constellation/.github/workflows/e2e-test-weekly.yml

name: e2e test weekly

on:
  workflow_dispatch:
  schedule:
    - cron: "0 3 * * 6" # At 03:00 on Saturday.

env:
  ARM_CLIENT_ID: ${{ secrets.AZURE_E2E_CLIENT_ID }}
  ARM_CLIENT_SECRET: ${{ secrets.AZURE_E2E_CLIENT_SECRET }}
  ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_E2E_SUBSCRIPTION_ID }}
  ARM_TENANT_ID: ${{ secrets.AZURE_E2E_TENANT_ID }}

jobs:
  find-latest-image:
    name: Find latest debug image
    runs-on: ubuntu-22.04
    permissions:
      id-token: write
      contents: read
    outputs:
      image: ${{ steps.find-latest-image.outputs.output }}
    steps:
      - name: Checkout
        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
        with:
          ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}

      - name: Login to AWS
        uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
        with:
          role-to-assume: arn:aws:iam::795746500882:role/GithubConstellationVersionsAPIRead
          aws-region: eu-central-1

      - name: Find latest image
        id: find-latest-image
        uses: ./.github/actions/versionsapi
        with:
          command: latest
          ref: main
          stream: debug

  e2e-weekly:
    strategy:
      fail-fast: false
      max-parallel: 5
      matrix:
        test:
          [
            "sonobuoy full",
            "autoscaling",
            "perf-bench",
            "lb",
            "verify",
            "recover",
            "iamcreate",
          ]
        provider: ["gcp", "azure", "aws"]
        version: ["v1.24", "v1.25", "v1.26"]
        exclude:
          # IAM create test runs only on latest version.
          - test: "iamcreate"
            version: "v1.24"
          - test: "iamcreate"
            version: "v1.25"
          # Verify test runs only on latest version.
          - test: "verify"
            version: "v1.24"
          - test: "verify"
            version: "v1.25"
          # Recover test runs only on latest version.
          - test: "recover"
            version: "v1.24"
          - test: "recover"
            version: "v1.25"
          # Autoscaling test runs only on latest version.
          - test: "autoscaling"
            version: "v1.24"
          - test: "autoscaling"
            version: "v1.25"
          # Perf-Bench test runs only on latest version.
          - test: "perf-bench"
            version: "v1.24"
          - test: "perf-bench"
            version: "v1.25"
          # lb test runs only on latest version.
          - test: "lb"
            version: "v1.24"
          - test: "lb"
            version: "v1.25"
          # Currently not supported on AWS.
          - test: "autoscaling"
            provider: "aws"
          - test: "perf-bench"
            provider: "aws"
    runs-on: ubuntu-22.04
    permissions:
      id-token: write
      checks: write
      contents: read
    needs: [find-latest-image]
    steps:
      - name: Check out repository
        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
        with:
          fetch-depth: 0
          ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}

      - name: Setup Go environment
        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
        with:
          go-version: "1.20.2"

      - name: Login to Azure
        if: matrix.provider == 'azure'
        uses: ./.github/actions/login_azure
        with:
          azure_credentials: ${{ secrets.AZURE_E2E_CREDENTIALS }}

      - name: Create Azure resource group
        id: az_resource_group_gen
        if: matrix.provider == 'azure'
        shell: bash
        run: |
          uuid=$(cat /proc/sys/kernel/random/uuid)
          name=e2e-test-${uuid%%-*}
          az group create --location northeurope --name "$name" --tags e2e
          echo "res_group_name=$name" >> "$GITHUB_OUTPUT"

      - name: Run E2E test
        id: e2e_test
        uses: ./.github/actions/e2e_test
        with:
          workerNodesCount: "2"
          controlNodesCount: "3"
          cloudProvider: ${{ matrix.provider }}
          osImage: ${{ needs.find-latest-image.outputs.image }}
          kubernetesVersion: ${{ matrix.version }}
          awsOpenSearchDomain: ${{ secrets.AWS_OPENSEARCH_DOMAIN }}
          awsOpenSearchUsers: ${{ secrets.AWS_OPENSEARCH_USER }}
          awsOpenSearchPwd: ${{ secrets.AWS_OPENSEARCH_PWD }}
          azureSubscription: ${{ secrets.AZURE_E2E_SUBSCRIPTION_ID }}
          azureTenant: ${{ secrets.AZURE_E2E_TENANT_ID }}
          azureClientID: ${{ secrets.AZURE_E2E_CLIENT_ID }}
          azureClientSecret: ${{ secrets.AZURE_E2E_CLIENT_SECRET }}
          azureUserAssignedIdentity: ${{ secrets.AZURE_E2E_USER_ASSIGNED_IDENTITY }}
          azureResourceGroup: ${{ steps.az_resource_group_gen.outputs.res_group_name }}
          gcpProject: ${{ secrets.GCP_E2E_PROJECT }}
          gcp_service_account: "constellation-e2e@constellation-331613.iam.gserviceaccount.com"
          gcpClusterServiceAccountKey: ${{ secrets.GCP_CLUSTER_SERVICE_ACCOUNT }}
          test: ${{ matrix.test }}
          buildBuddyApiKey: ${{ secrets.BUILDBUDDY_ORG_API_KEY }}

      - name: Always terminate cluster
        if: always()
        continue-on-error: true
        uses: ./.github/actions/constellation_destroy
        with:
          kubeconfig: ${{ steps.e2e_test.outputs.kubeconfig }}

      - name: Always delete IAM configuration
        if: always() && matrix.test == 'iamcreate' && matrix.provider != 'azure' # skip for Azure, as the SP / MI does not have the required permissions
        continue-on-error: true
        uses: ./.github/actions/constellation_iam_destroy

      - name: Notify teams channel
        if: failure() && github.ref == 'refs/heads/main'
        continue-on-error: true
        shell: bash
        working-directory: .github/actions/e2e_test
        run: |
          sudo apt-get install gettext-base -y
          export TEAMS_JOB_NAME=${{ matrix.provider }}
          export TEAMS_RUN_ID=${{ github.run_id }}
          envsubst < teams-payload.json > to-be-send.json
          curl                                          \
            -H "Content-Type: application/json"         \
            -d @to-be-send.json                         \
            "${{ secrets.MS_TEAMS_WEBHOOK_URI }}"

      - name: Always destroy Azure resource group
        if: always() && matrix.provider == 'azure'
        shell: bash
        run: |
          az group delete \
            --name ${{ steps.az_resource_group_gen.outputs.res_group_name }} \
            --force-deletion-types Microsoft.Compute/virtualMachineScaleSets \
            --force-deletion-types Microsoft.Compute/virtualMachines \
            --no-wait \
            --yes