test-e2e.yml

name: E2E Tests

on:
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
    branches: [ main ]


  merge_group:
    types: [checks_requested]

  push:
    branches: [ main ]

permissions:
  id-token: write

jobs:
  test-e2e:
    name: Run on Ubuntu
    runs-on: ubuntu-latest
    # Skip e2e tests for untrusted fork PRs (no access to the action's JWT token)
    # Allow e2e tests if PR author owns the fork AND is an OWNER/MEMBER/COLLABORATOR
    if: |
      github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository ||
      (
        github.event.pull_request.user.login == github.event.pull_request.head.repo.owner.login &&
        contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association)
      )
    env:
      AWS_ROLE_ARN: arn:aws:iam::418272753558:role/multi-platform-github-action
      AWS_REGION: us-east-1
      AWS_ROLE_DURATION: 3600 # 1 hour
      INSTANCE_TAG: ${{ github.run_id }}-development
      S3_LOGS_BUCKET: otelcol-logs
      KIND_EXPERIMENTAL_PROVIDER: podman
      E2E_DEBUG_LOG_DIR: ${{ github.workspace }}/e2e-debug-logs
    steps:
      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
        with:
          # this might remove tools that are actually needed,
          # if set to "true" but frees about 6 GB
          tool-cache: false

          docker-images: false

      - name: Clone the code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
        with:
          role-to-assume: ${{ env.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}
          role-duration-seconds: ${{ env.AWS_ROLE_DURATION }}

      - name: Validate AWS Credentials
        run: |
          aws sts get-caller-identity

      - name: Setup Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: go.mod

      - name: Install the latest version of kind
        run: |
          curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-amd64
          chmod +x ./kind
          sudo mv ./kind /usr/local/bin/kind

      - name: Verify kind installation
        run: kind version

      - name: Create kind cluster
        run: kind create cluster

      - name: Build and load images
        env:
          ENABLE_COVERAGE: "true"
        run: |
          go mod tidy
          make load-image
          podman exec kind-control-plane crictl images

      - name: Install dependencies
        run: |
          make tekton
          make cert-manager

      - name: Deploy MPC
        run: |
          make deploy

      - name: Run Test e2e
        run: |
          make test-e2e

      - name: Collect e2e coverage
        if: always()
        run: |
          mkdir -p coverage-output && chmod 777 coverage-output
          cp $HOME/.kube/config /tmp/kubeconfig && chmod 644 /tmp/kubeconfig
          podman run --rm \
            --network host \
            -v /tmp/kubeconfig:/kubeconfig:ro \
            -v $PWD/coverage-output:/workspace/coverage-output \
            -e KUBECONFIG=/kubeconfig \
            quay.io/konflux-ci/konflux-devprod/coverport-cli \
            collect \
              --namespace=multi-platform-controller \
              --label-selector="app in (multi-platform-controller,multi-platform-otp-server)" \
              --test-name=e2e-tests \
              --output=/workspace/coverage-output || true

      - name: Upload e2e coverage to Codecov
        if: always()
        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
        with:
          use_oidc: true
          flags: e2e-tests
          directory: coverage-output
          fail_ci_if_error: false

      - name: Upload E2E Debug Logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: e2e-debug-logs
          path: ${{ env.E2E_DEBUG_LOG_DIR }}
          if-no-files-found: ignore
          retention-days: 14

      # Reconfigure AWS credentials for cleanup to ensure they're available even if
      # The credentials expired (1-hour duration) during long-running tests

      - name: Configure AWS Credentials for Cleanup
        if: always()
        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
        with:
          role-to-assume: ${{ env.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}
          role-duration-seconds: ${{ env.AWS_ROLE_DURATION }}

      - name: Delete AWS EC2 Instances
        if: always()
        run: ./out/devsetup cleanup-instances ${{ env.INSTANCE_TAG }}

      - name: Delete AWS S3 Logs
        if: always()
        run: ./out/devsetup cleanup-s3-logs ${{ github.run_id }}

      - name: Delete AWS EC2 Key Pair
        if: always()
        run: ./out/devsetup cleanup-keypair ${{ github.run_id }}