build_and_test_qnx.yml

# *******************************************************************************
# Copyright (c) 2024 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Apache License Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0
#
# SPDX-License-Identifier: Apache-2.0
# *******************************************************************************

# Workflow configuration for S-CORE CI - Bazel Build & Test communication module for target platforms
# This workflow runs Bazel build and test for QNX when triggered by specific pull request events.

name: Bazel Build & Test communication module (target-platforms)
on:
  push:
    branches: [main]
  pull_request_target:
    types: [opened, reopened, synchronize, labeled, unlabeled]
  merge_group:
    types: [checks_requested]
  workflow_call:
    secrets:
      SCORE_QNX_LICENSE:
        required: true
      SCORE_QNX_USER:
        required: true
      SCORE_QNX_PASSWORD:
        required: true

concurrency:
  group: build_and_test_qnx-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request_target'}}

env:
  LICENSE_DIR: "/opt/score_qnx/license"
  ANDROID_HOME: ""
  ANDROID_SDK_ROOT: ""
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
jobs:
    precheck:
      runs-on: ubuntu-24.04
      outputs:
        should-run: ${{ steps.gate.outputs.should-run }}
        require-approval: ${{ steps.gate.outputs.require-approval }}
      permissions:
        contents: read
        pull-requests: read
      steps:
        - name: Evaluate QNX workflow gate
          id: gate
          env:
            EVENT_NAME: ${{ github.event_name }}
          run: |
            python3 - <<'SCRIPT_END'
            import json
            import os

            should_run = True
            require_approval = False

            with open(os.environ["GITHUB_EVENT_PATH"], encoding="utf-8") as event_file:
                event = json.load(event_file)

            pr = event.get("pull_request") or {}
            head_repo = (((pr.get("head") or {}).get("repo") or {}).get("full_name") or "")
            base_repo = (((pr.get("base") or {}).get("repo") or {}).get("full_name") or "")
            labels = {label.get("name", "") for label in (pr.get("labels") or [])}

            if os.environ["EVENT_NAME"] == "pull_request_target" and head_repo != base_repo:
                if "test-qnx" in labels:
                    require_approval = True
                else:
                    should_run = False
            
            should_run_string = 'true' if should_run else 'false'
            require_approval_string = 'true' if require_approval else 'false'

            labels_display = ", ".join(sorted(label for label in labels if label)) or "(none)"
            print(
                "QNX gate evaluation: "
                f"event_name='{os.environ['EVENT_NAME']}', "
                f"head_repo='{head_repo}', "
                f"base_repo='{base_repo}', "
                f"labels=[{labels_display}], "
                f"outputs: should-run={should_run_string}, "
                f"require-approval={require_approval_string}"
            )

            with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as github_output:
                print(f"should-run={should_run_string}", file=github_output)
                print(f"require-approval={require_approval_string}", file=github_output)
            SCRIPT_END

    approval:
      needs: precheck
      if: ${{ needs.precheck.outputs.require-approval == 'true' }}
      environment: 'workflow-approval'
      runs-on: ubuntu-24.04
      permissions:
        contents: read
        pull-requests: read
      steps:
        - name: Blocking on approval
          run: ''

    build_and_test_qnx:
      name: build_and_test_qnx
      needs:
        - precheck
        - approval
      if: ${{ always() && needs.precheck.outputs.should-run == 'true' && (needs.approval.result == 'success' || needs.approval.result == 'skipped') }}
      runs-on: ubuntu-24.04
      permissions:
        contents: read
        pull-requests: read
        actions: write
      steps:
        - name: Checkout repository
          uses: actions/checkout@v6.0.2
          with:
            ref: ${{ github.head_ref || github.event.pull_request.head.ref || github.ref }}
            repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
        - name: Free Disk Space (Ubuntu)
          uses: eclipse-score/more-disk-space@v1
          with:
            level: 4
        - name: Setup Bazel
          uses: castler/setup-bazel@cache-optimized
          with:
            bazelisk-cache: true
            disk-cache: build_and_test_qnx
            repository-cache: true
            cache-optimized: true
            cache-save: ${{ github.ref == 'refs/heads/main' }}
        - name: Allow linux-sandbox
          uses: ./actions/unblock_user_namespace_for_linux_sandbox
        - name: Setup QNX License
          env:
            SCORE_QNX_LICENSE: ${{ secrets.SCORE_QNX_LICENSE }}
          run: |
            set -euo pipefail

            sudo mkdir -p "${{ env.LICENSE_DIR }}"
            echo "${SCORE_QNX_LICENSE}" | base64 --decode | sudo tee "${{ env.LICENSE_DIR }}/licenses" >/dev/null
        - name: Build targets
          env:
            SCORE_QNX_USER: ${{ secrets.SCORE_QNX_USER }}
            SCORE_QNX_PASSWORD: ${{ secrets.SCORE_QNX_PASSWORD }}
          run: |
            bazel build --config=qnx -- //score/...
        - name: Install qemu
          run: |
            sudo apt-get update
            sudo apt-get install -y qemu-system
        - name: Enable KVM group perms
          run: |
            echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
            sudo udevadm control --reload-rules
            sudo udevadm trigger --name-match=kvm
        - name: Allow unprivileged user namespaces
          run: |
            sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0
        - name: Test targets
          env:
            SCORE_QNX_USER: ${{ secrets.SCORE_QNX_USER }}
            SCORE_QNX_PASSWORD: ${{ secrets.SCORE_QNX_PASSWORD }}
          run: |
            bazel test --config=qnx -- //score/...
        - name: Cleanup QNX License
          if: ${{ !cancelled() }}
          run: sudo rm -rf ${{ env.LICENSE_DIR }}