incluster-comp-pr-merged.yaml

name: pr-merged
on:
  # This workflow is designed to be called by other workflows (e.g., pr-merged.yaml).
  # We do not include a direct trigger here because it would be triggered without
  # the required inputs, leading to validation errors.
  workflow_call:
    inputs:
      HELM_BRANCH:
        required: false
        type: string
        default: main
      IMAGE_NAME:
        required: true
        type: string
      IMAGE_TAG:
        required: true
        type: string
      COMPONENT_NAME:
        required: true
        type: string
      GO_VERSION:
        required: true
        type: string
      GO111MODULE:
        required: false
        type: string
      CGO_ENABLED:
        required: false
        type: number
        default: 1
      BUILD_PLATFORM:
        required: false
        type: string
        default: "linux/amd64"
        description: "docker build platforms"
      REQUIRED_TESTS:
        required: true
        type: string
        description: "tests to run"
      COSIGN:
        required: false
        default: false
        type: boolean
        description: "run cosign on released image"
      TRIGGER_HELM_CICD:
        required: false
        default: true
        type: boolean
      HELM_E2E_TEST:
        required: false
        default: false
        type: boolean
      SYSTEM_TESTS_BRANCH:
        required: false
        default: master
        type: string
        description: "system tests branch"
      FORCE:
        required: false
        default: false
        type: boolean

jobs:
  docker-build:
    if: ${{ ((contains(github.event.pull_request.labels.*.name, 'release') || contains( github.event.pull_request.labels.*.name, 'trigger-integration-test')) && github.repository_owner == 'kubescape') || inputs.FORCE }}
    runs-on: ubuntu-large
    outputs:
      IMAGE_TAG_PRERELEASE: ${{ steps.image-prerelease-tag.outputs.IMAGE_TAG_PRERELEASE }}
      TEST_NAMES: ${{ steps.export_tests_to_env.outputs.TEST_NAMES }}
    permissions:
      id-token: write
      packages: write
      contents: read
      pull-requests: read

    steps:
      # - name: Exit if not on master branch
      #   if: github.ref == 'master'
      #   run: exit -1

      - uses: actions/checkout@v4
        name: Checkout
        with:
          fetch-depth: 0
        #   submodules: recursive

      - uses: actions/setup-go@v5
        name: Installing go
        with:
          go-version: "${{ inputs.GO_VERSION }}"

      - name: Ensure ig is installed
        run: curl https://github.com/inspektor-gadget/inspektor-gadget/releases/download/v0.48.1/ig_0.48.1_amd64.deb -LO && sudo dpkg -i ig_0.48.1_amd64.deb

      - name: Build gadgets
        run: make gadgets

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Set prerelease image tag
        id: image-prerelease-tag
        run: echo "IMAGE_TAG_PRERELEASE=${{ inputs.IMAGE_TAG }}-prerelease" >> $GITHUB_OUTPUT

      - name: Run unit test
        id: unit-test
        run: go test -exec sudo -v ./...

      - name: Login to Quay
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
          password: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: build/Dockerfile
          tags: ${{ inputs.IMAGE_NAME }}:${{ steps.image-prerelease-tag.outputs.IMAGE_TAG_PRERELEASE }}
          build-args: image_version=${{ inputs.IMAGE_TAG }}
          platforms: ${{ inputs.BUILD_PLATFORM }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          push: true

      - name: Install cosign
        uses: sigstore/cosign-installer@main
        with:
          cosign-release: "v2.2.2"

      - name: sign kubescape container image
        if: ${{ inputs.COSIGN }}
        env:
          COSIGN_EXPERIMENTAL: "true"
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY_V1 }}
          COSIGN_PRIVATE_KEY_PASSWORD: ${{ secrets.COSIGN_PRIVATE_KEY_V1_PASSWORD }}
          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY_V1 }}
        run: |
          # Sign the image with keyless mode
          cosign sign -y ${{ inputs.IMAGE_NAME }}:${{ steps.image-prerelease-tag.outputs.IMAGE_TAG_PRERELEASE }}

          # Sign the image with key for verifier clients without keyless support
          # Put the key from environment variable to a file
          echo "$COSIGN_PRIVATE_KEY" > cosign.key
          printf "$COSIGN_PRIVATE_KEY_PASSWORD" | cosign sign -key cosign.key -y ${{ inputs.IMAGE_NAME }}:${{ steps.image-prerelease-tag.outputs.IMAGE_TAG_PRERELEASE }}
          rm cosign.key
          # Verify the image
          echo "$COSIGN_PUBLIC_KEY" > cosign.pub
          cosign verify -key cosign.pub ${{ inputs.IMAGE_NAME }}:${{ steps.image-prerelease-tag.outputs.IMAGE_TAG_PRERELEASE }}

      - id: export_tests_to_env
        name: set test name
        run: |
          echo "TEST_NAMES<<EOF" >> $GITHUB_OUTPUT
          echo "$input" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT
        env:
          input: ${{ inputs.REQUIRED_TESTS }}

  run-tests:
    needs: docker-build
    if: ${{ inputs.HELM_E2E_TEST == true }}
    runs-on: ubuntu-latest
    steps:
      - name: Set dispatch info
        id: dispatch-info
        run: |
          # Correlation ID WITHOUT attempt - so re-runs can find the original run
          CORRELATION_ID="${GITHUB_REPOSITORY##*/}-${{ github.run_id }}"
          echo "correlation_id=${CORRELATION_ID}" >> "$GITHUB_OUTPUT"
          echo "Correlation ID: ${CORRELATION_ID}, Attempt: ${{ github.run_attempt }}"

      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.E2E_DISPATCH_APP_ID }}
          private-key: ${{ secrets.E2E_DISPATCH_APP_PRIVATE_KEY }}
          owner: armosec
          repositories: shared-workflows

      - name: Dispatch Helm E2E to private repo
        if: ${{ github.run_attempt == 1 }}
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          CORRELATION_ID: ${{ steps.dispatch-info.outputs.correlation_id }}
        run: |
          echo "Dispatching E2E tests with correlation_id: ${CORRELATION_ID}"
          echo "Using test group: NODE_AGENT_E2E"
          
          gh api "repos/armosec/shared-workflows/dispatches" \
            -f event_type="e2e-test-trigger" \
            -f "client_payload[correlation_id]=${CORRELATION_ID}" \
            -f "client_payload[github_repository]=${GITHUB_REPOSITORY}" \
            -f "client_payload[environment]=production" \
            -f "client_payload[tests_groups]=NODE_AGENT_E2E" \
            -f "client_payload[systests_branch]=${{ inputs.SYSTEM_TESTS_BRANCH }}" \
            -f "client_payload[in_cluster_chart_branch]=${{ inputs.HELM_BRANCH }}" \
            -f "client_payload[ks_branch]=release" \
            -f "client_payload[charts_repo]=kubescape/helm-charts" \
            -f "client_payload[component_image_tags]=${{ inputs.COMPONENT_NAME }}-tag=${{ needs.docker-build.outputs.IMAGE_TAG_PRERELEASE }}"

          echo "Dispatch completed"

      - name: Find E2E workflow run
        id: find-run
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          CORRELATION_ID: ${{ steps.dispatch-info.outputs.correlation_id }}
        run: |
          for i in {1..15}; do
            run_id=$(gh api "repos/armosec/shared-workflows/actions/runs?event=repository_dispatch&per_page=30" \
              --jq '.workflow_runs | map(select(.name | contains("'"$CORRELATION_ID"'"))) | first | .id // empty')
            
            if [ -n "$run_id" ]; then
              echo "run_id=${run_id}" >> "$GITHUB_OUTPUT"
              gh api "repos/armosec/shared-workflows/actions/runs/${run_id}" --jq '"url=" + .html_url' >> "$GITHUB_OUTPUT"
              exit 0
            fi
            echo "Attempt $i: waiting for run..."
            sleep $((i < 5 ? 10 : 30))
          done
          echo "::error::Could not find workflow run"
          exit 1

      - name: Re-run failed jobs in private repo
        id: rerun
        if: ${{ github.run_attempt > 1 }}
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          RUN_ID: ${{ steps.find-run.outputs.run_id }}
        run: |
          conclusion=$(gh api "repos/armosec/shared-workflows/actions/runs/${RUN_ID}" --jq '.conclusion')
          echo "Previous conclusion: $conclusion"
          
          if [ "$conclusion" = "success" ]; then
            echo "Previous run passed. Nothing to re-run."
            echo "skip=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          
          # Full rerun if cancelled, partial if failed
          if [ "$conclusion" = "cancelled" ]; then
            echo "Run was cancelled - triggering full re-run"
            gh api --method POST "repos/armosec/shared-workflows/actions/runs/${RUN_ID}/rerun"
          else
            echo "Re-running failed jobs only"
            gh api --method POST "repos/armosec/shared-workflows/actions/runs/${RUN_ID}/rerun-failed-jobs"
          fi
          
          # Wait for status to flip from 'completed'
          for i in {1..30}; do
            [ "$(gh api "repos/armosec/shared-workflows/actions/runs/${RUN_ID}" --jq '.status')" != "completed" ] && break
            sleep 2
          done

      - name: Wait for E2E tests to complete
        if: ${{ steps.rerun.outputs.skip != 'true' }}
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          RUN_ID: ${{ steps.find-run.outputs.run_id }}
          URL: ${{ steps.find-run.outputs.url }}
        run: |
          echo "Monitoring: ${URL}"
          
          for i in {1..60}; do  # 60 iterations × 60s = 1 hour max
            read status conclusion < <(gh api "repos/armosec/shared-workflows/actions/runs/${RUN_ID}" \
              --jq '[.status, .conclusion // "null"] | @tsv')
            
            echo "Status: ${status} | Conclusion: ${conclusion}"
            
            if [ "$status" = "completed" ]; then
              if [ "$conclusion" = "success" ]; then
                echo "E2E tests passed!"
                exit 0
              fi
              
              echo "::error::E2E tests failed: ${conclusion}"
              echo ""
              
              # Get failed job IDs to a file first
              gh api "repos/armosec/shared-workflows/actions/runs/${RUN_ID}/jobs" \
                --jq '.jobs[] | select(.conclusion == "failure") | [.id, .name, (.steps[] | select(.conclusion == "failure") | .name)] | @tsv' > /tmp/failed_jobs.txt
              
              # Process each failed job
              while IFS=$'\t' read -r job_id job_name step_name; do
                # Extract test name: "run-helm-e2e / ST (relevancy_python)" → "relevancy_python"
                test_name=$(echo "$job_name" | sed 's/.*(\(.*\))/\1/')
                
                echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
                echo "${job_name}"
                echo "   Step: ${step_name}"
                echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
                
                # Fetch logs to temp file
                gh api "repos/armosec/shared-workflows/actions/jobs/${job_id}/logs" 2>/dev/null > /tmp/job_logs.txt
                
                # Show summary in console
                grep -E "(ERROR|FAILURE)" /tmp/job_logs.txt | tail -10
                echo ""
                
                # Save to separate file per test
                log_file="failed_${test_name}.txt"
                echo "════════════════════════════════════════" > "$log_file"
                echo "${job_name}" >> "$log_file"
                echo "   Step: ${step_name}" >> "$log_file"
                echo "════════════════════════════════════════" >> "$log_file"
                last_endgroup=$(grep -n "##\[endgroup\]" /tmp/job_logs.txt | tail -1 | cut -d: -f1)
                if [ -n "$last_endgroup" ]; then
                  tail -n +$((last_endgroup + 1)) /tmp/job_logs.txt >> "$log_file"
                else
                  tail -500 /tmp/job_logs.txt >> "$log_file"
                fi
              done < /tmp/failed_jobs.txt
              
              echo "View full logs: ${URL}"
              exit 1
            fi
            
            sleep 60
          done
          
          echo "::error::Timeout waiting for tests"
          exit 1

      - name: Upload failed step logs
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: failed-e2e-logs-attempt-${{ github.run_attempt }}
          path: failed_*.txt
          retention-days: 7

  benchmark:
    needs: docker-build
    if: ${{ contains(github.event.pull_request.labels.*.name, 'release') }}
    uses: ./.github/workflows/benchmark.yaml
    with:
      after_image: ${{ inputs.IMAGE_NAME }}:${{ needs.docker-build.outputs.IMAGE_TAG_PRERELEASE }}
    secrets: inherit

  create-release-and-retag:
    if: ${{ contains(github.event.pull_request.labels.*.name, 'release') && always() && contains(needs.*.result, 'success') && !(contains(needs.*.result, 'failure')) && !(contains (needs.*.result,'cancelled')) || inputs.FORCE }}
    name: Docker retag and create release
    needs: [run-tests, docker-build]
    outputs:
      upload_url: ${{ steps.create_release.outputs.upload_url }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Quay
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
          password: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}

      - name: Docker retag
        run: |
          curl -L https://github.com/regclient/regclient/releases/download/v0.4.4/regctl-linux-amd64 >regctl
          chmod 755 regctl

          if [ ${{ inputs.COSIGN }} = true ]; then
            ./regctl image copy ${{ inputs.IMAGE_NAME }}:${{ needs.docker-build.outputs.IMAGE_TAG_PRERELEASE }} ${{ inputs.IMAGE_NAME }}:${{ inputs.IMAGE_TAG }} --digest-tags
            ./regctl image copy ${{ inputs.IMAGE_NAME }}:${{ needs.docker-build.outputs.IMAGE_TAG_PRERELEASE }} ${{ inputs.IMAGE_NAME }}:latest --digest-tags
          else
            ./regctl image copy ${{ inputs.IMAGE_NAME }}:${{ needs.docker-build.outputs.IMAGE_TAG_PRERELEASE }} ${{ inputs.IMAGE_NAME }}:${{ inputs.IMAGE_TAG }}
            ./regctl image copy ${{ inputs.IMAGE_NAME }}:${{ needs.docker-build.outputs.IMAGE_TAG_PRERELEASE }} ${{ inputs.IMAGE_NAME }}:latest
          fi

      - name: Create Release
        id: create_release
        uses: ncipollo/release-action@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          tag: ${{ inputs.IMAGE_TAG }}
          name: Release ${{ inputs.IMAGE_TAG }}
          draft: false
          prerelease: false
          body: ${{ github.event.pull_request.body }}

      - name: Trigger helm chart workflow
        if: ${{ inputs.TRIGGER_HELM_CICD == true }}
        uses: benc-uk/workflow-dispatch@v1
        with:
          workflow: 00-cicd.yaml
          repo: kubescape/helm-charts
          ref: ${{ inputs.HELM_BRANCH }}
          token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
          inputs: '{"IMAGE_TAG":"${{ inputs.IMAGE_TAG }}","COMPONENT_NAME":"${{ inputs.COMPONENT_NAME }}","HELM_E2E_TEST":"${{ inputs.HELM_E2E_TEST }}","CHANGE_TAG":"true"}'