ci.yaml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github. run_id }}
  cancel-in-progress: true

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Set up Go
        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version-file: '.go-version'

      - name: Set up Go cache
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ github.job }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ github.job }}-${{ runner.os }}-go-

      - name: Build
        run: make build

  test:
    name: Test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Set up Go
        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version-file: '.go-version'

      - name: Set up Go cache
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ github.job }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ github.job }}-${{ runner.os }}-go-

      - name: Test
        run: make test

  lint:
    name: Lint
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Set up Go
        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version-file: '.go-version'

      - name: Set up Go cache
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ github.job }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ github.job }}-${{ runner.os }}-go-

      - name: Make deps
        run: make deps

      - name: Lint Go code
        run: make lint-go

      - name: Lint Helm charts
        run: make lint-helm

      - name: Run Hadolint
        uses: hadolint/hadolint-action@v3.3.0
        with:
          dockerfile: Dockerfile
          config: .hadolint.yaml

      - name: Run Yamllint
        run: |
          pip install --user yamllint
          yamllint .

  license-check:
    name: License check
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Set up Go
        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version-file: '.go-version'

      - name: Set up Go cache
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ github.job }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ github.job }}-${{ runner.os }}-go-

      - name: Cache license information
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        with:
          path: .licensei.cache
          key: licensei-v1-${{ github.ref_name }}-${{ hashFiles('go.sum') }}
          restore-keys: |
            licensei-v1-${{ github.ref_name }}
            licensei-v1-main
            licensei-v1

      - name: Make deps
        run: make deps

      - name: Populate license cache
        run: make license-cache
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check licenses
        run: make license-check
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  artifacts:
    name: Artifacts
    uses: ./.github/workflows/artifacts.yaml
    with:
      publish: ${{ github.event_name == 'push' }}
    permissions:
      contents: read
      packages: write
      id-token: write
      security-events: write

  dependency-review:
    name: Dependency review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Dependency Review
        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

  e2e-test:
    name: E2E test
    runs-on: ubuntu-latest
    needs: [artifacts]
    strategy:
      matrix:
        k8s_version: ["v1.32.0", "v1.33.0", "v1.34.0"]
        operator_version: ["v1.22.4", "v1.23.0", "v1.23.1"] # First version that works with the generic webhook: v1.22.1
        webhook_version: ["v0.2.1", "v0.3.0", "v0.3.1"]

    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Set up Go
        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version-file: '.go-version'

      - name: Download docker image
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: "[container-image] Docker tarball"

      - name: Download helm chart
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: "[helm-chart] package"

      - name: Test
        run: make test-e2e
        env:
          KIND_K8S_VERSION: ${{ matrix.k8s_version }}
          LOAD_IMAGE_ARCHIVE: ${{ github.workspace }}/docker.tar
          RELOADER_VERSION: ${{ needs.artifacts.outputs.container-image-tag }}
          OPERATOR_VERSION: ${{ matrix.operator_version }}
          WEBHOOK_VERSION: ${{ matrix.webhook_version }}
          HELM_CHART: "${{ github.workspace }}/${{ needs.artifacts.outputs.helm-chart-package }}"
          LOG_VERBOSE: "true"