main.yml

name: Go
on:
  push:
    branches:
      - main
      - release-v*
      - release/v*
    paths-ignore:
      - "docs/**"
      - "**.md"
      - "scripts/cleanup/**"
      - "CODEOWNERS"
      - "OWNERS"
  pull_request:
    branches:
      - main
      - release-v*
      - release/v*
    paths-ignore:
      - "docs/**"
      - "**.md"
      - "scripts/cleanup/**"
      - "CODEOWNERS"
      - "OWNERS"

env:
  CI_WAIT_FOR_OK_SECONDS: 180
  CI_MAX_ITERATIONS_THRESHOLD: 0 #unlimited
  CI_CLIENT_CONCURRENT_CONNECTIONS: 1
  CI_MAX_WAIT_FOR_POD_TIME_SECONDS: 180
  CI_MIN_SUCCESS_THRESHOLD: 1
  CI_SLEEP_BETWEEN_REQUESTS_SECONDS: 3
  FSM_HUMAN_DEBUG_LOG: ${{ vars.FSM_HUMAN_DEBUG_LOG || 'false' }}
  CLUSTER_INSTALL_TYPE: ${{ vars.CLUSTER_INSTALL_TYPE || 'K3dCluster' }}
  K3D_NODE_LOGS: ${{ vars.K3D_NODE_LOGS || 'false' }}
  FSM_IMAGES_DOWNLOAD_PATH: ${{ vars.FSM_IMAGES_DOWNLOAD_PATH || '/tmp/fsm-images' }}
  FSM_IMAGE_ARTIFACTS_NAME: ${{ vars.FSM_IMAGE_ARTIFACTS_NAME || 'fsm-images' }}
  FSM_DEMO_IMAGES_DOWNLOAD_PATH: ${{ vars.FSM_DEMO_IMAGES_DOWNLOAD_PATH || '/tmp/fsm-demo-images' }}
  FSM_DEMO_IMAGE_ARTIFACTS_NAME: ${{ vars.FSM_DEMO_IMAGE_ARTIFACTS_NAME || 'fsm-demo-images' }}
  FSM_CLI_ARTIFACTS_NAME: ${{ vars.FSM_CLI_ARTIFACTS_NAME || 'fsm-cli' }}
  GOEXPERIMENT: jsonv2

permissions:
  contents: read
  packages: write
  actions: read

concurrency:
  group: ci-main-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  shellcheck:
    name: Shellcheck
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: ShellCheck
        run: shellcheck -x $(find . -name '*.sh')

  lint:
    name: Lint
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: false
      - name: go build deps
        run: make embed-files-test
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: latest
          args: --allow-parallel-runners=true --tests=false --timeout=5m

  codegen:
    name: Codegen
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: false
      - name: go mod tidy
        run: make go-mod-tidy
      - name: Codegen checks
        run: make check-codegen
      - name: Scripts checks
        run: make check-scripts
      - name: Manifests checks
        run: |
          make manifests
          make check-manifests

  mocks:
    name: Mocks
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: false
      - name: go mod tidy
        run: make go-mod-tidy
      - name: gomock checks
        run: make check-mocks

  charts:
    name: Chart checks
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: false
      - name: chart checks
        run: make chart-checks

  build:
    name: Go build
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: false
      - name: Package Helm Charts
        run: make charts-tgz
      - name: Go Build
        run: make build-ci

  unittest:
    name: Go test
    runs-on: ubuntu-24.04
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: false
      - name: go mod tidy
        run: make go-mod-tidy
      - name: Test
        run: make go-test-coverage
      - name: Upload Coverage
        if: ${{ success() }}
        uses: codecov/codecov-action@v5
        with:
          flags: unittests

  fsm-artifacts:
    name: FSM artifacts(images, cli...)
    runs-on: ubuntu-24.04
    needs: build
    env:
      CTR_REGISTRY: ${{ vars.CI_CTR_REGISTRY || 'localhost:5000' }}
      CTR_TAG: ${{ github.sha }}
      DOCKER_BUILDX_OUTPUT: type=docker
      FSM_TAR_PATH: /tmp/fsm-images/${{ github.sha }}
      FSM_DEMO_TAR_PATH: /tmp/fsm-demo-images/${{ github.sha }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Setup Go
        id: setup-go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: false
      - name: Build fsm images
        run: make docker-build-fsm
      - name: Save fsm images
        run: make docker-save-fsm
        env:
          DOCKER_TAR_PATH: ${{ env.FSM_TAR_PATH }}
      - name: Upload fsm images
        uses: actions/upload-artifact@v6
        with:
          name: ${{ env.FSM_IMAGE_ARTIFACTS_NAME }}
          path: ${{ env.FSM_TAR_PATH }}
          retention-days: 1
          overwrite: true
      - name: Build fsm demo images
        run: make docker-build-demo
      - name: Save fsm demo images
        run: make docker-save-demo
        env:
          DOCKER_TAR_PATH: ${{ env.FSM_DEMO_TAR_PATH }}
      - name: Upload fsm demo images
        uses: actions/upload-artifact@v6
        with:
          name: ${{ env.FSM_DEMO_IMAGE_ARTIFACTS_NAME }}
          path: ${{ env.FSM_DEMO_TAR_PATH }}
          retention-days: 1
          overwrite: true
      - name: Build fsm CLI
        run: make build-fsm
      - name: Upload fsm CLI
        uses: actions/upload-artifact@v6
        with:
          name: fsm-cli
          path: ./bin/fsm
          retention-days: 1
          overwrite: true

  image-scan:
    name: Scan images for security vulnerabilities
    runs-on: ubuntu-24.04
    needs: fsm-artifacts
    steps:
      - name: Setup Trivy
        uses: aquasecurity/setup-trivy@v0.2.4
      - name: Download docker image artifacts
        uses: actions/download-artifact@v7
        with:
          name: ${{ env.FSM_IMAGE_ARTIFACTS_NAME }}
          path: ${{ env.FSM_IMAGES_DOWNLOAD_PATH }}
      - name: Scan docker images for vulnerabilities
        run: |
          ls -1 ${{ env.FSM_IMAGES_DOWNLOAD_PATH }}/*.tar | \
          xargs --no-run-if-empty -L 1 \
            trivy image --exit-code 1 \
              --ignore-unfixed \
              --severity HIGH,CRITICAL \
              --dependency-tree \
              --scanners vuln,secret \
              --pkg-types os \
              --input 

  mesh-e2e-test:
    name: Go mesh test
    needs: fsm-artifacts
    strategy:
      matrix:
        k8s_version: [""]
        focus: [""]
        bucket: [1, 2, 3, 4, 5]
        include:
          - k8s_version: v1.21.14-k3s1
            focus: "Test traffic flowing from client to server with a Kubernetes Service for the Source: HTTP"
            bucket: ".*"
          - k8s_version: v1.27.16-k3s1
            focus: "Test traffic flowing from client to server with a Kubernetes Service for the Source: HTTP"
            bucket: ".*"
    uses: ./.github/workflows/e2e.yml
    with:
      k8s_version: ${{ matrix.k8s_version }}
      bucket: ${{ matrix.bucket }}
      focus: ${{ matrix.focus }}
    secrets: inherit

  gateway-e2e-test:
    name: Go gateway test
    needs: fsm-artifacts
    strategy:
      matrix:
        k8s_version: [latest, v1.21.14-k3s1, v1.23.17-k3s1, v1.25.16-k3s4]
        focus: [""]
        bucket: [6, 7]
        exclude:
          - k8s_version: v1.23.17-k3s1
            focus: ""
            bucket: "7"
          - k8s_version: v1.25.16-k3s4
            focus: ""
            bucket: "7"
    uses: ./.github/workflows/e2e.yml
    with:
      k8s_version: ${{ matrix.k8s_version }}
      bucket: ${{ matrix.bucket }}
      focus: ${{ matrix.focus }}
      install_grpcurl: true
      add_hosts: true
    secrets: inherit

  ingress-e2e-test:
    name: Go ingress test
    needs: fsm-artifacts
    strategy:
      matrix:
        k8s_version: [ "" ]
        focus: [ "" ]
        bucket: [ 10 ]
    uses: ./.github/workflows/e2e.yml
    with:
      os: ubuntu-24.04
      k8s_version: ${{ matrix.k8s_version }}
      bucket: ${{ matrix.bucket }}
      focus: ${{ matrix.focus }}
      install_grpcurl: true
      add_hosts: true
    secrets: inherit

  mesh-retry-e2e-test:
    name: Go retry test
    needs: fsm-artifacts
    strategy:
      matrix:
        k8s_version: [""]
        focus: [""]
        bucket: [9]
    uses: ./.github/workflows/e2e.yml
    with:
      os: ubuntu-24.04
      k8s_version: ${{ matrix.k8s_version }}
      bucket: ${{ matrix.bucket }}
      focus: ${{ matrix.focus }}
    secrets: inherit

  mesh-statefulset-e2e-test:
    name: Go statefulset test
    needs: fsm-artifacts
    strategy:
      matrix:
        k8s_version: [""]
        focus: [""]
        bucket: [8]
    uses: ./.github/workflows/e2e.yml
    with:
      os: ubuntu-24.04
      k8s_version: ${{ matrix.k8s_version }}
      bucket: ${{ matrix.bucket }}
      focus: ${{ matrix.focus }}
    secrets: inherit

  integration-tresor:
    name: Integration Test with Tresor, SMI traffic policies, and egress disabled
    runs-on: ubuntu-24.04
    needs: fsm-artifacts
    steps:
      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@main
        if: vars.FREE_DISK_SPACE == 'true'
        with:
          tool-cache: false
          android: true
          dotnet: true
          haskell: true
          large-packages: true
          docker-images: false
          swap-storage: true
      - name: Checkout
        uses: actions/checkout@v6
      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: false
      - name: Install k3d CLI
        run: |
          curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash
          k3d version
      - name: Download fsm image artifacts
        uses: actions/download-artifact@v7
        with:
          name: ${{ env.FSM_IMAGE_ARTIFACTS_NAME }}
          path: ${{ env.FSM_IMAGES_DOWNLOAD_PATH }}
      - name: Load fsm images
        run: |
          ls -1 ${{ env.FSM_IMAGES_DOWNLOAD_PATH }}/*.tar | xargs --no-run-if-empty -L 1 docker load -i
          docker image ls -a
      - name: Download fsm demo image artifacts
        uses: actions/download-artifact@v7
        with:
          name: ${{ env.FSM_DEMO_IMAGE_ARTIFACTS_NAME }}
          path: ${{ env.FSM_DEMO_IMAGES_DOWNLOAD_PATH }}
      - name: Load fsm demo images
        run: |
          ls -1 ${{ env.FSM_DEMO_IMAGES_DOWNLOAD_PATH }}/*.tar | xargs --no-run-if-empty -L 1 docker load -i
          docker image ls -a
      - name: Download fsm CLI
        uses: actions/download-artifact@v7
        with:
          name: ${{ env.FSM_CLI_ARTIFACTS_NAME }}
          path: ./bin
      - name: Grant execute permission to fsm CLI
        run: |
          chmod a+x ./bin/fsm
          ls -l ./bin/fsm
      - name: Run Simulation w/ Tresor, SMI policies, egress disabled and reconciler disabled
        env:
          CERT_MANAGER: "tresor"
          BOOKSTORE_SVC: "bookstore"
          BOOKTHIEF_EXPECTED_RESPONSE_CODE: "0"
          ENABLE_EGRESS: "false"
          ENABLE_RECONCILER: "false"
          PERMISSIVE_MODE: "false"
          DEPLOY_TRAFFIC_SPLIT: "true"
          CTR_REGISTRY: ${{ vars.CI_CTR_REGISTRY || 'localhost:5000' }}
          CTR_TAG: ${{ github.sha }}
          USE_PRIVATE_REGISTRY: "false"
          PUBLISH_IMAGES: "false"
          BUILD_FSM_CLI: "false"
          GODEBUG: "netdns=go+1"
          NUM_K3D_SERVERS: ${{ vars.NUM_K3D_SERVERS || '1' }}
          NUM_K3D_AGENTS: ${{ vars.NUM_K3D_AGENTS || '1' }}
        run: |
          touch .env
          make k3d-up
          docker image list --format "{{.Repository}}:{{.Tag}}" | grep "^localhost" | xargs --no-run-if-empty -L 1 docker push
          ./demo/run-fsm-demo.sh
          go run ./ci/cmd/maestro.go

  images:
    name: Docker Images
    runs-on: ubuntu-24.04
    if: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-')) && github.event_name == 'push' }}
    env:
      DOCKER_USER: ${{ secrets.RELEASE_DOCKER_USER }}
      DOCKER_PASS: ${{ secrets.RELEASE_DOCKER_PASS }}
      CTR_REGISTRY: ${{ secrets.RELEASE_REGISTRY }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Docker Login
        run: docker login --username "$DOCKER_USER" --password-stdin <<< "$DOCKER_PASS"
      - name: Push images with "latest-main" tag
        env:
          CTR_TAG: latest-main
        run: make docker-build-cross