: openstack
            systems: 'ubuntu-18.04-64'
            kernel: '5\.4.*-generic'
            support: '2030-04-30'
          - group: focal-5.4
            backend: openstack
            systems: 'ubuntu-20.04-64'
            kernel: '5\.4.*-generic'
            support: '2032-04-30'
          - group: focal-5.15
            backend: openstack
            systems: 'ubuntu-20.04-64'
            kernel: '5\.15.*-generic'
            support: '2032-04-30'
          - group: jammy-5.15
            backend: openstack
            systems: 'ubuntu-22.04-64'
            kernel: '5\.15.*-generic'
            support: '2034-04-30'
          - group: jammy-6.8
            backend: openstack
            systems: 'ubuntu-22.04-64'
            kernel: '6\.8.*-generic'
            support: '2034-04-30'
          - group: noble-6.8
            backend: openstack
            systems: 'ubuntu-24.04-64'
            kernel: '6\.8.*-generic'
            support: '2036-04-30'
          - group: noble-6.14
            backend: openstack
            systems: 'ubuntu-24.04-64'
            kernel: '6\.14.*-generic'
            support: '2036-04-30'

  re-run:
    permissions:
      actions: write
    needs: [read-systems, spread-master-fundamental, spread-master-not-fundamental, spread-master-nested]
    # If the spread tests ended in failure, rerun the workflow up to maximum-reruns times
    if: failure() && fromJSON(github.run_attempt) <= 1
    runs-on: ubuntu-latest
    steps:
      - env:
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ github.token }}
        run: gh workflow run rerun.yaml -F run_id=${{ github.run_id }}