test.yaml

name: Test

on:
  workflow_dispatch:
  # Use a manual approval process before PR's are given access to
  # the secrets which are required to run the integration tests.
  # The PR code should be manually approved to see if it can be trusted.
  # When in doubt, do not approve the test run.
  # Reference: https://dev.to/petrsvihlik/using-environment-protection-rules-to-secure-secrets-when-building-external-forks-with-pullrequesttarget-hci
  pull_request_target:
    branches: [ main ]
  merge_group:
jobs:
  approve:
    name: Approve
    environment:
      # For security reasons, all pull requests need to be approved first before granting access to secrets
      # So the environment should be set to have a reviewer/s inspect it before approving it
      name: ${{ github.event_name == 'pull_request_target' && 'Test Pull Request' || 'Test Auto'  }}
    runs-on: ubuntu-latest
    steps:
      - name: Wait for approval
        run: echo "Approved"

  test:
    name: Test ${{ matrix.job.image }}
    needs: [approve]
    permissions:
      pull-requests: write
    environment:
      name: Test Auto
    runs-on: ubuntu-latest
    env:
      TEST_IMAGE: ${{ matrix.job.image }}

    strategy:
      fail-fast: false
      matrix:
        job:
          - { image: debian-systemd-docker-cli, test_options: "--include docker" }
          - { image: debian-systemd-podman-cli, test_options: "--include podman" }

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || '' }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          install: true

      - name: create .env file
        run: |
          touch .env
          echo 'C8Y_BASEURL="${{ secrets.C8Y_BASEURL }}"' >> .env
          echo 'C8Y_USER="${{ secrets.C8Y_USER }}"' >> .env
          echo 'C8Y_PASSWORD="${{ secrets.C8Y_PASSWORD }}"' >> .env
          echo 'PRIVATE_IMAGE="${{ secrets.PRIVATE_IMAGE }}"' >> .env
          echo 'REGISTRY1_REPO="${{ secrets.REGISTRY1_REPO }}"' >> .env
          echo 'REGISTRY1_USERNAME="${{ secrets.REGISTRY1_USERNAME }}"' >> .env
          echo 'REGISTRY1_PASSWORD="${{ secrets.REGISTRY1_PASSWORD }}"' >> .env

      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: 'pip'
          cache-dependency-path: |
            tests/requirements.txt

      - uses: taiki-e/install-action@just

      #
      # Build
      #
      - uses: actions/setup-go@v5
        with:
          go-version: stable
          cache: false
      - name: Install dependencies
        run: |
          go install github.com/goreleaser/nfpm/v2/cmd/nfpm@latest
          go install github.com/goreleaser/goreleaser/v2@latest
      - name: Build package (for testing)
        run: just release-local

      #
      # Test
      #
      - name: Install dependencies
        run: |
          just venv
          just build-test

      - name: Run tests
        run: just test ${{ matrix.job.test_options }}

      - name: Upload test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: reports-${{ matrix.job.image }}
          path: output

      - name: Send report to commit
        if: ${{ always() && github.event_name == 'pull_request_target' }}
        uses: "joonvena/robotframework-reporter-action@v2.5"
        with:
          report_path: output
          gh_access_token: ${{ secrets.GITHUB_TOKEN }}