ci-tests.yaml

name: CI run integration tests
on:
  pull_request_target:
    types: [ opened, synchronize, reopened ]

# By specifying the access of one of the scopes, all of those that are not specified are set to 'none'.
permissions:
  # To be able to access the repository with actions/checkout
  contents: read

jobs:
  proxylib:
    timeout-minutes: 360
    name: Run unit tests for proxylib
    runs-on: ubuntu-latest
    steps:
    - name: Install Go
      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
      with:
        # renovate: datasource=golang-version depName=go
        go-version: 1.22.7
    - name: Checkout code
      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
      with:
        persist-credentials: false
    - name: Check module vendoring
      run: |
        go mod tidy
        go mod vendor
        test -z "$(git status --porcelain)" || (echo "please run 'go mod tidy && go mod vendor', and submit your changes"; exit 1)
    - name: Run unit tests
      run: |
        make -C proxylib test

  tests:
    timeout-minutes: 360
    name: Run integration tests on amd64
    runs-on: ubuntu-latest-64-cores-256gb
    steps:
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1

    - name: Login to quay.io
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
      with:
        registry: quay.io
        username: ${{ secrets.QUAY_ENVOY_USERNAME_DEV }}
        password: ${{ secrets.QUAY_ENVOY_PASSWORD_DEV }}

    - name: Enable Docker IPv6
      run: |
        modprobe -v ipv6
        sudo sed -i -e '1s!^{!\{ "ipv6": true, "fixed-cidr-v6": "fd00::/80",!' /etc/docker/daemon.json || echo '{ "ipv6": true, "fixed-cidr-v6": "fd00::/80" }' | sudo tee /etc/docker/daemon.json
        sudo systemctl restart docker

    - name: Cache Docker layers
      uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
      with:
        path: /tmp/buildx-cache
        key: docker-cache-tests
        restore-keys: docker-cache-main

    - name: Checkout PR Source Code
      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
      with:
        ref: ${{ github.event.pull_request.head.sha }}
        persist-credentials: false

    - name: Prep for build
      run: |
        echo "${{ github.event.pull_request.head.sha }}" >SOURCE_VERSION
        echo "ENVOY_VERSION=$(cat ENVOY_VERSION)" >> $GITHUB_ENV
        echo "BAZEL_VERSION=$(cat .bazelversion)" >> $GITHUB_ENV
        echo "BUILDER_DOCKER_HASH=$(git ls-tree --full-tree HEAD -- ./Dockerfile.builder.tests | awk '{ print $3 }')" >> $GITHUB_ENV

    - name: Checking if cilium-envoy-builder image exists
      id: cilium-builder-tests-tag-in-repositories
      shell: bash
      run: |
        if docker buildx imagetools inspect quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:test-${{ env.BAZEL_VERSION }}-${{ env.BUILDER_DOCKER_HASH }} &>/dev/null; then
          echo exists="true" >> $GITHUB_OUTPUT
        else
          echo exists="false" >> $GITHUB_OUTPUT
        fi

    - name: PR Multi-arch build & push of Builder image (dev)
      uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
      if: steps.cilium-builder-tests-tag-in-repositories.outputs.exists == 'false'
      id: docker_build_builder_tests_ci
      with:
        provenance: false
        context: .
        file: ./Dockerfile.builder.tests
        platforms: linux/amd64,linux/arm64
        push: true
        tags: quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:test-${{ env.BAZEL_VERSION }}-${{ env.BUILDER_DOCKER_HASH }}

    - name: Run integration tests on amd64
      uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
      id: docker_tests_ci
      with:
        provenance: false
        context: .
        file: ./Dockerfile.tests
        platforms: linux/amd64
        build-args: |
          BUILDER_BASE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:test-${{ env.BAZEL_VERSION }}-${{ env.BUILDER_DOCKER_HASH }}
          ARCHIVE_IMAGE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder:test-main-archive-latest
          BAZEL_BUILD_OPTS=--remote_upload_local_results=false
          BAZEL_TEST_OPTS=--test_timeout=300 --local_test_jobs=1 --flaky_test_attempts=3
        cache-from: type=local,src=/tmp/buildx-cache
        push: false