main.yml

name: Validate SecureSign
on:
  push:
    branches: [ "main", "release*" ]
    tags: [ "*" ]
  pull_request:
    branches: [ "main", "release*" ]

env:
  GO_VERSION: 1.25
  REGISTRY: ghcr.io
  CONTAINER_TOOL: podman
  IMG: ghcr.io/securesign/secure-sign-operator:dev-${{ github.sha }}
  BUNDLE_IMG: ghcr.io/securesign/secure-sign-operator-bundle:dev-${{ github.sha }}
  CATALOG_IMG: ghcr.io/securesign/secure-sign-operator-fbc:dev-${{ github.sha }}
  NEW_OLM_CHANNEL: rhtas-operator.v1.5.0
  OCP_VERSION: ${{ vars.OLM_INDEX_VERSION }}

jobs:
  build-operator:
    name: Build-operator
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout source
        uses: actions/checkout@v4

      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Log in to GitHub Container Registry
        uses: redhat-actions/podman-login@v1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          auth_file_path: /tmp/config.json

      - name: Replace images
        run: make dev-images && cat config/default/images.env

      - name: Build operator container
        run: make docker-build docker-push

  build-bundle:
    name: Build-bundle-image
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout source
        uses: actions/checkout@v4

      - name: Log in to GitHub Container Registry
        uses: redhat-actions/podman-login@v1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          auth_file_path: /tmp/config.json

      - name: Log in to registry.redhat.io
        uses: redhat-actions/podman-login@v1
        with:
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}
          registry: registry.redhat.io
          auth_file_path: /tmp/config.json

      - name: Replace images
        run: make dev-images && cat config/default/images.env

      - name: Build operator bundle
        run: make bundle-build bundle-push

  build-fbc:
    name: Build-fbc
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
    needs: build-bundle
    steps:
      - name: Checkout source
        uses: actions/checkout@v4

      - name: Log in to GitHub Container Registry
        uses: redhat-actions/podman-login@v1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          auth_file_path: /tmp/config.json

      - name: Log in to registry.redhat.io
        uses: redhat-actions/podman-login@v1
        with:
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}
          registry: registry.redhat.io
          auth_file_path: /tmp/config.json

      - name: Log in to registry.redhat.io
        uses: redhat-actions/podman-login@v1
        with:
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}
          registry: brew.registry.redhat.io
          auth_file_path: /tmp/config.json

      - name: Install OPM
        uses: redhat-actions/openshift-tools-installer@v1
        with:
          source: "github"
          github_pat: ${{ github.token }}
          opm: 1.61.0

      - name: Checkout FBC source
        uses: actions/checkout@v4
        with:
          repository: "securesign/fbc"
          ref: main
          path: fbc

      - name: Build catalog
        env:
          BUNDLE_IMAGE: ${{ env.BUNDLE_IMG }}
          BUNDLE_NAME: ${{ env.NEW_OLM_CHANNEL }}
          FBC_DIR: rhtas-operator
          GRAPH: ${{ env.OCP_VERSION }}/rhtas-operator/graph.yaml
          CHANNELS: "stable,stable-v1.5"
          CATALOG_FILE: ${{ env.OCP_VERSION }}/rhtas-operator/catalog/rhtas-operator/catalog.json
        run: |
          cd fbc
          utils/configure_bundles.sh
          utils/configure_channels.sh
          utils/render_catalog.sh
          
          cat ${{ env.GRAPH }}
          opm validate ${{ env.OCP_VERSION }}/rhtas-operator/catalog/rhtas-operator
          podman build ${{ env.OCP_VERSION }}/rhtas-operator -f catalog.Dockerfile -t $CATALOG_IMG
          podman push $CATALOG_IMG

  build-tuftool:
    name: Build-tuftool
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout tough source
        uses: actions/checkout@v4
        with:
          repository: "securesign/tough"
          path: tough

      - uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            /tmp/tuftool
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

      - name: Build
        run: cd tough && cargo build --release --target-dir /tmp/tuftool

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: tuftool
          path: /tmp/tuftool/release/tuftool
          retention-days: 1
          if-no-files-found: error

  test-kind:
    name: Test kind deployment
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: read
    needs:
    - build-operator
    - build-tuftool
    steps:
      - name: Checkout source
        uses: actions/checkout@v4

      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Download tuftool
        uses: actions/download-artifact@v4
        with:
          name: tuftool
          path: /tmp/tuftool
      - run: echo "/tmp/tuftool" >> $GITHUB_PATH

      - name: Log in to GitHub Container Registry
        uses: redhat-actions/podman-login@v1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          auth_file_path: /tmp/config.json

      - name: Log in to registry.redhat.io
        uses: redhat-actions/podman-login@v1
        with:
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}
          registry: registry.redhat.io
          auth_file_path: /tmp/config.json

      - name: Install Cluster
        uses: ./.github/actions/kind-cluster
        with:
          config: ./ci/config.yaml
          prometheus: 'true'
          keycloak: 'true'
          olm: 'true'

      - name: Pull Container image from GHCR
        run: podman pull ${{ env.IMG }}

      - name: Load Docker image into Kind cluster
        run: |
          podman save ${{ env.IMG }} -o operator-oci.tar
          kind load image-archive operator-oci.tar

      - name: Replace images
        run: make dev-images && cat config/default/images.env

      - name: Deploy operator container
        run: make deploy

      - name: Wait for operator to be ready
        run: |
          kubectl wait --for=condition=available deployment/rhtas-operator-controller-manager --timeout=120s -n openshift-rhtas-operator

      - name: Add service hosts to /etc/hosts
        run: |
          sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local keycloak-internal.keycloak-system.svc rekor-search-ui.local cli-server.local tsa-server.local" | sudo tee -a /etc/hosts
      - name: Install cosign
        run: go install github.com/sigstore/cosign/v3/cmd/cosign@v3.0.5

      - name: Run tests
        run: make test-e2e

      - name: Archive test artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-kind
          path: test/**/k8s-dump-*.tar.gz
          if-no-files-found: ignore

      - name: dump the logs of the operator
        run: kubectl logs -n openshift-rhtas-operator deployment/rhtas-operator-controller-manager
        if: always()

  test-upgrade:
    name: Test upgrade operator
    runs-on:
      labels: ubuntu-4core
    permissions:
      contents: read
      packages: read
    needs:
      - build-operator
      - build-bundle
      - build-fbc
    steps:
      - name: Checkout source
        uses: actions/checkout@v4

      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Log in to GitHub Container Registry
        uses: redhat-actions/podman-login@v1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          auth_file_path: /tmp/config.json

      - name: Log in to registry.redhat.io
        uses: redhat-actions/podman-login@v1
        with:
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}
          registry: registry.redhat.io
          auth_file_path: /tmp/config.json

      - name: Install Cluster
        uses: ./.github/actions/kind-cluster
        with:
          config: ./ci/config.yaml
          prometheus: 'true'
          keycloak: 'true'
          olm: 'true'

      - name: Pull Container image from GHCR
        run: |
          podman pull ${{ env.IMG }}
          podman pull ${{ env.BUNDLE_IMG }}
          podman pull ${{ env.CATALOG_IMG }}

      - name: Load Docker image into Kind cluster
        run: |
          podman save ${{ env.IMG }} -o operator-oci.tar
          podman save ${{ env.BUNDLE_IMG }} -o operator-bundle-oci.tar
          podman save ${{ env.CATALOG_IMG }} -o operator-fbc-oci.tar
          
          kind load image-archive operator-oci.tar
          kind load image-archive operator-bundle-oci.tar
          kind load image-archive operator-fbc-oci.tar

      - name: Add service hosts to /etc/hosts
        run: |
          sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local keycloak-internal.keycloak-system.svc rekor-search-ui.local cli-server.local tsa-server.local" | sudo tee -a /etc/hosts
      - name: Install cosign
        #keep upgrade scenario on cosign v2 (latest released version does not support cosign v3)
        run: go install github.com/sigstore/cosign/v2/cmd/cosign@v2.4.0

      - name: Replace images
        run: make dev-images generate && cat config/default/images.env

      - name: Run tests
        env:
          TEST_BASE_CATALOG: registry.redhat.io/redhat/redhat-operator-index:${{ vars.OLM_INDEX_VERSION }}
          TEST_TARGET_CATALOG: ${{ env.CATALOG_IMG }}
        run: go test -p 1 ./test/e2e/... -tags=upgrade -timeout 20m

      - name: Archive test artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-upgrade
          path: test/**/k8s-dump-*.tar.gz
          if-no-files-found: ignore

  test-ha-install:
    name: Test with High Availability
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: read
    needs:
    - build-operator
    steps:
      - name: Checkout source
        uses: actions/checkout@v4

      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Log in to GitHub Container Registry
        uses: redhat-actions/podman-login@v1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          auth_file_path: /tmp/config.json

      - name: Log in to registry.redhat.io
        uses: redhat-actions/podman-login@v1
        with:
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}
          registry: registry.redhat.io
          auth_file_path: /tmp/config.json

      - name: Install Cluster
        uses: ./.github/actions/kind-cluster
        with:
          config: ./ci/config.yaml
          prometheus: 'true'
          keycloak: 'true'
          olm: 'true'
          nfs-csi: 'true'

      - name: Pull Container image from GHCR
        run: podman pull ${{ env.IMG }}

      - name: Load Docker image into Kind cluster
        run: |
          podman save ${{ env.IMG }} -o operator-oci.tar
          kind load image-archive operator-oci.tar

      - name: Replace images
        run: make dev-images && cat config/default/images.env

      - name: Deploy operator container
        run: make deploy

      - name: Wait for operator to be ready
        run: |
          kubectl wait --for=condition=available deployment/rhtas-operator-controller-manager --timeout=120s -n openshift-rhtas-operator

      - name: Add service hosts to /etc/hosts
        run: |
          sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local keycloak-internal.keycloak-system.svc rekor-search-ui.local cli-server.local tsa-server.local" | sudo tee -a /etc/hosts

      - name: Install cosign
        run: go install github.com/sigstore/cosign/v3/cmd/cosign@v3.0.5

      - name: Run tests
        run: |
          make generate && go test -p 1 ./test/e2e/... -tags=ha -timeout 20m

      - name: Archive test artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-ha-install
          path: test/**/k8s-dump-*.tar.gz
          if-no-files-found: ignore

      - name: dump the logs of the operator
        run: kubectl logs -n openshift-rhtas-operator deployment/rhtas-operator-controller-manager
        if: always()

      - name: Cleanup Cluster
        uses: ./.github/actions/kind-cluster-cleanup
        if: always()
        with:
          nfs-csi: true

  test-custom-install:
    name: Test with custom operator installation
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: read
    needs:
      - build-operator
    steps:
      - name: Checkout source
        uses: actions/checkout@v4

      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Log in to GitHub Container Registry
        uses: redhat-actions/podman-login@v1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          auth_file_path: /tmp/config.json

      - name: Log in to registry.redhat.io
        uses: redhat-actions/podman-login@9184318aae1ee5034fbfbacc0388acf12669171f # v1
        with:
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}
          registry: registry.redhat.io
          auth_file_path: /tmp/config.json

      - name: Install Cluster
        uses: ./.github/actions/kind-cluster
        with:
          config: ./ci/config.yaml
          nfs-csi: true
          keycloak: 'false' # keycloak use a lot of resources and is not needed for custom_intall tests

      - name: Pull Container image from GHCR
        run: |
          podman pull ${{ env.IMG }}

      - name: Load Docker image into Kind cluster
        run: |
          podman save ${{ env.IMG }} -o operator-oci.tar
          kind load image-archive operator-oci.tar

      - name: Add service hosts to /etc/hosts
        run: |
          sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local rekor-search-ui.local cli-server.local" | sudo tee -a /etc/hosts

      - name: Replace images
        run: make dev-images generate && cat config/default/images.env

      - name: Run tests
        env:
          TEST_MANAGER_IMAGE: ${{ env.IMG }}
        run: make install && go test ./test/e2e/... -tags=custom_install -p 1 -timeout 20m

      - name: Archive test artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-custom-install
          path: test/**/k8s-dump-*.tar.gz
          if-no-files-found: ignore

      - name: Cleanup Cluster
        uses: ./.github/actions/kind-cluster-cleanup
        if: always()
        with:
          nfs-csi: true

  test-e2e:
    name: Execute securesign/sigstore-e2e
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: read
    needs:
      - build-operator
    env:
      TEST_NAMESPACE: test
    steps:
      - name: Checkout source
        uses: actions/checkout@v4
      - name: Checkout test source repository
        uses: actions/checkout@v4
        with:
          repository: "securesign/sigstore-e2e"
          path: e2e

      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Log in to GitHub Container Registry
        uses: redhat-actions/podman-login@v1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          auth_file_path: /tmp/config.json

      - name: Log in to registry.redhat.io
        uses: redhat-actions/podman-login@9184318aae1ee5034fbfbacc0388acf12669171f # v1
        with:
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}
          registry: registry.redhat.io
          auth_file_path: /tmp/config.json

      - name: Install Cluster
        id: kind
        uses: ./.github/actions/kind-cluster
        with:
          config: ./ci/config.yaml
          keycloak: 'true'
          olm: 'true'
          prometheus: 'true'

      - name: Pull Container image from GHCR
        run: |
          podman pull ${{ env.IMG }}

      - name: Load Docker image into Kind cluster
        run: |
          podman save ${{ env.IMG }} -o operator-oci.tar
          kind load image-archive operator-oci.tar

      - name: Add service hosts to /etc/hosts
        run: |
          sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local rekor-search-ui.local tsa-server.local cli-server.local ${{ steps.kind.outputs.oidc_host }}" | sudo tee -a /etc/hosts

      - name: Replace images
        run: make dev-images generate && cat config/default/images.env

      - name: Deploy operator container
        run: make deploy

      - name: Wait for operator to be ready
        run: |
          kubectl wait --for=condition=available deployment/rhtas-operator-controller-manager --timeout=120s -n openshift-rhtas-operator

      - name: Install securesign
        run: |
          sed -i 's#https://your-oidc-issuer-url#http://${{ steps.kind.outputs.oidc_host }}/realms/trusted-artifact-signer#' config/samples/rhtas_v1alpha1_securesign.yaml
          kubectl create ns ${{ env.TEST_NAMESPACE }}
          kubectl create -f config/samples/rhtas_v1alpha1_securesign.yaml -n ${{ env.TEST_NAMESPACE }}
          sleep 1
          kubectl wait --for=condition=Ready securesign/securesign-sample --timeout=5m -n ${{ env.TEST_NAMESPACE }}

      - name: Run tests
        run: |
          export OIDC_ISSUER_URL="http://${{ steps.kind.outputs.oidc_host }}/realms/trusted-artifact-signer"
          export REKOR_UI_URL=$(kubectl  get rekor -o jsonpath='{.items[0].status.rekorSearchUIUrl}' -n ${{ env.TEST_NAMESPACE }})
          export TUF_URL=$(kubectl get tuf -o jsonpath='{.items[0].status.url}' -n ${{ env.TEST_NAMESPACE }})
          export REKOR_URL=$(kubectl get rekor -o jsonpath='{.items[0].status.url}' -n ${{ env.TEST_NAMESPACE }})
          export FULCIO_URL=$(kubectl get fulcio -o jsonpath='{.items[0].status.url}' -n ${{ env.TEST_NAMESPACE }})
          
          export CLI_STRATEGY=cli_server
          export CLI_SERVER_URL="http://cli-server.local"
          
          cd e2e
          source ./tas-env-variables.sh
          # Install Playwright with dependencies for UI tests
          go run github.com/playwright-community/playwright-go/cmd/playwright install --with-deps
          go test -v ./test/...

      - name: dump the logs of the operator
        run: |
          kubectl logs -n openshift-rhtas-operator deployment/rhtas-operator-controller-manager
        if: failure()