samcli-direct.yaml

name: samcli-direct

on:
  pull_request:
    branches:
      - main
    paths-ignore:
      - '**.md'
  schedule:
    - cron: '0 8 * * *'
  workflow_dispatch:

env:
  GO_VERSION: '1.24.11'

permissions:
  id-token: write
  contents: read

jobs:
  samcli-direct-test:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        test_type: [unit, package, invoke, start-lambda, start-api]
    env:
      AWS_DEFAULT_REGION: "${{ secrets.REGION }}"
      DOCKER_HOST: unix:///var/run/finch.sock
      DOCKER_CONFIG: $HOME/.finch
      BY_CANARY: true # allows full testing
      SAM_CLI_DEV: 1
      SAM_CLI_TELEMETRY: 0
    steps:

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
        with:
          role-to-assume: ${{secrets.SAMCLI_DIRECT_ROLE_BASE}}
          role-session-name: samcli-${{ matrix.test_type }}-tests
          aws-region: ${{ secrets.REGION }}
          role-duration-seconds: 2000

      - name: Set up Go
        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
          go-version: ${{ env.GO_VERSION }}

      # from aws/aws-sam-cli/setup.py: python_requires=">=3.9, <=4.0, !=4.0
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          # python version should match https://github.com/aws/aws-sam-cli/blame/develop/tests/integration/testdata/durable/template.yaml
          python-version: '3.13'

      - name: Checkout finch-daemon
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Stop pre-existing services
        run: |
          sudo systemctl stop docker
          sudo systemctl stop containerd

      - name: Remove default podman network config
        run: |
          sudo rm -f /etc/cni/net.d/87-podman-bridge.conflist

      - name: Clean up Daemon socket
        run: |
          sudo rm -f /run/finch.sock
          sudo rm -f /run/finch.pid
          sudo rm -f /run/finch-credential.sock

      - name: Install finch-daemon dependencies
        run: |
          ./setup-test-env.sh
          sleep 10

      - name: Build and start finch-daemon
        run: |
          make build
          sudo bin/finch-daemon --debug --socket-owner $UID 2>&1 | tee finch-daemon.log &
          sleep 10

      - name: Get latest SAM CLI tag
        id: sam-tag
        run: |
          TAG=$(curl -s https://api.github.com/repos/aws/aws-sam-cli/releases/latest | jq -r .tag_name)
          echo "tag=$TAG" >> $GITHUB_OUTPUT

      - name: Checkout SAM CLI
        uses: actions/checkout@v4
        with:
          repository: aws/aws-sam-cli
          submodules: recursive
          path: aws-sam-cli
          ref: ${{ steps.sam-tag.outputs.tag }}

      - name: Set up SAM CLI from source
        working-directory: aws-sam-cli
        run: |
          python -m pip install --upgrade pip
          make init
          samdev --version

      - name: Run ${{ matrix.test_type }} tests
        run: ./scripts/samcli-direct/run-${{ matrix.test_type }}-tests.sh

      - name: Show finch-daemon logs
        if: always()
        run: |
          echo "=== FINCH-DAEMON OUTPUT ==="
          cat finch-daemon.log

  # ensuring resources are clean post-test
  cleanup:
    runs-on: ubuntu-latest
    needs: samcli-direct-test
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df
        with:
          role-to-assume: ${{ secrets.SAMCLI_DIRECT_ROLE_BASE }}
          role-session-name: cleanup-samcli-direct
          aws-region: ${{ secrets.REGION }}

      - name: Comprehensive AWS resource cleanup
        timeout-minutes: 10
        run: ./scripts/cleanup-aws-resources.sh