ci.yaml

name: CI

on:
  workflow_dispatch:
    inputs:
      git-ref:
        description: The target `git` branch, `git` tag or `git` SHA to be released.
        required: true

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: controller
  ARCH: amd64
  TAG: ${{ github.event.inputs.git-ref }}

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
      with:
        ref: ${{ github.event.inputs.git-ref }}

    - name: Run Gosec Security Scanner
      uses: securego/gosec@1af1d5bb49259b62e45c505db397dd2ada5d74f8 # v2.14.0
      with:
        # G601 for zz_generated.deepcopy.go
        # G306 TODO: Expect WriteFile permissions to be 0600 or less
        # G307 TODO: Deferring unsafe method "Close"
        args: -exclude=G109,G601,G104,G204,G304,G306,G307 -tests=false -exclude-dir=test -exclude-dir=images/  -exclude-dir=docs/ ./...

  lint:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
      with:
        ref: ${{ github.event.inputs.git-ref }}

    - name: Set up Go
      id: go
      uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
      with:
        go-version: '1.20'
        check-latest: true

    - name: Run Lint
      run: ./hack/verify-golint.sh

  gofmt:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
      with:
        ref: ${{ github.event.inputs.git-ref }}

    - name: Set up Go
      id: go
      uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
      with:
        go-version: '1.20'
        check-latest: true

    - name: Run go-fmt
      run: ./hack/verify-gofmt.sh

  test-go:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
      with:
        ref: ${{ github.event.inputs.git-ref }}

    - name: Set up Go
      id: go
      uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
      with:
        go-version: '1.20'
        check-latest: true

    - name: Run test
      run: make test

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
      with:
        ref: ${{ github.event.inputs.git-ref }}

    - name: Set up Go
      id: go
      uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
      with:
        go-version: '1.20'
        check-latest: true

    - name: Set up QEMU
      uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0

    - name: Set up Docker Buildx
      id: buildx
      uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2.2.1
      with:
        version: latest

    - name: Available platforms
      run: echo ${{ steps.buildx.outputs.platforms }}

    - name: Prepare Host
      run: |
        sudo apt-get -qq update || true
        sudo apt-get install -y pigz
        curl -LO https://storage.googleapis.com/kubernetes-release/release/$KUBECTL_VERSION/bin/linux/amd64/kubectl
        chmod +x ./kubectl
        sudo mv ./kubectl /usr/local/bin/kubectl

    - name: Build images
      env:
        ARCH: amd64
      run: |
        echo "building images..."
        make clean-image build image
        make -C test/e2e-image image

        echo "creating images cache..."
        docker save \
          nginx-ingress-controller:e2e \
          $REGISTRY/$IMAGE_NAME:$TAG \
          | pigz > docker.tar.gz

    - name: cache
      uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1
      with:
        name: docker.tar.gz
        path: docker.tar.gz

  kubernetes:
    name: Kubernetes
    runs-on: ubuntu-latest
    needs:
    - build

    strategy:
      matrix:
        k8s: [v1.23.17, v1.24.7, v1.25.3, v1.26.0]

    steps:
    - name: Checkout
      uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
      with:
        ref: ${{ github.event.inputs.git-ref }}

    - name: cache
      uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1
      with:
        name: docker.tar.gz

    - name: Create Kubernetes ${{ matrix.k8s }} cluster
      id: kind
      run: |
        kind create cluster --image=kindest/node:${{ matrix.k8s }} --config test/e2e/kind.yaml

    - uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0
      with:
        name: docker.tar.gz
        failOnError: false

    - name: Load images from cache
      run: |
        echo "loading docker images..."
        pigz -dc docker.tar.gz | docker load

    - name: Run e2e tests
      env:
        KIND_CLUSTER_NAME: kind
        SKIP_CLUSTER_CREATION: true
        SKIP_IMAGE_CREATION: true
      run: |
        kind get kubeconfig > $HOME/.kube/kind-config-kind
        make kind-e2e-test

  release:
    name: Release
    runs-on: ubuntu-latest
    needs:
    - kubernetes
    steps:
    - name: Check out ingress-nginx
      uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
      with:
        ref: ${{ github.event.inputs.git-ref }}

    # Based on https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions#publishing-a-package-using-an-action
    - name: Log in to the Container registry
      uses: docker/login-action@v2
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: cache
      uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1
      with:
        name: docker.tar.gz

    - name: Load images from cache
      run: |
        echo "loading docker images..."
        pigz -dc docker.tar.gz | docker load
        docker image ls

#     - name: Build and push image
#       run: |
#         docker image ls
#         docker push $REGISTRY/$IMAGE_NAME:$TAG

    - uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0
      with:
        name: docker.tar.gz
        failOnError: false