workflows: use latest stable CLI in post-test information gathering

[nbusseneau]

The post-test information gathering steps were previously self-contained and became split between the actual workflow step and in-cluster jobs logs in #212.

In parallel, sysdump became a subcommand of the CLI and we switched to using it in post-test information gathering in #405.

However, we explicitly do not want to run PR-built cilium in the context of a pull_request_target-triggered privileged workflow, as it would allow an attacker to leak the repository's secrets.

Our proposal is to use the latest stable version of the CLI in the post-test information gathering step. This is acceptable as the purpose of this step is retrieving information, not testing the actual cilium commands run in the step -- this is done as part of the in-cluster jobs.

Should a workflow developer actually need to check that a PR editing sysdump or any other cilium command used in this step works as intended with the new changes, they can always switch to pull_request testing or edit the in-cluster scripts with additional testing.

[nbusseneau]

Added a test commit with pull_request triggers and always() post-test condition to test all workflows with changes before merging.

[tklauser]

Thanks!

[aanm]

I'm probably missing something but if we are changing from pull_request_target to pull_request how will forks be able to run the conformance tests?

[nbusseneau]

I'm probably missing something but if we are changing from pull_request_target to pull_request how will forks be able to run the conformance tests?

We are not, you're looking at a DO NOT MERGE test commit :D

[nbusseneau]

@michi-covalent @tklauser all workflows have failed at the cilium sysdump call, hitting the workflow timeout (see how they all spend 20 minutes in the post-test gathering step). I think something's not working with cilium sysdump.

[michi-covalent]

@michi-covalent @tklauser all workflows have failed at the cilium sysdump call, hitting the workflow timeout (see how they all spend 20 minutes in the post-test gathering step). I think something's not working with cilium sysdump.

yeah we need this commit ead8cc6 it's not release yet 🤯

[nbusseneau]

Blocked by #428.

[tklauser]

Rebased to re-trigger CI now that v0.8.5 is released.

[tklauser]

Tests passed with ciliuim invoked correctly in collected in the "Post-test information gathering" step:

• AKS https://github.com/cilium/cilium-cli/actions/runs/1029059137
• EKS (ENI) https://github.com/cilium/cilium-cli/actions/runs/1029059139
• EKS (tunnel) https://github.com/cilium/cilium-cli/actions/runs/1029059130
• GKE https://github.com/cilium/cilium-cli/actions/runs/1029059135
• Multicluster https://github.com/cilium/cilium-cli/actions/runs/1029059131
• Kind https://github.com/cilium/cilium-cli/actions/runs/1029059133
• External Workloads https://github.com/cilium/cilium-cli/actions/runs/1029059136

Removing the temporary test commit and merging to unblock other PRs which rely on collecting sysdumps.

[tklauser]

Rebased again to fix conflict after merging #426.