Conformance #151
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Conformance | |
| on: | |
| schedule: | |
| - cron: '0 4 * * *' # 04:00 UTC nightly | |
| push: | |
| tags: | |
| - 'v*' | |
| pull_request: | |
| paths: | |
| - 'test/conformance/**' | |
| - '.github/workflows/conformance.yaml' | |
| workflow_dispatch: | |
| jobs: | |
| negative: | |
| name: Negative (webhook deny paths) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: { go-version-file: go.mod } | |
| - uses: helm/kind-action@v1 | |
| with: | |
| cluster_name: hermes-conformance | |
| config: hack/kind-config.yaml | |
| # helm/kind-action writes the kubeconfig to the default location | |
| # ($HOME/.kube/config) but does NOT export KUBECONFIG. The conformance | |
| # suite's BeforeSuite skips when KUBECONFIG is unset, so without this the | |
| # whole suite silently SKIPs. Export it for all subsequent steps. See #64. | |
| - name: Export KUBECONFIG to environment | |
| run: echo "KUBECONFIG=$HOME/.kube/config" >> "$GITHUB_ENV" | |
| - uses: azure/setup-helm@v5 | |
| - name: Install cert-manager | |
| run: bash hack/install-cert-manager.sh | |
| # conformance-install depends on docker-build, so the image is built here | |
| # (no separate docker-build step needed). | |
| - run: make conformance-install IMG=hermes-operator:dev | |
| - run: make conformance-negative | |
| idempotency: | |
| name: Idempotency | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 65 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: { go-version-file: go.mod } | |
| - uses: helm/kind-action@v1 | |
| with: | |
| cluster_name: hermes-conformance | |
| config: hack/kind-config.yaml | |
| - name: Export KUBECONFIG to environment | |
| run: echo "KUBECONFIG=$HOME/.kube/config" >> "$GITHUB_ENV" | |
| - uses: azure/setup-helm@v5 | |
| - name: Install cert-manager | |
| run: bash hack/install-cert-manager.sh | |
| # conformance-install depends on docker-build, so the image is built here | |
| # (no separate docker-build step needed). | |
| - run: make conformance-install IMG=hermes-operator:dev | |
| - run: make conformance-idempotency | |
| upgrade: | |
| name: Upgrade path matrix | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: { go-version-file: go.mod } | |
| - uses: azure/setup-helm@v5 | |
| - env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: make conformance-upgrade | |
| # The GitOps-coexistence and failure-injection suites are not implemented yet | |
| # (gitops_coexistence_test.go is a t.Skip placeholder and there is no | |
| # failure_injection_test.go), so `make conformance-gitops` / `-failure` match | |
| # zero Ginkgo specs. Standing up a kind cluster + cert-manager + an operator | |
| # image build for them runs nothing and, worse, the extra parallel kind | |
| # clusters starve the runner so cert-manager's `--wait` blows past its timeout | |
| # in the jobs that DO run specs (negative). So until those suites land, run | |
| # the targets without a cluster: the focus matches nothing and BeforeSuite | |
| # skips cleanly. Restore the kind/cert-manager/install steps (mirroring the | |
| # negative job) when the specs are written. | |
| gitops: | |
| name: GitOps coexistence | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: { go-version-file: go.mod } | |
| - run: make conformance-gitops | |
| failure-injection: | |
| name: Failure injection | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: { go-version-file: go.mod } | |
| - run: make conformance-failure | |
| # PR runs are advisory; nightly/release-tag runs gate releases. | |
| required: | |
| name: Conformance gate | |
| needs: [negative, idempotency, upgrade, gitops, failure-injection] | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/v') | |
| steps: | |
| - run: echo "All conformance jobs passed." |