From 156e49bc1ed68cb622a2ba011d0b50fd996b0ac9 Mon Sep 17 00:00:00 2001
From: Thomas Sibley <tsibley@fredhutch.org>
Date: Fri, 6 Jan 2023 15:07:17 -0800
Subject: [PATCH] dev: Add Singularity runtime to our CI integration tests

---
 .../actions/run-integration-tests/action.yaml | 11 ++++++++
 .../setup-integration-tests/action.yaml       | 28 +++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/.github/actions/run-integration-tests/action.yaml b/.github/actions/run-integration-tests/action.yaml
index fcfc2085..c9c6a605 100644
--- a/.github/actions/run-integration-tests/action.yaml
+++ b/.github/actions/run-integration-tests/action.yaml
@@ -23,6 +23,10 @@ runs:
       shell: bash -l -eo pipefail {0}
       run: nextstrain setup conda
 
+    - if: runner.os != 'macOS' && runner.os != 'Windows'
+      shell: bash -l -eo pipefail {0}
+      run: nextstrain setup singularity
+
     - shell: bash -l -eo pipefail {0}
       run: nextstrain check-setup --set-default
 
@@ -43,6 +47,13 @@ runs:
         git -C zika-tutorial clean -dfqx
         nextstrain build --conda --cpus 2 zika-tutorial
 
+    - if: runner.os != 'macOS' && runner.os != 'Windows'
+      name: Build zika-tutorial with --singularity
+      shell: bash -l -eo pipefail {0}
+      run: |
+        git -C zika-tutorial clean -dfqx
+        nextstrain build --singularity --cpus 2 zika-tutorial
+
     - if: runner.os != 'Windows'
       name: Build zika-tutorial with --ambient
       shell: bash -l -eo pipefail {0}
diff --git a/.github/actions/setup-integration-tests/action.yaml b/.github/actions/setup-integration-tests/action.yaml
index fa50ddf7..91032804 100644
--- a/.github/actions/setup-integration-tests/action.yaml
+++ b/.github/actions/setup-integration-tests/action.yaml
@@ -70,6 +70,34 @@ runs:
         python3 --version | grep -F 'Python ${{ inputs.python-version }}.'
         [[ "$(python --version)" == "$(python3 --version)" ]]
 
+    # Install Singularity on Linux.
+    #
+    # We don't install it with Conda because Conda Forge provides a non-suid
+    # build of Singularity.  We're compatible with Singularity's non-suid mode,
+    # but production usages of Singularity are likely to use its suid mode, so
+    # I'd rather test against that.
+    #   -trs, 6 Jan 2023
+    - if: runner.os == 'Linux'
+      shell: bash -l -eo pipefail {0}
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        # Work in a temp dir to avoid cluttering the caller's working dir
+        pushd "$(mktemp -d)"
+        export "$(grep UBUNTU_CODENAME /etc/os-release)"
+
+        # Download latest SingularityCE .deb for this version of Ubuntu
+        url="$(
+          curl -fsSL --proto '=https' -H "Authorization: Bearer $GITHUB_TOKEN" \
+            https://api.github.com/repos/sylabs/singularity/releases/latest \
+              | jq -r '.assets | map(select(.name | endswith("\(env.UBUNTU_CODENAME)_amd64.deb"))) | .[0].browser_download_url')"
+
+        curl -fsSL --proto '=https' "$url" > singularity.deb
+
+        # Install and check that it runs
+        sudo dpkg -i singularity.deb
+        singularity --version
+
     # Clone the small build we'll use as an integration test case.
     - run: git clone https://github.com/nextstrain/zika-tutorial
       shell: bash -l -eo pipefail {0}