__shared-ci.yml

name: Internal - Common Continuous Integration tasks

on:
  workflow_call:
    inputs:
      tag:
        description: "Tag Version (semver - x.x.x)"
        type: string
        required: false
    outputs:
      built-images:
        value: ${{ jobs.docker-build-images.outputs.built-images }}

jobs:

  init:
    name: "prepare environment for jobs"
    runs-on: self-hosted
    steps:
      # login to dockerhub to prevent limit rate
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

  shellcheck:
    name: "Shell: Lint Shell Scripts"
    runs-on: self-hosted
    needs:
      - init
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Lint Shell Scripts
        run: |
          shellcheck --shell=bash entrypoint.sh

  hadolint:
    name: "Docker: Lint Dockerfile"
    runs-on: self-hosted
    needs:
      - init
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Lint Dockerfile
        run: |
          docker run --rm -i hadolint/hadolint < Dockerfile

  docker-build-images:
    name: "Docker: Build Images"
    needs:
      - init
      - shellcheck
      - hadolint
    uses: hoverkraft-tech/ci-github-container/.github/workflows/docker-build-images.yml@0.18.0
    permissions:
      actions: write
      contents: read
      id-token: write
      issues: read
      packages: write
      pull-requests: read
    secrets:
      oci-registry-password: ${{ secrets.GITHUB_TOKEN }}
    with:
      runs-on: '["self-hosted"]'
      oci-registry: ghcr.io
      oci-registry-username: ${{ github.actor }}
      images: |
        [{
          "name": "app",
          "repository": "${{ github.repository }}",
          "tag": "${{ inputs.tag }}",
          "dockerfile": "./Dockerfile",
          "platforms": [
            "linux/amd64",
            "linux/arm64"
          ]
        }]

  sign-images:
    name: "Docker: Sign Images"
    runs-on: self-hosted
    needs:
      - init
      - shellcheck
      - hadolint
      - docker-build-images
    steps:
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: install cosign
        uses: sigstore/cosign-installer@v3.7.0
        with:
          cosign-release: 'v2.4.1'

      - name: debug
        run: |
          set -ex
          echo "output1=${{ needs.docker-build-images.outputs.built-images }}"
          echo "output2=${{ fromJson(needs.docker-build-images.outputs.built-images) }}"
          echo "output3=${{ fromJson(needs.docker-build-images.outputs.built-images).app.tags }}[]"
          echo "output4=${{ fromJson(needs.docker-build-images.outputs.built-images).app.tags[0] }}"
          echo "output5=${{ fromJson(needs.docker-build-images.outputs.built-images).app.digests }}[]"
          echo "output6=${{ fromJson(needs.docker-build-images.outputs.built-images).app.digests[0] }}"

      - name: Prepare vars
        id: prepare-vars
        uses: actions/github-script@v8
        with:
          script: |
            const builtImages = JSON.parse(process.env.BUILT_IMAGES);
            const tags = builtImages.app.images.join(',');
            const digest = builtImages.app.digests[0].includes('@') ? builtImages.app.digests[0].split('@')[1] : '';
            core.setOutput('tags', tags);
            core.setOutput('digest', digest);
        env:
          BUILT_IMAGES: ${{ needs.docker-build-images.outputs.built-images }}

      - name: Sign container images with a key
        uses: dodopizza/cosign-sign-push-action@v1.0.13
        with:
          image-tags: ${{ steps.prepare-vars.outputs.tags }}
          image-digest: ${{ steps.prepare-vars.outputs.digest }}
          cosign-private-key: ${{ secrets.COSIGN_PRIVATE_KEY }}
          cosign-password: ''

  chart-testing:
    name: "Tests: helm chart"
    runs-on: self-hosted
    needs:
      - init
      - docker-build-images
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install tools with asdf
        uses: asdf-vm/actions/install@v3
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Set up chart-testing
        uses: helm/chart-testing-action@v2.6.1
      - name: Run chart-testing (list-changed)
        id: list-changed
        run: |
          changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
          if [[ -n "$changed" ]]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Run chart-testing (lint)
        if: steps.list-changed.outputs.changed == 'true'
        run: ct lint --target-branch ${{ github.event.repository.default_branch }}
      - name: Create kind cluster
        if: steps.list-changed.outputs.changed == 'true'
        uses: helm/kind-action@v1.11.0
      - name: Run chart-testing (install)
        if: steps.list-changed.outputs.changed == 'true'
        run: |
          ct install \
            --target-branch ${{ github.event.repository.default_branch }} \
            --helm-extra-args "--set image.tag=${{ fromJson(needs.docker-build-images.outputs.built-images).app.tags[0] }} --wait"
      - name: show pods
        if: steps.list-changed.outputs.changed == 'true'
        run: |
          sleep 10
          kubectl get cronjob -n default
          kubectl create job --from=cronjob/ovh-snapshoter -n default ovh-snapshoter-job
          sleep 10
          kubectl get pods -n default

  app-testing:
    name: "Tests: application"
    runs-on: self-hosted
    needs:
      - init
      - docker-build-images
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Run tests
        run: |
          echo "OS_PASSWORD length: ${#OS_PASSWORD}"
          echo "OS_PROJECT_ID length: ${#OS_PROJECT_ID}"
          echo "OS_REGION_NAME length: ${#OS_REGION_NAME}"
          echo "OS_TENANT_ID length: ${#OS_TENANT_ID}"
          echo "OS_TENANT_NAME length: ${#OS_TENANT_NAME}"
          echo "OS_USERNAME length: ${#OS_USERNAME}"
          echo "OS_VOLUMES length: ${#OS_VOLUMES}"
          docker run --rm -i  \
            -e DRY_RUN=true   \
            -e CLEANUP=true   \
            -e OS_PASSWORD    \
            -e OS_PROJECT_ID  \
            -e OS_REGION_NAME \
            -e OS_TENANT_ID   \
            -e OS_TENANT_NAME \
            -e OS_USERNAME    \
            -e OS_VOLUMES     \
            ${IMAGE} > output
        env:
          OS_PASSWORD: ${{ secrets.OS_PASSWORD }}
          OS_PROJECT_ID: ${{ secrets.OS_PROJECT_ID }}
          OS_REGION_NAME: ${{ secrets.OS_REGION_NAME }}
          OS_TENANT_ID: ${{ secrets.OS_TENANT_ID }}
          OS_TENANT_NAME: ${{ secrets.OS_TENANT_NAME }}
          OS_USERNAME: ${{ secrets.OS_USERNAME }}
          OS_VOLUMES: ${{ secrets.OS_VOLUMES }}
          IMAGE: ghcr.io/${{ github.repository }}/app:${{ fromJson(needs.docker-build-images.outputs.built-images).app.tags[0] }}
      - name: show output
        run: |
          cat output
      - name: check if snapshot was created
        run: |
          echo -n "check if snapshot was created: "
          grep -q "would create snapshot $(date +%Y%m%d)" output && echo 'ok'
      - name: check if old snapshot will be deleted
        run: |
          echo -n "check if old snapshot will be deleted: "
          grep -q "would remove snapshot with id=" output && echo ok
      - name: delete output file
        run: rm output