linkerd2/.github/workflows/workflow.yml

name: CI

on:
  pull_request: {}
  push:
    branches:
    - master
    tags:
    - "*"

# Jobs by event type and dependencies:

# Unit tests for every master/tag push and PR
#
# validate_go_deps
# go_unit_tests
# go_lint
# js_unit_tests

# master/tag push and linkerd org PR: Docker build and integration tests
#
# docker_pull
# docker_build
# kind_setup
#   -> kind_integration_host
#     -> kind_cleanup

# Forked repository PR: Docker build and integration tests
#
# docker_build
#   -> kind_integration_github

# Docker deploy and cloud integration tests for every master/tag push
#
#       -> docker_deploy
#         -> cloud_integration

jobs:

  #
  # Unit tests run for:
  # - every master push
  # - every tag push
  # - every PR
  #

  validate_go_deps:
    name: Validate go deps
    runs-on: ubuntu-18.04
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    # for debugging
    - name: Dump env
      run: |
        env | sort        
    - name: Dump GitHub context
      env:
        GITHUB_CONTEXT: ${{ toJson(github) }}
      run: echo "$GITHUB_CONTEXT"
    - name: Dump job context
      env:
        JOB_CONTEXT: ${{ toJson(job) }}
      run: echo "$JOB_CONTEXT"
    - name: Validate go deps
      run: |
        . bin/_tag.sh
        for f in $( grep -lR --include=Dockerfile\* go-deps: . ) ; do
          validate_go_deps_tag $f
        done        

  go_unit_tests:
    name: Go unit tests
    runs-on: ubuntu-18.04
    container:
      image: golang:1.13.4
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    - name: Go unit tests
      env:
        GITCOOKIE_SH: ${{ secrets.GITCOOKIE_SH }}
      run: |
        echo "$GITCOOKIE_SH" | bash
        # TODO: validate bin/protoc-go.sh does not dirty the repo
        go test -cover -race -v -mod=readonly ./...        

  go_lint:
    name: Go lint
    runs-on: ubuntu-18.04
    container:
      image: golang:1.13.4
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    - name: Go lint
      env:
        GITCOOKIE_SH: ${{ secrets.GITCOOKIE_SH }}
        # prevent OOM
        GOGC: 20
      run: |
        echo "$GITCOOKIE_SH" | bash
        bin/lint --verbose        

  go_fmt:
    name: Go Format
    runs-on: ubuntu-18.04
    container:
      image: golang:1.13.4
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    - name: Format
      env:
        GITCOOKIE_SH: ${{ secrets.GITCOOKIE_SH }}
      run: |
        echo "$GITCOOKIE_SH" | bash
        bin/fmt        

  js_unit_tests:
    name: JS unit tests
    runs-on: ubuntu-18.04
    container:
      image: node:10.16.0-stretch
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    - name: Yarn setup
      run: |
        curl -o- -L https://yarnpkg.com/install.sh | bash -s -- --version 1.21.1 --network-concurrency 1        
    - name: JS unit tests
      run: |
        export PATH="$HOME/.yarn/bin:$PATH"
        export NODE_ENV=test
        bin/web
        bin/web test --reporters=jest-dot-reporter        

  #
  # Docker build and kind integration tests run for:
  # - every master push
  # - every tag push
  # - every PR
  #

  docker_pull:
    name: Docker pull
    if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork
    runs-on: ubuntu-18.04
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    - name: Docker SSH setup
      run: |
        mkdir -p ~/.ssh/
        touch ~/.ssh/id && chmod 600 ~/.ssh/id
        echo "${{ secrets.DOCKER_SSH_CONFIG }}"  > ~/.ssh/config
        echo "${{ secrets.DOCKER_PRIVATE_KEY }}" > ~/.ssh/id
        echo "${{ secrets.DOCKER_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
        ssh linkerd-docker docker version        
    - name: Docker pull
      env:
        DOCKER_HOST: ssh://linkerd-docker
      run: |
        bin/docker pull gcr.io/linkerd-io/proxy-init:v1.3.1
        bin/docker pull prom/prometheus:v2.11.1        

  docker_build:
    name: Docker build
    runs-on: ubuntu-18.04
    env:
      IMAGE_ARCHIVES_DIR: /home/runner/archives
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    - name: Docker SSH setup
      if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork
      run: |
        mkdir -p ~/.ssh/
        touch ~/.ssh/id && chmod 600 ~/.ssh/id
        echo "${{ secrets.DOCKER_SSH_CONFIG }}"  > ~/.ssh/config
        echo "${{ secrets.DOCKER_PRIVATE_KEY }}" > ~/.ssh/id
        echo "${{ secrets.DOCKER_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
        ssh linkerd-docker docker version
        echo ::set-env name=DOCKER_HOST::ssh://linkerd-docker        
    - name: Build docker images
      run: |
        export PATH="`pwd`/bin:$PATH"
        DOCKER_TRACE=1 bin/docker-build        
    - name: Create artifact with CLI and image archives
      if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork
      run: |
        mkdir -p $IMAGE_ARCHIVES_DIR
        cp target/cli/linux/linkerd $IMAGE_ARCHIVES_DIR/
        TAG="$(CI_FORCE_CLEAN=1 bin/root-tag)"
        for img in controller grafana proxy web ; do
          docker save "gcr.io/linkerd-io/$img:$TAG" > $IMAGE_ARCHIVES_DIR/$img.tar
        done        
    # `with.path` values do not support environment variables yet, so an
    # absolute path is used here.
    #
    # https://github.com/actions/upload-artifact/issues/8
    - name: Upload artifact
      if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork
      uses: actions/upload-artifact@v1
      with:
        name: image-archives
        path: /home/runner/archives

  kind_setup:
    strategy:
      max-parallel: 3
      matrix:
        integration_test: [deep, upgrade, helm, helm_upgrade, custom_domain, external_issuer]
    name: Cluster setup (${{ matrix.integration_test }})
    if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork
    runs-on: ubuntu-18.04
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    - name: Docker SSH setup
      run: |
        mkdir -p ~/.ssh/
        touch ~/.ssh/id && chmod 600 ~/.ssh/id
        echo "${{ secrets.DOCKER_SSH_CONFIG }}"  > ~/.ssh/config
        echo "${{ secrets.DOCKER_PRIVATE_KEY }}" > ~/.ssh/id
        echo "${{ secrets.DOCKER_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
        ssh linkerd-docker docker version        
    - name: Kind cluster setup
      env:
        DOCKER_HOST: ssh://linkerd-docker
      run: |
        TAG="$(CI_FORCE_CLEAN=1 bin/root-tag)"
        export KIND_CLUSTER=github-$TAG-${{ matrix.integration_test }}
        export KUBECONFIG=/tmp/kind-config-$KIND_CLUSTER
        export CUSTOM_DOMAIN_CONFIG="test/testdata/custom_cluster_domain_config.yaml"
        # retry cluster creation once in case of port conflict or kubeadm failure
        if [ "${{ matrix.integration_test }}" == "custom_domain" ]
        then
          bin/kind create cluster --name=$KIND_CLUSTER --wait=2m --verbosity 3 --config=$CUSTOM_DOMAIN_CONFIG ||
            bin/kind create cluster --name=$KIND_CLUSTER --wait=2m --verbosity 3 --config=$CUSTOM_DOMAIN_CONFIG
        else
          bin/kind create cluster --name=$KIND_CLUSTER --wait=2m --verbosity 3 ||
            bin/kind create cluster --name=$KIND_CLUSTER --wait=2m --verbosity 3
        fi        

  #
  # Integration tests that run on the docker host are limited by the fact that
  # while they all run in separate KinD clusters, they are on the same
  # machine. The `strategy` context cannot be conditionally set, so there are
  # separate `kind_integration_*` jobs. This allows the `kind_integration_github`
  # job to run it's entire matrix in parallel.
  #

  kind_integration_host:
    strategy:
      max-parallel: 3
      matrix:
        integration_test: [deep, upgrade, helm, helm_upgrade, custom_domain, external_issuer]
    needs: [docker_pull, docker_build, kind_setup]
    name: Host int. tests (${{ matrix.integration_test }})
    if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork
    runs-on: ubuntu-18.04
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    - name: Docker SSH setup
      run: |
        mkdir -p ~/.ssh/
        touch ~/.ssh/id && chmod 600 ~/.ssh/id
        echo "${{ secrets.DOCKER_SSH_CONFIG }}"  > ~/.ssh/config
        echo "${{ secrets.DOCKER_PRIVATE_KEY }}" > ~/.ssh/id
        echo "${{ secrets.DOCKER_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
        ssh linkerd-docker docker version        
    - name: Try to load cached Go modules
      uses: actions/cache@v1
      with:
        path: ~/go/pkg/mod
        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
        restore-keys: |
          ${{ runner.os }}-go-          
    - name: Kind load docker images
      run: |
        TAG="$(CI_FORCE_CLEAN=1 bin/root-tag)"
        export KIND_CLUSTER=github-$TAG-${{ matrix.integration_test }}
        ssh -T linkerd-docker > /dev/null << EOF
          # TODO: This is using the kind binary on the remote host.
          # TODO: 'kind' still points to v0.5.1. When there are no more old CI branches depending on that
          # we can replace it with v0.6.1. In the meantime we explicitly use 'kind-0.6.1'
          kind-0.6.1 load docker-image gcr.io/linkerd-io/proxy-init:v1.3.1 --name=$KIND_CLUSTER
          kind-0.6.1 load docker-image prom/prometheus:v2.11.1 --name=$KIND_CLUSTER
          for IMG in controller grafana proxy web ; do
            kind-0.6.1 load docker-image gcr.io/linkerd-io/\$IMG:$TAG --name=$KIND_CLUSTER
          done
        EOF        
    - name: Install linkerd CLI
      env:
        DOCKER_HOST: ssh://linkerd-docker
      run: |
        TAG="$(CI_FORCE_CLEAN=1 bin/root-tag)"
        image="gcr.io/linkerd-io/cli-bin:$TAG"
        id=$(bin/docker create $image)
        bin/docker cp "$id:/out/linkerd-linux" "$HOME/.linkerd"
        $HOME/.linkerd version --client
        # validate CLI version matches the repo
        [[ "$TAG" == "$($HOME/.linkerd version --short --client)" ]]
        echo "Installed Linkerd CLI version: $TAG"        
    - name: Run integration tests
      env:
        DOCKER_HOST: ssh://linkerd-docker
        GITCOOKIE_SH: ${{ secrets.GITCOOKIE_SH }}
      run: |
        export PATH="`pwd`/bin:$PATH"
        echo "$GITCOOKIE_SH" | bash
        # TODO: pin Go version
        go version
        TAG="$(CI_FORCE_CLEAN=1 bin/root-tag)"
        export KIND_CLUSTER=github-$TAG-${{ matrix.integration_test }}
        # Restore kubeconfig from remote docker host.
        mkdir -p $HOME/.kube
        export KUBECONFIG=$HOME/.kube/kind-config-$KIND_CLUSTER
        bin/kind export kubeconfig --name=$KIND_CLUSTER --kubeconfig $KUBECONFIG
        # Start ssh tunnel to allow kubectl to connect via localhost.
        export KIND_PORT=$(bin/kubectl config view -o jsonpath="{.clusters[?(@.name=='kind-$KIND_CLUSTER')].cluster.server}" | cut -d':' -f3)
        echo "KIND_PORT: $KIND_PORT"
        ssh -4 -N -L $KIND_PORT:localhost:$KIND_PORT linkerd-docker &
        sleep 2 # Wait for ssh tunnel to come up.
        bin/kubectl version --short # Test connection to kind cluster.
        (
          . bin/_test-run.sh
          init_test_run $HOME/.linkerd
          ${{ matrix.integration_test }}_integration_tests
        )        

  kind_integration_github:
    strategy:
      matrix:
        integration_test: [deep, upgrade, helm, helm_upgrade, custom_domain, external_issuer]
    needs: [docker_build]
    name: GitHub int. tests (${{ matrix.integration_test }})
    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork
    runs-on: ubuntu-18.04
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    - name: Download image archives
      uses: actions/download-artifact@v1
      with:
        name: image-archives
    - name: Try to load cached Go modules
      uses: actions/cache@v1
      with:
        path: ~/go/pkg/mod
        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
        restore-keys: |
          ${{ runner.os }}-go-          
    - name: Setup KinD (default)
      if: matrix.integration_test != 'custom_domain'
      uses: engineerd/setup-kind@v0.3.0
      with:
        version: "v0.6.1"
    - name: Setup KinD (custom_domain)
      if: matrix.integration_test == 'custom_domain'
      uses: engineerd/setup-kind@v0.3.0
      with:
        config: test/testdata/custom_cluster_domain_config.yaml
        version: "v0.6.1"
    - name: Load image archives into KinD
      run: |
        for img in controller grafana proxy web; do
          kind load image-archive image-archives/$img.tar
        done        
    - name: Install linkerd CLI
      run: |
        cp image-archives/linkerd $HOME/.linkerd
        chmod +x $HOME/.linkerd        
    - name: Run integration tests
      run: |
        . bin/_test-run.sh
        init_test_run $HOME/.linkerd
        ${{ matrix.integration_test }}_integration_tests        

  kind_cleanup:
    strategy:
      fail-fast: false # always attempt to cleanup all clusters
      matrix:
        integration_test: [deep, upgrade, helm, helm_upgrade, custom_domain, external_issuer]
    needs: [kind_integration_host]
    name: Cluster cleanup (${{ matrix.integration_test }})
    if: always() && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork)
    runs-on: ubuntu-18.04
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    # for debugging
    - name: Dump env
      run: |
        env | sort        
    - name: Dump GitHub context
      env:
        GITHUB_CONTEXT: ${{ toJson(github) }}
      run: echo "$GITHUB_CONTEXT"
    - name: Dump job context
      env:
        JOB_CONTEXT: ${{ toJson(job) }}
      run: echo "$JOB_CONTEXT"
    - name: Docker SSH setup
      run: |
        mkdir -p ~/.ssh/
        touch ~/.ssh/id && chmod 600 ~/.ssh/id
        echo "${{ secrets.DOCKER_SSH_CONFIG }}"  > ~/.ssh/config
        echo "${{ secrets.DOCKER_PRIVATE_KEY }}" > ~/.ssh/id
        echo "${{ secrets.DOCKER_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
        ssh linkerd-docker docker version        
    - name: Kind cluster cleanup
      env:
        DOCKER_HOST: ssh://linkerd-docker
      run: |
        TAG="$(CI_FORCE_CLEAN=1 bin/root-tag)"
        export KIND_CLUSTER=github-$TAG-${{ matrix.integration_test }}
        bin/kind delete cluster --name=$KIND_CLUSTER        

  #
  # Docker deploy and cloud integration tests run for:
  # - every master push
  # - every tag push
  #

  docker_deploy:
    name: Docker deploy
    if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags')
    runs-on: ubuntu-18.04
    needs: [validate_go_deps, go_unit_tests, go_lint, js_unit_tests, kind_integration_host, kind_cleanup]
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    - name: Configure gcloud
      uses: linkerd/linkerd2-action-gcloud@v1.0.0
      with:
        cloud_sdk_service_account_key: ${{ secrets.CLOUD_SDK_SERVICE_ACCOUNT_KEY }}
        gcp_project: ${{ secrets.GCP_PROJECT }}
        gcp_zone: ${{ secrets.GCP_ZONE }}
    - name: Docker SSH setup
      run: |
        mkdir -p ~/.ssh/
        touch ~/.ssh/id && chmod 600 ~/.ssh/id
        echo "${{ secrets.DOCKER_SSH_CONFIG }}"  > ~/.ssh/config
        echo "${{ secrets.DOCKER_PRIVATE_KEY }}" > ~/.ssh/id
        echo "${{ secrets.DOCKER_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
        ssh linkerd-docker docker version        
    - name: Docker push
      env:
        DOCKER_HOST: ssh://linkerd-docker
      run: |
        export PATH="`pwd`/bin:$PATH"
        TAG="$(CI_FORCE_CLEAN=1 bin/root-tag)"
        bin/docker-push-deps
        bin/docker-push $TAG
        bin/docker-retag-all $TAG master
        bin/docker-push master        

  cloud_integration:
    name: Cloud integration tests
    if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags')
    runs-on: ubuntu-18.04
    needs: [docker_deploy]
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    - name: Install linkerd CLI
      id: install_cli
      run: |
        TAG="$(CI_FORCE_CLEAN=1 bin/root-tag)"
        image="gcr.io/linkerd-io/cli-bin:$TAG"
        id=$(bin/docker create $image)
        bin/docker cp "$id:/out/linkerd-linux" "$HOME/.linkerd"
        $HOME/.linkerd version --client
        # validate CLI version matches the repo
        [[ "$TAG" == "$($HOME/.linkerd version --short --client)" ]]
        echo "Installed Linkerd CLI version: $TAG"
        echo "::set-output name=tag::$TAG"        
    - name: Create GKE cluster
      uses: linkerd/linkerd2-action-gcloud@v1.0.0
      with:
        cloud_sdk_service_account_key: ${{ secrets.CLOUD_SDK_SERVICE_ACCOUNT_KEY }}
        gcp_project: ${{ secrets.GCP_PROJECT }}
        gcp_zone: ${{ secrets.GCP_ZONE }}
        create: true
        name: testing-${{ steps.install_cli.outputs.tag }}-${{ github.run_id }}
    - name: Run integration tests
      env:
        GITCOOKIE_SH: ${{ secrets.GITCOOKIE_SH }}
      run: |
        export PATH="`pwd`/bin:$PATH"
        echo "$GITCOOKIE_SH" | bash
        version="$($HOME/.linkerd version --client --short | tr -cd '[:alnum:]-')"
        bin/test-run $HOME/.linkerd linkerd-$version        
    - name: CNI tests
      run: |
        export TAG="$($HOME/.linkerd version --client --short)"
        go test -cover -race -v -mod=readonly ./cni-plugin/test -integration-tests        

  # Helm chart artifact deploy run for:
  # - every tag push
  #

  chart_deploy:
    name: Helm chart deploy
    if: startsWith(github.ref, 'refs/tags')
    runs-on: ubuntu-18.04
    needs: [cloud_integration]
    steps:
    - name: Checkout code
      uses: actions/checkout@v2
    - name: Configure gsutils
      uses: linkerd/linkerd2-action-gcloud@v1.0.0
      with:
        cloud_sdk_service_account_key: ${{ secrets.CLOUD_SDK_SERVICE_ACCOUNT_KEY }}
        gcp_project: ${{ secrets.GCP_PROJECT }}
        gcp_zone: ${{ secrets.GCP_ZONE }}
    - name: Edge Helm chart creation and upload
      if: startsWith(github.ref, 'refs/tags/edge')
      run: |
        mkdir -p target/helm
        gsutil cp gs://helm.linkerd.io/edge/index.yaml target/helm/index-pre.yaml
        bin/helm-build package
        gsutil rsync target/helm gs://helm.linkerd.io/edge        
    - name: Stable Helm chart creation and upload
      if: startsWith(github.ref, 'refs/tags/stable')
      run: |
        mkdir -p target/helm
        gsutil cp gs://helm.linkerd.io/stable/index.yaml target/helm/index-pre.yaml
        bin/helm-build package
        gsutil rsync target/helm gs://helm.linkerd.io/stable