image-pr.yaml

name: 'Build AMD64 images (PR)'

on:
  pull_request:

permissions:
  contents: write
  security-events: write
  id-token: write
  actions: read
concurrency:
  group: ci-pr-amd64-${{ github.head_ref || github.ref }}-${{ github.repository }}
  cancel-in-progress: true
jobs:
  build:
    name: ${{ matrix.image_name }}
    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@8952c3a5f4f6255cc63af88cb3637a9684970c8d # v1.1.3
    secrets:
      # The PR path only ever writes quay.io/kairos/ci-temp-images, so it uses
      # the kairos+prci robot, which has Write on that repository and nothing
      # else. QUAY_USERNAME/QUAY_PASSWORD is the credential release.yaml uses to
      # publish permanent images and does not belong on a PR path.
      registry_username: ${{ secrets.QUAY_PR_USERNAME }}
      registry_password: ${{ secrets.QUAY_PR_PASSWORD }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - image_name: "hadron"
            base_image: "ghcr.io/kairos-io/hadron:v0.5.1"
            kubernetes_distro: ""
            custom_job_name_format: "core-amd64-generic"
          - image_name: "hadron"
            base_image: "ghcr.io/kairos-io/hadron:v0.5.1"
            kubernetes_distro: "k3s"
            custom_job_name_format: "standard-amd64-generic-k3s"
    with:
      auroraboot_version: "v0.26.2"
      dockerfile_path: "images/Dockerfile"
      base_image: ${{ matrix.base_image }}
      model: "generic"
      arch: "amd64"
      version: "auto"
      iso: true
      grype: true
      # Report-only: the scan still runs and reports, but criticals from the
      # upstream base image must not block PRs. Mirrors master / release builds.
      security_scan_mode: "report-only"
      registry_domain: "quay.io"
      registry_namespace: "kairos"
      registry_repository: "ci-temp-images"
      custom_tag_format: "$FLAVOR-$FLAVOR_RELEASE-$VARIANT-$ARCH-$MODEL-$COMMIT_SHA"
      custom_artifact_format: "kairos-$FLAVOR-$FLAVOR_RELEASE-$VARIANT-$ARCH-$MODEL"
      custom_job_name_format: ${{ matrix.custom_job_name_format }}
      image_labels: "quay.expires-after=6h"
      summary_artifacts: true
      kubernetes_distro: ${{ matrix.kubernetes_distro }}
  core-tests:
    name: ${{ format('core-tests (hadron, amd64, generic) {0}', matrix.test) }}
    # Explicit rather than `secrets: inherit`, and scoped to the ci-temp-images
    # robot. These jobs boot an image built from the pull request under review;
    # they pull it from ci-temp-images and push a bundles-test image back there,
    # so Write on that one repository is all they need.
    secrets:
      QUAY_USERNAME: ${{ secrets.QUAY_PR_USERNAME }}
      QUAY_PASSWORD: ${{ secrets.QUAY_PR_PASSWORD }}
    uses: ./.github/workflows/reusable-qemu-test.yaml
    with:
      base_image: "ghcr.io/kairos-io/hadron:v0.5.1"
      test: ${{ matrix.test }}
      secureboot: false
      release-matcher: ${{ matrix.release-matcher || '' }}
      variant: "core"
      arch: "amd64"
      model: "generic"
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        include:
          - test: "custom-partitioning"
          - test: "acceptance"
          - test: "install"
          - test: "install-target"
          - test: "reset"
          - test: "upgrade-with-cli"
          - test: "bundles"
          - test: "upgrade-latest-with-cli"
            release-matcher: "kairos-hadron-*-core-amd64-generic-v*.iso"
  standard-tests:
    name: ${{ format('standard-tests (hadron, amd64, generic) {0}', matrix.test) }}
    uses: ./.github/workflows/reusable-qemu-test.yaml
    # Explicit rather than `secrets: inherit`, and scoped to the ci-temp-images
    # robot. These jobs boot an image built from the pull request under review;
    # they pull it from ci-temp-images and push a bundles-test image back there,
    # so Write on that one repository is all they need.
    secrets:
      QUAY_USERNAME: ${{ secrets.QUAY_PR_USERNAME }}
      QUAY_PASSWORD: ${{ secrets.QUAY_PR_PASSWORD }}
    permissions:
      contents: write
      security-events: write
      id-token: write
      actions: read
      attestations: read
      checks: read
      deployments: read
      discussions: read
      issues: read
      packages: read
      pages: read
      pull-requests: read
      repository-projects: read
      statuses: read
    with:
      base_image: "ghcr.io/kairos-io/hadron:v0.5.1"
      test: ${{ matrix.test }}
      variant: "standard"
      arch: "amd64"
      model: "generic"
      kubernetes_distro: "k3s"
      use_bridge_network: ${{ matrix.test == 'provider-decentralized-k8s' }}
      release-matcher: ${{ matrix.release-matcher || '' }}
    needs:
      - build
    strategy:
      fail-fast: false
      matrix:
        include:
          - test: "provider-qrcode-install"
          - test: "provider-upgrade"
          - test: "provider-upgrade-k8s"
          - test: "provider-decentralized-k8s"
          - test: "provider-k3s-disabled"
          - test: "encryption-local"
          - test: "encryption-remote-auto"
          - test: "encryption-remote-static"
          - test: "encryption-remote-https-pinned"
          - test: "encryption-remote-https-bad-cert"
          - test: "encryption-kcrypt-cli"
          - test: "provider-upgrade-latest-k8s-with-kubernetes"
            release-matcher: "kairos-hadron-*-standard-amd64-generic-*k3sv*.iso"