fix(ci): repair release workflow entrypoints

mahmut-Abi · mahmut-Abi · commit 2f42562f5867 · 2026-06-16T21:52:05.000+08:00
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -28,6 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       release_tag: ${{ steps.vars.outputs.release_tag }}
+      checkout_ref: ${{ steps.vars.outputs.checkout_ref }}
       control_image: ${{ steps.vars.outputs.control_image }}
       control_image_name: ${{ steps.vars.outputs.control_image_name }}
 
@@ -47,21 +48,26 @@ jobs:
           fi
 
           owner_lc="${GITHUB_REPOSITORY_OWNER,,}"
+          checkout_ref="refs/tags/${release_tag}"
           control_image_name="ghcr.io/${owner_lc}/nantian-controlplane"
           control_image="${control_image_name}:${release_tag}"
 
           {
             echo "release_tag=${release_tag}"
+            echo "checkout_ref=${checkout_ref}"
             echo "control_image=${control_image}"
             echo "control_image_name=${control_image_name}"
           } >>"${GITHUB_OUTPUT}"
 
   security-scans:
     name: Security Scans
+    needs: metadata
     permissions:
       contents: read
       security-events: read
     uses: ./.github/workflows/security-scans.yml
+    with:
+      checkout_ref: ${{ needs.metadata.outputs.checkout_ref }}
 
   controlplane:
     name: Controlplane Tests
@@ -72,6 +78,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.metadata.outputs.checkout_ref }}
 
       - name: Set up Go
         uses: actions/setup-go@v6
@@ -80,8 +88,7 @@ jobs:
           cache-dependency-path: go.sum
 
       - name: Run Go unit tests
-        working-directory: controlplane
-        run: go test ./...
+        run: go test -count=1 -timeout 5m ./...
 
   kind-smoke:
     name: Kind Validation
@@ -90,11 +97,20 @@ jobs:
       - metadata
       - controlplane
     timeout-minutes: 90
+    env:
+      CLUSTER_NAME: release-validation
+      GATEWAY_API_VERSION: v1.5.1
+      CONTROLPLANE_IMAGE: ${{ needs.metadata.outputs.control_image }}
+      DATAPLANE_IMAGE: ghcr.io/nantian-gw/dataplane:latest
+      DASHBOARD_IMAGE: ghcr.io/nantian-gw/dashboard:latest
+      CONFORMANCE_EXPERIMENTAL: "true"
+      ALL_FEATURES: "true"
 
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
+          ref: ${{ needs.metadata.outputs.checkout_ref }}
           fetch-depth: 0
 
       - name: Set up Go
@@ -103,82 +119,73 @@ jobs:
           go-version-file: go.mod
           cache-dependency-path: go.sum
 
-      - name: Install release validation dependencies
+      - name: Install Kind tooling
+        run: scripts/ci/install-kind-tools.sh
+
+      - name: Create kind cluster
+        run: scripts/ci/create-kind-cluster.sh
+
+      - name: Install Gateway API CRDs
+        run: scripts/ci/install-gateway-api-crds.sh
+
+      - name: Build current control-plane image
+        run: scripts/ci/build-controlplane-image.sh
+
+      - name: Load images into kind
+        run: scripts/ci/load-kind-images.sh
+
+      - name: Deploy Nantian Gateway
+        run: scripts/ci/deploy-kind-conformance.sh
+
+      - name: Record image versions
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends protobuf-compiler libprotobuf-dev jq socat
-          go install sigs.k8s.io/kind@v0.27.0
-          sudo curl -fsSL "https://dl.k8s.io/release/v1.32.2/bin/linux/amd64/kubectl" -o /usr/local/bin/kubectl
-          sudo chmod +x /usr/local/bin/kubectl
-          echo "$(go env GOPATH)/bin" >>"${GITHUB_PATH}"
-
-      - name: Run Kind smoke test with release tag
-        env:
-          IMAGE_TAG: ${{ needs.metadata.outputs.release_tag }}
-        run: ./tests/e2e/run-kind.sh
+          echo "=== Images under test ==="
+          kubectl get pods -n nantian-gw -o json | jq -r '.items[] | .spec.containers[] | "  \(.name): \(.image)"'
+          echo "=== Image digests ==="
+          kubectl get pods -n nantian-gw -o json | jq -r '.items[] | .status.containerStatuses[] | "  \(.name): \(.imageID)"'
+
+      - name: Run smoke test
+        run: CLUSTER_NAME="$CLUSTER_NAME" ./test/e2e/smoke/run.sh --no-cleanup
 
       - name: Run full Gateway API conformance
         id: conformance
         env:
           RELEASE_TAG: ${{ needs.metadata.outputs.release_tag }}
-          REPORT_PATH: ${{ github.workspace }}/dist/conformance/report.yaml
-          LOG_PATH: ${{ github.workspace }}/dist/conformance/run.log
         run: |
           mkdir -p dist/conformance
+          report_path="${GITHUB_WORKSPACE}/dist/conformance/report.yaml"
           set +e
-          ALL_FEATURES=true \
-          IMPLEMENTATION_VERSION="${RELEASE_TAG}" \
-          REPORT_OUTPUT="${REPORT_PATH}" \
-          ./tests/conformance/run.sh 2>&1 | tee "${LOG_PATH}"
+          go test -tags=conformance -count=1 -v -timeout 30m ./conformance/ \
+            -args \
+            -gateway-class nantian-gw \
+            -report-output "$report_path" \
+            -organization "Nantian Gateway" \
+            -project "Nantian Gateway" \
+            -url "https://github.com/nantian-gw/gateway" \
+            -version "${RELEASE_TAG}" \
+            -contact "https://github.com/nantian-gw/gateway/issues" 2>&1 \
+            | tee dist/conformance/run.log
           status=${PIPESTATUS[0]}
           echo "exit_code=${status}" >>"${GITHUB_OUTPUT}"
           exit "${status}"
 
-      - name: Archive conformance report into repository layout
-        if: always()
-        env:
-          RELEASE_TAG: ${{ needs.metadata.outputs.release_tag }}
-          SOURCE_COMMAND: ALL_FEATURES=true IMPLEMENTATION_VERSION=${{ needs.metadata.outputs.release_tag }} REPORT_OUTPUT=${{ github.workspace }}/dist/conformance/report.yaml ./tests/conformance/run.sh
-          SOURCE_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          if [[ ! -f dist/conformance/report.yaml ]]; then
-            echo "no report produced; skipping archival"
-            exit 0
-          fi
-
-          if [[ "${{ steps.conformance.outputs.exit_code }}" == "0" ]]; then
-            export RESULT_STATUS=passed
-          else
-            export RESULT_STATUS=failed
-          fi
-          export REPORT_SCOPE=releases
-
-          scripts/archive-conformance-report.sh \
-            "${RELEASE_TAG}" \
-            "${GITHUB_WORKSPACE}/dist/conformance/report.yaml" \
-            "${GITHUB_WORKSPACE}/dist/conformance/run.log"
-
-          cp "reports/conformance/releases/${RELEASE_TAG}/metadata.yaml" "dist/conformance/metadata.yaml"
+      - name: Collect diagnostics on failure
+        if: failure()
+        run: ARTIFACT_DIR=tmp/conformance-diagnostics scripts/ci/collect-kind-diagnostics.sh
 
-      - name: Upload conformance artifact
+      - name: Upload conformance artifacts
         if: always()
         uses: actions/upload-artifact@v7
         with:
           name: conformance-${{ needs.metadata.outputs.release_tag }}
-          path: dist/conformance/
+          path: |
+            dist/conformance/
+            tmp/conformance-diagnostics/
           if-no-files-found: warn
 
-      - name: Publish conformance reports branch
+      - name: Cleanup
         if: always()
-        env:
-          COMMIT_MESSAGE: "conformance: archive ${{ needs.metadata.outputs.release_tag }}"
-        run: |
-          if [[ ! -f reports/conformance/latest/report.yaml ]]; then
-            echo "no archived report available; skipping branch publish"
-            exit 0
-          fi
-
-          scripts/publish-conformance-reports.sh conformance-reports
+        run: command -v kind >/dev/null 2>&1 && kind delete cluster --name "$CLUSTER_NAME" || true
 
   publish:
     name: Publish Release Images
@@ -194,6 +201,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.metadata.outputs.checkout_ref }}
 
       - name: Set up Go
         uses: actions/setup-go@v6
@@ -248,4 +257,4 @@ jobs:
         with:
           name: image-metadata-${{ needs.metadata.outputs.release_tag }}
           path: dist/image-metadata/
-          if-no-files-found: warn
+          if-no-files-found: warn
diff --git a/.github/workflows/security-scans.yml b/.github/workflows/security-scans.yml
@@ -2,7 +2,17 @@ name: Security Scans
 
 "on":
   workflow_call:
+    inputs:
+      checkout_ref:
+        description: "Git ref to scan"
+        required: true
+        type: string
   workflow_dispatch:
+    inputs:
+      checkout_ref:
+        description: "Git ref to scan"
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -21,6 +31,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.checkout_ref }}
 
       - name: Set up Go
         uses: actions/setup-go@v6
@@ -58,12 +70,12 @@ jobs:
           echo "${RUNNER_TEMP:-/tmp}/bin" >>"${GITHUB_PATH}"
 
       - name: Run security scan bundle
-        run: scripts/run-security-scans.sh
+        run: scripts/ci/run-security-scans.sh
 
       - name: Upload security scan artifacts
         if: always()
         uses: actions/upload-artifact@v7
         with:
           name: security-scans
           path: tmp/security-scans/latest/
-          if-no-files-found: warn
+          if-no-files-found: warn
diff --git a/scripts/ci/ci_assets_test.go b/scripts/ci/ci_assets_test.go
@@ -157,6 +157,55 @@ func TestWorkflowsUseSharedKindClusterHelper(t *testing.T) {
 	}
 }
 
+func TestReleaseWorkflowUsesCurrentCIEntrypoints(t *testing.T) {
+	contents := string(readFile(t, repoPath(".github", "workflows", "release.yml")))
+
+	for _, want := range []string{
+		`checkout_ref: ${{ steps.vars.outputs.checkout_ref }}`,
+		`ref: ${{ needs.metadata.outputs.checkout_ref }}`,
+		`run: go test -count=1 -timeout 5m ./...`,
+		`run: scripts/ci/install-kind-tools.sh`,
+		`run: scripts/ci/create-kind-cluster.sh`,
+		`run: scripts/ci/install-gateway-api-crds.sh`,
+		`run: scripts/ci/load-kind-images.sh`,
+		`run: scripts/ci/deploy-kind-conformance.sh`,
+		`run: CLUSTER_NAME="$CLUSTER_NAME" ./test/e2e/smoke/run.sh --no-cleanup`,
+		`go test -tags=conformance -count=1 -v -timeout 30m ./conformance/ \`,
+	} {
+		if !strings.Contains(contents, want) {
+			t.Fatalf("release workflow missing %q", want)
+		}
+	}
+
+	for _, unwanted := range []string{
+		`working-directory: controlplane`,
+		`./tests/e2e/run-kind.sh`,
+		`./tests/conformance/run.sh`,
+		`scripts/archive-conformance-report.sh`,
+		`scripts/publish-conformance-reports.sh`,
+	} {
+		if strings.Contains(contents, unwanted) {
+			t.Fatalf("release workflow still contains stale path %q", unwanted)
+		}
+	}
+}
+
+func TestSecurityScanWorkflowUsesExistingHelper(t *testing.T) {
+	contents := string(readFile(t, repoPath(".github", "workflows", "security-scans.yml")))
+	helperPath := repoPath("scripts", "ci", "run-security-scans.sh")
+
+	if !strings.Contains(contents, `run: scripts/ci/run-security-scans.sh`) {
+		t.Fatalf("security scan workflow must invoke scripts/ci/run-security-scans.sh")
+	}
+	if !strings.Contains(contents, `ref: ${{ inputs.checkout_ref }}`) {
+		t.Fatalf("security scan workflow must checkout the caller-provided ref")
+	}
+
+	if _, err := os.Stat(helperPath); err != nil {
+		t.Fatalf("security scan helper %s is missing: %v", helperPath, err)
+	}
+}
+
 func TestSmokeScriptForwardsToProgrammedGatewayListener(t *testing.T) {
 	contents := string(readFile(t, repoPath("test", "e2e", "smoke", "run.sh")))
 
diff --git a/scripts/ci/run-security-scans.sh b/scripts/ci/run-security-scans.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ARTIFACT_DIR="${ARTIFACT_DIR:-tmp/security-scans/latest}"
+mkdir -p "$ARTIFACT_DIR"
+
+osv-scanner scan source -r . --format json --output-file "$ARTIFACT_DIR/osv-scanner.json"
+grype dir:. -o json --file "$ARTIFACT_DIR/grype-dir.json"
+kubescape scan framework nsa \
+  --format json \
+  --format-version v2 \
+  --output "$ARTIFACT_DIR/kubescape-nsa.json" \
+  deploy/kubernetes/overlays/kind-conformance
+
+{
+  echo "Generated security scan artifacts in $ARTIFACT_DIR"
+  echo "osv-scanner: $(command -v osv-scanner)"
+  echo "grype: $(command -v grype)"
+  echo "kubescape: $(command -v kubescape)"
+} >"$ARTIFACT_DIR/summary.txt"
