kind-e2e.yaml

name: KinD e2e tests

on:
  workflow_dispatch:  # Allow manual runs.
  pull_request:
    branches:
      - 'main'

jobs:
  e2e-tests:
    name: e2e tests
    runs-on: ubuntu-latest
    env:
      # https://github.com/google/go-containerregistry/pull/125 allows insecure registry for
      # '*.local' hostnames. This works both for `ko` and our own tag-to-digest resolution logic,
      # thus allowing us to test without bypassing tag-to-digest resolution.
      REGISTRY_NAME: registry.local
      REGISTRY_PORT: 5000
      KO_DOCKER_REPO: registry.local:5000/ko

    steps:
    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5

    - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
      with:
        go-version-file: 'go.mod'
        check-latest: true

    - name: Install ko
      run: go install ./

    - name: Setup Cluster
      uses: chainguard-dev/actions/setup-kind@81dc0f9b6cd749004a9567afffef41ea84cf954c # main
      with:
        k8s-version: v1.25.x
        registry-authority: ${{ env.REGISTRY_NAME }}:${{ env.REGISTRY_PORT }}

    - name: Install Cosign
      uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0

    - name: Run Smoke Test
      run: |
        # Test with kind load
        KO_DOCKER_REPO=kind.local ko apply --platform=all -f ./test
        kubectl wait --timeout=10s --for=condition=Ready pod/kodata
        kubectl delete pod kodata

        # Test with registry
        ko apply --platform=all -f ./test
        kubectl wait --timeout=60s --for=condition=Ready pod/kodata
        kubectl delete pod kodata

        # Test ko run with kind load
        # This tests that --labels are passed to kubectl, and -wait is passed to the test binary.
        KO_DOCKER_REPO=kind.local ko run ./test -- --labels=foo=bar -- -wait=false

    - name: Check SBOM
      run: |
        set -o pipefail

        echo '::group:: SBOM'
        cosign download sbom $(ko build ./test)
        echo "${SBOM}"
        echo '::endgroup::'

    - name: Collect diagnostics and upload
      if: ${{ failure() }}
      uses: chainguard-dev/actions/kind-diag@84c993eaf02da1c325854fb272a4df9184bd80fc # main