push_pr_checks_tests.yml

name: Checks and tests

on:
  pull_request:
  merge_group:
  push:
    branches:
      - main
      - renovate/**

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  codespell:
    name: codespell
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Codespell test
        uses: codespell-project/actions-codespell@94259cd8be02ad2903ba34a22d9c13de21a74461 # 94259cd8be02ad2903ba34a22d9c13de21a74461

  cargo-fmt:
    name: cargo fmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: ./.github/actions/install-rust-toolchain
        with:
          components: rustfmt

      - name: Check code formatting
        run: cargo fmt --check

  cargo-clippy:
    name: cargo clippy
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ ubuntu-latest, windows-latest ]
    permissions:
      contents: read
      checks: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: ./.github/actions/install-rust-toolchain
        with:
          components: clippy

      - uses: ./.github/actions/rust-cache
        with:
          identifier: 'clippy'
          restore-strategy: ${{ github.ref == 'refs/heads/main' && 'exact' || 'nearest' }}
          save-cache: true

      - name: cargo clippy with compiler warnings
        run: cargo clippy --workspace --all-targets -- -D warnings -D clippy::all

  cargo-doc:
    name: cargo doc
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ ubuntu-latest, windows-latest ]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: ./.github/actions/install-rust-toolchain

      - name: Create documentation
        run: cargo doc --no-deps --package newrelic_agent_control
        env:
          RUSTDOCFLAGS: --cfg docsrs

  third-party-notices-check:
    name: ⚖️ Check third party licenses
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: ./.github/actions/install-rust-toolchain

      - name: Fetch dependencies
        run: cargo fetch

      - uses: newrelic/rust-licenses-noticer@9da6eb161e6fa15cf315a3012096447513015224 # v1
        with:
          template-file: THIRD_PARTY_NOTICES.md.tmpl

  unused-dependencies-check:
    name: cargo shear (unused dependencies)
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ ubuntu-latest, windows-latest ]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: taiki-e/install-action@94cb46f8d6e437890146ffbd78a778b78e623fb2 # v2.74.0
        with:
          tool: cargo-shear@1.7.2

      - run: cargo shear

  coverage:
    name: ubuntu / stable / coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: ./.github/actions/install-rust-toolchain
        with:
          components: llvm-tools-preview

      - name: cargo install cargo-llvm-cov
        uses: taiki-e/install-action@71765c00dd3e08a5484a5b9e82a4c88b86520e0e # 71765c00dd3e08a5484a5b9e82a4c88b86520e0e
        # uses: taiki-e/install-action@cargo-llvm-cov
      - name: cargo generate-lockfile
        if: hashFiles('Cargo.lock') == ''
        run: cargo generate-lockfile
      - uses: ./.github/actions/rust-cache
        with:
          identifier: 'coverage'
          restore-strategy: ${{ github.ref == 'refs/heads/main' && 'exact' || 'nearest' }}
          save-cache: true
      - name: Generate coverage report
        run: COVERAGE_OUT_FORMAT=json COVERAGE_OUT_FILEPATH=jcov.info make coverage
      - name: Calculate and print total coverage
        run: |
          echo "Total functions coverage: $(jq '.data[].totals.functions.percent' jcov.info)"
          echo "Total lines coverage: $(jq '.data[].totals.lines.percent' jcov.info)"
          echo "Total regions coverage: $(jq '.data[].totals.regions.percent' jcov.info)"
          echo "Total instantiations coverage: $(jq '.data[].totals.instantiations.percent' jcov.info)"
      - name: Fail if function coverage is below 75%
        run: |
          fn_cov=$(jq '.data[].totals.functions.percent' jcov.info)
          expected=75

          if (( $(echo "$fn_cov < $expected" | bc -l) )); then
            echo "Function coverage is below ${expected}%"
            exit 1
          fi
      - name: Fail if line coverage is below 80%
        run: |
          ln_cov=$(jq '.data[].totals.lines.percent' jcov.info)
          expected=80

          if (( $(echo "$ln_cov < $expected" | bc -l) )); then
            echo "Line coverage is below ${expected}%"
            exit 1
          fi

  security:
    uses: ./.github/workflows/component_security.yml

  generate-release-build:
    name: "Build release binaries"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: ./.github/actions/install-rust-toolchain
        with:
          targets: >-
            x86_64-unknown-linux-musl

      - name: cargo generate-lockfile
        if: hashFiles('Cargo.lock') == ''
        run: cargo generate-lockfile
      - uses: ./.github/actions/rust-cache
        # We have faced issues 'hashFiles('**/Cargo.lock') failed.' in this job. As we couldn't pinpoint
        # the exact cause, we are adding continue-on-error to avoid blocking merges.
        continue-on-error: true
        with:
          identifier: 'release'
          restore-strategy: ${{ github.ref == 'refs/heads/main' && 'exact' || 'nearest' }}
          save-cache: true

      - name: Install Zig
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2

      - uses: taiki-e/install-action@94cb46f8d6e437890146ffbd78a778b78e623fb2 # v2.74.0
        with:
          tool: cargo-zigbuild@0.20.1

      - name: Build k8s in release mode
        run: cargo zigbuild --release --package newrelic_agent_control --bin newrelic-agent-control-k8s --target x86_64-unknown-linux-musl
      - name: Build onhost in release mode
        run: cargo zigbuild --release --package newrelic_agent_control --bin newrelic-agent-control --target x86_64-unknown-linux-musl

  unit-docs-onhost-integration-tests:
    name: Unit, docs and onhost integration tests
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ ubuntu-latest, windows-latest ]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - if: ${{ matrix.os == 'ubuntu-latest' }}
        uses: ./.github/actions/install-rust-toolchain
        with:
          targets: >-
            aarch64-unknown-linux-musl,
            x86_64-unknown-linux-musl

      - if: ${{ matrix.os == 'windows-latest' }}
        uses: ./.github/actions/install-rust-toolchain

      - name: cargo generate-lockfile
        if: hashFiles('Cargo.lock') == ''
        run: cargo generate-lockfile

      - uses: ./.github/actions/rust-cache
        with:
          identifier: 'test-dev'
          restore-strategy: 'nearest'
          save-cache: false

      - name: Run workspace tests excluding the agent control pkg (includes -winAdmin- ignored because it doesn't apply)
        run: cargo test --workspace --exclude 'newrelic_agent_control' --all-targets -- --include-ignored

      - name: Run tests agent control lib excluding root-required tests (on-host)
        run: make -C agent-control test/onhost

      - name: Run tests agent control integration_test excluding root-required tests (on-host)
        run: make -C agent-control test/onhost/integration

      - name: Run tests agent control (k8s)
        run: make -C agent-control test/k8s

      - name: Run documentation tests
        run: cargo test --locked --doc

  # Test using root can be troublesome to perform as usually the Rust toolchain is installed local to the user.
  # To test for root privileges, we can run from a container (disabling the test that fail if running non-root).
  on-host-root-tests:
    name: tests as root
    # Container operations must run on a linux runner https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcontainer.
    # We use `null` to disable the use of a container on windows.
    container: ${{ matrix.os == 'ubuntu-latest' && 'rust:latest' || null }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ ubuntu-latest, windows-latest ]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: ./.github/actions/install-rust-toolchain

      - uses: ./.github/actions/rust-cache
        with:
          identifier: 'test-dev'
          restore-strategy: 'nearest'
          save-cache: false

      - name: Run onHost root-required integration-tests only
        run: make -C agent-control test/onhost/root/integration

  on-host-oci-registry-tests:
    name: tests with oci registry
    # Container operations must run on a linux runner https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcontainer.
    # We use `null` to disable the use of a container on windows.
    container: ${{ matrix.os == 'ubuntu-latest' && 'rust:latest' || null }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ ubuntu-latest, windows-latest ]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: ./.github/actions/install-rust-toolchain

      - uses: ./.github/actions/rust-cache
        with:
          identifier: 'test-dev'
          restore-strategy: 'nearest'
          save-cache: false

      - name: Run onHost root-required integration-tests only
        shell: bash
        run: make -C agent-control test/onhost/oci-registry/integration

      - name: Show zot logs
        run: cat ~/.zot/zot.log

  k8s-integration-tests:
    name: K8s integration tests
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        group: [ part1, part2, flux-self-update ]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Free up space
        run: bash .github/workflows/scripts/space_cleanup.sh

      - name: Setup Minikube
        uses: manusa/actions-setup-minikube@96202dee4ae1c2f46a62fe197273aaf22b83f42d # v2.16.1
        with:
          minikube version: v1.35.0
          kubernetes version: "v1.30.14"
          driver: docker
          github token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Tilt
        run: |
          curl -fsSL https://raw.githubusercontent.com/tilt-dev/tilt/master/scripts/install.sh | bash

      - uses: ./.github/actions/install-rust-toolchain
        with:
          targets: >-
            x86_64-unknown-linux-musl

      - uses: ./.github/actions/rust-cache
        # We have faced issues 'hashFiles('**/Cargo.lock') failed.' in this job. As we couldn't pinpoint
        # the exact cause, we are adding continue-on-error to avoid blocking merges.
        continue-on-error: true
        with:
          identifier: 'test-dev'
          restore-strategy: ${{ github.ref == 'refs/heads/main' && 'exact' || 'nearest' }}
          save-cache: true

      - name: Install Zig
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2

      - uses: taiki-e/install-action@94cb46f8d6e437890146ffbd78a778b78e623fb2 # v2.74.0
        with:
          tool: cargo-zigbuild@0.20.1

      - name: Run k8s integration tests
        env:
          # Tilt configs
          ARCH: amd64
        run: make -C agent-control test/k8s/integration-${{ matrix.group }}

  k8s-e2e-tests:
    uses: ./.github/workflows/component_k8s_e2e.yml
    with:
      scenarios: '["infra"]'
      caller_workflow: push_pr_checks_tests
    secrets:
      E2E_ACCOUNT_ID: ${{ secrets.AC_PROD_E2E_ACCOUNT_ID }}
      E2E_API_KEY: ${{ secrets.AC_PROD_E2E_API_KEY }}
      E2E_LICENSE_KEY: ${{ secrets.AC_PROD_E2E_LICENSE_KEY }}

  check-all-green:
    name: 🟢 All required checks and tests pass
    if: always()

    needs:
      # checks
      - cargo-clippy
      - cargo-fmt
      - cargo-doc
      - third-party-notices-check
      - unused-dependencies-check
      - codespell
      - security
      - coverage
      # tests
      - generate-release-build
      - unit-docs-onhost-integration-tests
      - on-host-root-tests
      - on-host-oci-registry-tests
      - k8s-integration-tests
      - k8s-e2e-tests

    runs-on: Ubuntu-latest

    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # 05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe
        with:
          # allowed-failures: docs, linters
          # allowed-skips: non-voting-flaky-job
          jobs: ${{ toJSON(needs) }}