github.com/nginxinc/kubernetes-ingress@v1.12.5/.github/workflows/edge.yml

name: Edge

on:
  push:
    branches:
      - master
    paths-ignore:
      - 'docs/**'
      - 'docs-web/**'
      - 'examples/**'
      - 'examples-of-custom-resources/**'
      - '**.md'
  pull_request:
    branches:
      - master
      - release-1.12
    paths-ignore:
      - 'docs/**'
      - 'docs-web/**'
      - 'examples/**'
      - 'examples-of-custom-resources/**'
      - '**.md'
    types:
      - opened
      - reopened
      - synchronize

defaults:
  run:
    shell: bash

env:
  DOCKER_BUILDKIT: 1
  K8S_VERSION: 1.20.15
  K8S_TIMEOUT: 75s
  HELM_CHART_DIR: deployments/helm-chart
  HELM_CHART_VERSION: 0.0.0-edge
  GIT_NAME: NGINX Kubernetes Team
  GIT_MAIL: kubernetes@nginx.com

jobs:

  binary:
    name: Build Binary
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Output Variables
        id: commit
        run: |
          echo "::set-output name=sha::$(echo ${GITHUB_SHA} | cut -c1-7)"
      - name: Setup Golang Environment
        uses: actions/setup-go@v3
        with:
          go-version-file: go.mod
          cache: true
      - name: Determine GOPATH
        run: echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
      - name: Check if CRDs changed
        run: |
          make update-crds && git diff --name-only --exit-code deployments/common/crds* deployments/helm-chart/crds*
      - name: Check if Codegen changed
        run: |
          make update-codegen && git diff --name-only --exit-code pkg/**/zz_generated.deepcopy.go
      - name: Build binaries
        uses: goreleaser/goreleaser-action@v2
        with:
          version: latest
          args: build --snapshot --rm-dist --single-target
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GOPATH: ${{ env.GOPATH }}
      - name: Store Artifacts in Cache
        uses: actions/cache@v2
        with:
          path: ${{ github.workspace }}/dist
          key: nginx-ingress-${{ github.run_id }}-${{ github.run_number }}

  unit-tests:
    name: Unit Tests
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3
      - name: Setup Golang Environment
        uses: actions/setup-go@v3
        with:
          go-version-file: go.mod
          cache: true
      - name: Run Tests
        run: go test ./...

  container-scan:
    name: Container Scanning
    runs-on: ubuntu-20.04
    needs: binary
    strategy:
      fail-fast: false
      matrix:
        image: [debian, alpine, opentracing, ubi]
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3
      - name: Output Variables
        id: commit
        run: |
          echo "::set-output name=nginx_version::$(cat build/Dockerfile | grep -m1 "FROM nginx:" | cut -d":" -f2 | cut -d" " -f1)"
      - name: Fetch Cached Artifacts
        uses: actions/cache@v2
        with:
          path: ${{ github.workspace }}/dist
          key: nginx-ingress-${{ github.run_id }}-${{ github.run_number }}
      - name: Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Build ${{ matrix.image }} Container
        uses: docker/build-push-action@v3
        with:
          file: build/Dockerfile
          context: '.'
          cache-from: type=gha,scope=${{ matrix.image }}
          cache-to: type=gha,scope=${{ matrix.image }},mode=max
          target: goreleaser
          tags: ${{ matrix.image }}:${{ github.sha }}
          load: true
          build-args: |
            BUILD_OS=${{ matrix.image }}
            NGINX_VERSION=${{ steps.commit.outputs.nginx_version }}
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.7.1
        continue-on-error: true
        with:
          image-ref: '${{ matrix.image }}:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results-${{ matrix.image }}.sarif'
          ignore-unfixed: 'true'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        continue-on-error: true
        with:
          sarif_file: 'trivy-results-${{ matrix.image }}.sarif'
      - name: Upload Scan Results
        uses: actions/upload-artifact@v3
        continue-on-error: true
        with:
          name: 'trivy-results-${{ matrix.image }}.sarif'
          path: 'trivy-results-${{ matrix.image }}.sarif'
        if: always()

  smoke-tests:
    name: Smoke Tests
    runs-on: ubuntu-20.04
    needs: [binary, unit-tests]
    strategy:
      fail-fast: false
      matrix:
        include:
          - image: debian
            marker: 'ingresses'
          - image: alpine
            marker: 'vsr'
          - image: opentracing
            marker: 'vs'
          - image: ubi
            marker: 'ts'
          - image: debian
            marker: 'policies'
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3
      - name: Output Variables
        id: commit
        run: |
          echo "::set-output name=nginx_version::$(cat build/Dockerfile | grep -m1 "FROM nginx:" | cut -d":" -f2 | cut -d" " -f1)"
      - name: Fetch Cached Artifacts
        uses: actions/cache@v2
        with:
          path: ${{ github.workspace }}/dist
          key: nginx-ingress-${{ github.run_id }}-${{ github.run_number }}
      - name: Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Build ${{ matrix.image }} Container
        uses: docker/build-push-action@v3
        with:
          file: build/Dockerfile
          context: '.'
          cache-from: type=gha,scope=${{ matrix.image }}
          cache-to: type=gha,scope=${{ matrix.image }},mode=max
          target: goreleaser
          tags: ${{ matrix.image }}:${{ github.sha }}
          load: true
          build-args: |
            BUILD_OS=${{ matrix.image }}
            NGINX_VERSION=${{ steps.commit.outputs.nginx_version }}
      - name: Build Test-Runner Container
        uses: docker/build-push-action@v3
        with:
          file: tests/docker/Dockerfile
          context: '.'
          cache-from: type=gha,scope=test-runner
          cache-to: type=gha,scope=test-runner,mode=max
          tags: test-runner:${{ github.sha }}
          load: true
      - name: Deploy Kubernetes
        id: k8s
        run: |
          kind create cluster --name ${{ github.run_id }} --image=kindest/node:v${{ env.K8S_VERSION }} --config ${{ github.workspace }}/tests/ci-files/ci-kind-config.yaml --kubeconfig kube-${{ github.run_id }} --wait ${{ env.K8S_TIMEOUT }}
          kind load docker-image ${{ matrix.image }}:${{ github.sha }} --name ${{ github.run_id }}
          echo ::set-output name=cluster_ip::$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' ${{ github.run_id }}-control-plane)
          echo ::set-output name=cluster::$(echo 'nginx-${{ matrix.image }}-${{ matrix.marker }}')
      - name: Setup Kubeconfig
        run: |
          sed -i 's|server:.*|server: https://${{ steps.k8s.outputs.cluster_ip }}:6443|' kube-${{ github.run_id }}
      - name: Run Smoke Tests
        run: |
          touch tests-${{ steps.k8s.outputs.cluster }}.html
          docker run --rm \
          --name test-runner-${{ github.run_id }} \
          --network=kind \
          -v ${{ github.workspace }}/tests/tests-${{ steps.k8s.outputs.cluster }}.html:/workspace/tests/tests-${{ steps.k8s.outputs.cluster }}.html \
          -v ${{ github.workspace }}/kube-${{ github.run_id }}:/root/.kube/config test-runner:${{ github.sha }} \
          --context=kind-${{ github.run_id }} \
          --image=${{ matrix.image }}:${{ github.sha }} \
          --image-pull-policy=Never \
          --ic-type=nginx-ingress \
          --service=nodeport --node-ip=${{ steps.k8s.outputs.cluster_ip }} \
          --html=tests-${{ steps.k8s.outputs.cluster }}.html \
          --self-contained-html \
          --show-ic-logs=yes --profile \
          -m ${{ matrix.marker }}
        working-directory: ./tests
      - name: Upload Test Results
        uses: actions/upload-artifact@v3
        with:
          name: test-results-${{ steps.k8s.outputs.cluster }}
          path: ${{ github.workspace }}/tests/tests-${{ steps.k8s.outputs.cluster }}.html
        if: always()

  helm-tests:
    name: Helm Tests
    runs-on: ubuntu-20.04
    needs: [binary, unit-tests]
    env:
      NGINX_HTTP_PORT: 8080
      NGINX_HTTPS_PORT: 8443
      HELM_TEST_RETRIES: 5
      HELM_HTTP_POSTFIX: s
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3
      - name: Fetch Cached Artifacts
        uses: actions/cache@v2
        with:
          path: ${{ github.workspace }}/dist
          key: nginx-ingress-${{ github.run_id }}-${{ github.run_number }}
      - name: Docker Buildx
        uses: docker/setup-buildx-action@v2
        with:
          driver-opts: network=host
      - name: Build Docker Image nginx-ingress
        uses: docker/build-push-action@v3
        with:
          file: build/Dockerfile
          context: '.'
          cache-from: type=gha,scope=debian
          cache-to: type=gha,scope=debian,mode=max
          target: goreleaser
          tags: nginx-ingress:${{ github.sha }}
          load: true
          build-args: |
            BUILD_OS=debian
      - name: Deploy Kubernetes
        id: k8s
        run: |
          kind create cluster --name ${{ github.run_id }} --image=kindest/node:v${{ env.K8S_VERSION }} --wait ${{ env.K8S_TIMEOUT }}
          kind load docker-image nginx-ingress:${{ github.sha }} --name ${{ github.run_id }}
      - name: Install Chart
        run: >
          helm install
          oss
          .
          --set controller.image.repository=nginx-ingress
          --set controller.image.tag=${{ github.sha }}
          --set controller.service.type=NodePort
          --set controller.nginxplus=false
          --wait
        working-directory: ${{ github.workspace }}/deployments/helm-chart
      - name: Expose Test Ingresses
        run: |
          kubectl port-forward service/oss-nginx-ingress ${{ env.NGINX_HTTP_PORT }}:80 &
          kubectl port-forward service/oss-nginx-ingress ${{ env.NGINX_HTTPS_PORT }}:443 &
      - name: Test HTTP
        run: |
          . tests/ci-files/helm-http-test.sh ${{ env.HELM_TEST_RETRIES }} ${{ env.NGINX_HTTP_PORT }}
      - name: Test HTTPS
        run: |
          . tests/ci-files/helm-http-test.sh ${{ env.HELM_TEST_RETRIES }} ${{ env.NGINX_HTTPS_PORT }} ${{ env.HELM_HTTP_POSTFIX }}

  release-docker:
    name: Release Images
    runs-on: ubuntu-20.04
    needs: [smoke-tests, helm-tests]
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    strategy:
      fail-fast: false
      matrix:
        include:
          - tag: edge
            type: debian
            platforms: linux/arm,linux/arm64,linux/amd64,linux/ppc64le,linux/s390x
          - tag: edge-alpine
            type: alpine
            platforms: linux/arm,linux/arm64,linux/amd64,linux/ppc64le,linux/s390x
          - tag: edge-ubi
            type: ubi
            platforms: linux/arm64,linux/amd64
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Output Variables
        id: commit
        run: |
          echo "::set-output name=sha::$(echo ${GITHUB_SHA} | cut -c1-7)"
          echo "::set-output name=tag::$(git describe --tags --abbrev=0)"
          echo "::set-output name=date::$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
          echo "::set-output name=nginx_version::$(cat build/Dockerfile | grep -m1 "FROM nginx:" | cut -d":" -f2 | cut -d" " -f1)"
      - name: Fetch Cached Artifacts
        uses: actions/cache@v2
        with:
          path: ${{ github.workspace }}/dist
          key: nginx-ingress-${{ github.run_id }}-${{ github.run_number }}
      - name: Setup QEMU
        uses: docker/setup-qemu-action@v2
        with:
          platforms: arm,arm64,ppc64le,s390x
      - name: Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: DockerHub Login
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Push to Dockerhub
        uses: docker/build-push-action@v3
        with:
          file: build/Dockerfile
          context: '.'
          cache-from: type=gha,scope=${{ matrix.type }}
          cache-to: type=gha,scope=${{ matrix.type }},mode=max
          target: goreleaser
          tags: nginx/nginx-ingress:${{ matrix.tag }}
          platforms: ${{ matrix.platforms }}
          push: true
          build-args: |
            BUILD_OS=${{ matrix.type }}
            IC_VERSION=${{ steps.commit.outputs.tag }}-SNAPSHOT-${{ steps.commit.outputs.sha }}
            NGINX_VERSION=${{ steps.commit.outputs.nginx_version }}
            DATE=${{ steps.commit.outputs.date }}
            GIT_COMMIT=${{ github.sha }}

  package-helm:
    name: Package Helm Chart
    runs-on: ubuntu-20.04
    needs: [smoke-tests, helm-tests, release-docker]
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3
      - name: Lint
        run: |
          helm lint ${{ env.HELM_CHART_DIR }} || true
      - name: Package
        run: |
          helm package --version ${{ env.HELM_CHART_VERSION }} ${{ env.HELM_CHART_DIR }}
      - name: Upload Chart
        uses: actions/upload-artifact@v3
        with:
          name: helm-chart
          path: ${{ github.workspace }}/nginx-ingress-${{ env.HELM_CHART_VERSION }}.tgz

  release-helm:
    name: Release Helm Chart
    runs-on: ubuntu-20.04
    needs: [smoke-tests, helm-tests, release-docker, package-helm]
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3
        with:
          repository: nginxinc/helm-charts
          fetch-depth: 1
          token: ${{ secrets.NGINX_PAT }}
      - name: Remove previous Chart
        run: rm -f ${{ github.workspace }}/edge/nginx-ingress-${{ env.HELM_CHART_VERSION }}.tgz
      - name: Retrieve latest Helm Chart
        uses: actions/download-artifact@v2
        with:
          name: helm-chart
          path: ${{ github.workspace }}/edge
      - name: Push Helm Chart
        run: |
          helm repo index edge --url https://helm.nginx.com/edge
          git add -A
          git -c user.name='${{ env.GIT_NAME }}' -c user.email='${{ env.GIT_MAIL }}' \
          commit -m "NGINX Ingress Controller - Edge Release (latest)"
          git push -u origin master

  notify:
    name: Notify
    runs-on: ubuntu-20.04
    needs: release-helm
    if: always() && github.ref == 'refs/heads/master'
    steps:
      - name: Workflow Status
        id: check
        uses: martialonline/workflow-status@v2
      - name: Output Variables
        id: commit
        run: |
          echo "::set-output name=sha::$(echo ${GITHUB_SHA} | cut -c1-7)"
          echo "::set-output name=repo::$(echo ${GITHUB_REPOSITORY} | cut -d '/' -f 2)"
      - name: Send Notification
        uses: 8398a7/action-slack@v3
        if:
          steps.check.outputs.status == 'failure'
        with:
          status: custom
          custom_payload: |
            {
              username: 'Github',
              icon_emoji: ':octocat:',
              mention: 'channel',
              attachments: [{
                title: '${{ steps.commit.outputs.repo }} ${{ github.workflow }} pipeline has failed',
                color: '${{ steps.check.outputs.status }}' == 'failure' ? 'danger' : 'warning',
                fields: [{
                  title: 'Commit Hash',
                  value: '${{ steps.commit.outputs.sha }}',
                  short: true
                },
                {
                  title: 'Author',
                  value: '${{ github.actor }}',
                  short: true
                },
                {
                  title: 'Commit Message',
                  value: `${{ github.event.head_commit.message }}`,
                  short: false
                },
                {
                  title: 'Pipeline URL',
                  value: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}',
                  short: false
                }]
              }]
            }
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}