ci.yaml

name: CI

concurrency:
  group: ci-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

on:
  push:
    branches:
      - master
      - release/*
    tags:
      - "v*"
  pull_request:
  schedule:
    - cron: "0 10 * * *" # ~2am PST
  workflow_dispatch:
    inputs:
      debug_enabled:
        type: boolean
        description: "Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)"
        required: false
        default: false

jobs:
  test:
    runs-on: lab

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
          cache: true

      - name: Setup Just
        uses: extractions/setup-just@v2

      - name: Lint and generate code
        run: |
          just --timestamp lint-gha gen _lint

      - name: More Go lint
        uses: golangci/golangci-lint-action@v6
        with:
          # keep in sync with hack/tools.just
          version: v1.61.0

      - name: Run tests
        run: |
          just --timestamp test

      # Don't remove it! We shouldn't allow CI to pass if there are any changes not committed after running gen/lint/test
      - name: Fail on dirty
        run: |
          git status --short
          git diff --quiet

      - name: Setup tmate session for debug
        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
        uses: mxschmitt/action-tmate@v3
        timeout-minutes: 30
        with:
          limit-access-to-actor: true

  # faster build installer without airgap using hosted runners and ghcr.io
  build:
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15

    strategy:
      matrix:
        os:
          - ubuntu-latest-x86-4-cores
          - ubuntu-24.04-arm64-4-core
          - macos-latest
        buildmode:
          - "--mode=manual"
          - "--mode=usb"
          - "--mode=iso"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
          cache: true

      - name: Setup Just
        uses: extractions/setup-just@v2

      - name: Setup docker on MacOS
        if: matrix.os == 'macos-latest'
        run: |
          brew install --formula docker

      - name: Setup oras
        uses: oras-project/setup-oras@v1

      - name: Setup local registry
        env:
          LOCALREG_SYNC_REGISTRY: ghcr.io
          LOCALREG_SYNC_USERNAME: ${{ github.actor }}
          LOCALREG_SYNC_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
        run: |
          just --timestamp _localreg &

      - name: Build hhfab for local OS/ARCH
        run: |
          just --timestamp oci_repo=127.0.0.1:30000 oci=http hhfab-build-local _hhfabctl-push-main

      - name: hhfab init and build
        env:
          HHFAB_REG_REPO: 127.0.0.1:30000
        run: |
          bin/hhfab init -v --dev --import-host-upstream
          bin/hhfab versions
          bin/hhfab build -v ${{ matrix.buildmode }}
          ls -lah result

      - name: Dump local registry logs
        if: ${{ always() }}
        run: |
          cat .zot/log

      - name: Setup tmate session for debug
        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
        uses: mxschmitt/action-tmate@v3
        timeout-minutes: 30
        with:
          limit-access-to-actor: true

  build-multi:
    runs-on: lab
    timeout-minutes: 15

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
          cache: true

      - name: Setup Just
        uses: extractions/setup-just@v2

      - name: Build bins for all OS/ARCH
        run: |
          just --timestamp build-multi

      - name: Setup tmate session for debug
        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
        uses: mxschmitt/action-tmate@v3
        timeout-minutes: 30
        with:
          limit-access-to-actor: true

  builds:
    runs-on: ubuntu-latest
    needs:
      - build
      - build-multi
    if: ${{ always() }}

    steps:
      - run: |
          result="${{ needs.build.result }}"
          if [[ $result == "success" || $result == "skipped" ]]; then
            exit 0
          else
            exit 1
          fi

  vlab:
    runs-on: vlab
    needs:
      - test
      - builds
    timeout-minutes: 60

    strategy:
      fail-fast: false
      matrix:
        fabricmode:
          - spine-leaf
        includeonie:
          - false
        buildmode:
          - usb
          - iso
          - manual
        include:
          - fabricmode: collapsed-core
            includeonie: false
            buildmode: iso
          - fabricmode: spine-leaf
            includeonie: true
            buildmode: usb
          - fabricmode: spine-leaf
            includeonie: true
            buildmode: iso

    steps:
      - name: Runner host
        run: |
          echo "$KUBE_NODE"

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
          cache: true

      - name: Setup local registry
        run: |
          just --timestamp _localreg &

      - name: Build hhfab
        run: |
          just --timestamp oci_repo=127.0.0.1:30000 oci=http push

      - name: hhfab init and vlab up
        env:
          HHFAB_REG_REPO: 127.0.0.1:30000
          HHFAB_VLAB_COLLECT: true
        run: |
          bin/hhfab init -v --dev -m ${{ matrix.fabricmode }} --include-onie=${{ matrix.includeonie }}
          bin/hhfab versions
          bin/hhfab vlab gen -v
          bin/hhfab vlab up -v --ready setup-vpcs --ready inspect --ready test-connectivity --ready exit --mode=${{ matrix.buildmode }}

      - name: Dump local registry logs
        if: ${{ always() }}
        run: |
          cat .zot/log

      - name: Collect VM Serial Logs
        if: ${{ always() }}
        run: |
          mkdir -p show-tech-output
          for vm in ./vlab/vms/*; do
            if [ -f "$vm/serial.log" ]; then
              cp "$vm/serial.log" "show-tech-output/$(basename $vm)-serial.log"
            fi
          done

      - name: Upload show-tech artifacts
        uses: actions/upload-artifact@v4
        if: ${{ always() }}
        with:
          name: show-tech-vlab-${{ matrix.fabricmode }}-${{ matrix.includeonie }}-${{ matrix.buildmode }}
          path: show-tech-output

      - name: Setup tmate session for debug
        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
        uses: mxschmitt/action-tmate@v3
        timeout-minutes: 30
        with:
          limit-access-to-actor: true

  vlab-upgrade:
    runs-on: vlab
    needs:
      - test
      - builds
    timeout-minutes: 90

    strategy:
      fail-fast: false
      matrix:
        include:
          - fabricmode: spine-leaf
            fromversion: "beta-1"
            fromflags: "--usb"
          - fabricmode: spine-leaf
            fromversion: "24.09"
            fromflags: "-m=iso"

    steps:
      - name: Runner host
        run: |
          echo "$KUBE_NODE"

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
          cache: true

      - name: Setup local registry
        run: |
          just --timestamp _localreg &

      - name: Initial VLAB with old version
        env:
          HHFAB_REG_REPO: 127.0.0.1:30000
          HHFAB_VLAB_COLLECT: true
        run: |
          mkdir old
          curl -fsSL https://i.hhdev.io/hhfab | USE_SUDO=false INSTALL_DIR=./old VERSION="${{ matrix.fromversion }}" bash

          old/hhfab init -v --dev -m ${{ matrix.fabricmode }} --include-onie=true
          old/hhfab versions
          old/hhfab vlab gen -v
          old/hhfab vlab up -v --ready setup-vpcs --ready test-connectivity --ready exit ${{ matrix.fromflags }}

      - name: Collect VM Serial Logs
        if: ${{ always() }}
        run: |
          mkdir -p show-tech-output
          for vm in ./vlab/vms/*; do
            if [ -f "$vm/serial.log" ]; then
              cp "$vm/serial.log" "show-tech-output/$(basename $vm)-serial.log"
            fi
          done

      - name: Upload show-tech artifacts
        uses: actions/upload-artifact@v4
        if: ${{ always() }}
        with:
          name: show-tech-upgrade-old-${{ matrix.fabricmode }}-${{ matrix.fromversion }}-${{ matrix.fromflags == '--usb' && 'usb' || matrix.fromflags == '-m=iso' && 'iso' }}
          path: old/show-tech-output

      - name: Build current hhfab
        run: |
          just --timestamp oci_repo=127.0.0.1:30000 oci=http push

      - name: hhfab vlab up --upgrade
        env:
          HHFAB_REG_REPO: 127.0.0.1:30000
          HHFAB_VLAB_COLLECT: true
        run: |
          bin/hhfab vlab up -v --ready setup-vpcs --ready inspect --ready test-connectivity --ready exit --upgrade

      - name: Collect VM Serial Logs
        if: ${{ always() }}
        run: |
          mkdir -p show-tech-output
          for vm in ./vlab/vms/*; do
            if [ -f "$vm/serial.log" ]; then
              cp "$vm/serial.log" "show-tech-output/$(basename $vm)-serial.log"
            fi
          done

      - name: Upload show-tech artifacts
        uses: actions/upload-artifact@v4
        if: ${{ always() }}
        with:
          name: show-tech-upgrade-cur-${{ matrix.fabricmode }}-${{ matrix.fromversion }}-${{ matrix.fromflags == '--usb' && 'usb' || matrix.fromflags == '-m=iso' && 'iso' }}
          path: show-tech-output

      - name: Dump local registry logs
        if: ${{ always() }}
        run: |
          cat .zot/log

      - name: Setup tmate session for debug
        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
        uses: mxschmitt/action-tmate@v3
        timeout-minutes: 30
        with:
          limit-access-to-actor: true

  vlabs:
    runs-on: ubuntu-latest
    needs:
      - vlab
      - vlab-upgrade
    if: ${{ always() }}

    steps:
      - run: |
          result="${{ needs.vlab.result }}"
          if [[ $result == "success" || $result == "skipped" ]]; then
            exit 0
          else
            exit 1
          fi

  hlab:
    runs-on: hlab
    timeout-minutes: 60
    needs:
      - test
      - builds

    strategy:
      fail-fast: false
      matrix:
        include:
          - fabricmode: spine-leaf
            includeonie: true
            buildmode: iso

    steps:
      - name: Runner host
        run: |
          echo "$KUBE_NODE"

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Checkout lab-ci repository
        uses: actions/checkout@v4
        with:
          repository: githedgehog/lab-ci
          path: './lab-ci'

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
          cache: true

      - name: Setup local registry
        run: |
          just --timestamp _localreg &

      - name: Build hhfab
        run: |
          just --timestamp oci_repo=127.0.0.1:30000 oci=http push

      - name: hhfab init and vlab up
        env:
          HHFAB_REG_REPO: 127.0.0.1:30000
          HHFAB_VLAB_COLLECT: true
        run: |
          source "./lab-ci/envs/$KUBE_NODE/source.sh"
          bin/hhfab init -v --dev --include-onie=${{ matrix.includeonie }} -w "./lab-ci/envs/$KUBE_NODE/wiring.yaml"
          bin/hhfab versions
          bin/hhfab vlab up -v --ready switch-reinstall --ready inspect --ready setup-vpcs --ready test-connectivity --ready exit --mode=${{ matrix.buildmode }}

      - name: Collect VM Serial Logs
        if: ${{ always() }}
        run: |
          mkdir -p show-tech-output
          for vm in ./vlab/vms/*; do
            if [ -f "$vm/serial.log" ]; then
              cp "$vm/serial.log" "show-tech-output/$(basename $vm)-serial.log"
            fi
          done

      - name: Upload show-tech artifacts
        uses: actions/upload-artifact@v4
        if: ${{ always() }}
        with:
          name: show-tech-hlab-${{ matrix.fabricmode }}-${{ matrix.includeonie }}-${{ matrix.buildmode }}
          path: show-tech-output

      - name: Dump local registry logs
        if: ${{ always() }}
        run: |
          cat .zot/log

      - name: Setup tmate session for debug
        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
        uses: mxschmitt/action-tmate@v3
        timeout-minutes: 60
        with:
          limit-access-to-actor: true

  hlabs:
    runs-on: ubuntu-latest
    needs:
      - hlab
    if: ${{ always() }}

    steps:
      - run: |
          result="${{ needs.hlab.result }}"
          if [[ $result == "success" || $result == "skipped" ]]; then
            exit 0
          else
            exit 1
          fi

  publish-release:
    runs-on: lab
    if: startsWith(github.event.ref, 'refs/tags/v') && github.event_name == 'push'
    needs:
      - build
      - build-multi
      - vlab
      - vlab-upgrade
      - hlab

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
          cache: true

      # - name: Cache dev tools
      #   uses: actions/cache@v3
      #   with:
      #     path: bin
      #     key: bin-${{ hashFiles('hack/tools.mk') }}

      - name: Login to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish Images, Helm charts and Bins on release
        run: |
          just --timestamp oci_repo=ghcr.io push push-multi

      - name: Create GH Release
        uses: softprops/action-gh-release@v2
        with:
          make_latest: true # TODO do it for master only
          files: |
            bin/hhfab-*.tar.gz
            bin/hhfabctl-*.tar.gz

      - name: Setup tmate session for debug
        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
        uses: mxschmitt/action-tmate@v3
        timeout-minutes: 30
        with:
          limit-access-to-actor: true

  publish-master:
    runs-on: lab
    if: github.event.ref == 'refs/heads/master' && github.event_name == 'push'
    needs:
      - build
      - build-multi
      - vlab
      - vlab-upgrade
      - hlab

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
          cache: true

      # - name: Cache dev tools
      #   uses: actions/cache@v3
      #   with:
      #     path: bin
      #     key: bin-${{ hashFiles('hack/tools.mk') }}

      - name: Login to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish Images, Helm charts and Bins for master
        run: |
          just --timestamp oci_repo=ghcr.io version_extra=-master push push-multi

      - name: Setup tmate session for debug
        if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
        uses: mxschmitt/action-tmate@v3
        timeout-minutes: 30
        with:
          limit-access-to-actor: true