tests-l4lb.yaml

name: Cilium L4LB XDP (ci-l4lb)

# Any change in triggers needs to be reflected in the concurrency group.
on:
  issue_comment:
    types:
      - created
  # Run every 6 hours
  schedule:
    - cron:  '0 5/6 * * *'
  ### FOR TESTING PURPOSES
  # This workflow runs in the context of `main`, and ignores changes to
  # workflow files in PRs. For testing changes to this workflow from a PR:
  # - Make sure the PR uses a branch from the base repository (requires write
  #   privileges). It will not work with a branch from a fork (missing secrets).
  # - Uncomment the `pull_request` event below, commit separately with a `DO
  #   NOT MERGE` message, and push to the PR. As long as the commit is present,
  #   any push to the PR will trigger this workflow.
  # - Don't forget to remove the `DO NOT MERGE` commit once satisfied. The run
  #   will disappear from the PR checks: please provide a direct link to the
  #   successful workflow run (can be found from Actions tab) in a comment.
  #
  # pull_request: {}
  ###

# By specifying the access of one of the scopes, all of those that are not
# specified are set to 'none'.
permissions:
  # To be able to access the repository with actions/checkout
  contents: read
  # To allow retrieving information from the PR API
  pull-requests: read
  # So that Sibz/github-status-action can write into the status API
  statuses: write

concurrency:
  # Structure:
  # - Workflow name
  # - Event type
  # - A unique identifier depending on event type:
  #   - schedule: SHA
  #   - issue_comment: PR number
  #   - pull_request: PR number
  #
  # This structure ensures a unique concurrency group name is generated for each
  # type of testing:
  # - schedule: {name} schedule {SHA}
  # - issue_comment: {name} issue_comment {PR number}
  # - pull_request: {name} pull_request {PR number}
  #
  # Note: for `issue_comment` triggers, we additionally need to filter out based
  # on comment content, otherwise any comment will interrupt workflow runs.
  group: |
    ${{ github.workflow }}
    ${{ github.event_name }}
    ${{
      (github.event_name == 'schedule' && github.sha) ||
      (github.event_name == 'issue_comment' && (
        github.event.comment.body == '/ci-l4lb' ||
        github.event.comment.body == '/test'
      ) && github.event.issue.number) ||
      (github.event_name == 'pull_request' && github.event.pull_request.number)
    }}
  cancel-in-progress: true

env:
  # renovate: datasource=github-releases depName=cilium/cilium-cli
  cilium_cli_version: v0.14.5
  cilium_cli_ci_version:
  check_url: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}

jobs:
  check_changes:
    name: Deduce required tests from code changes
    if: |
      (github.event_name == 'issue_comment' && (
        github.event.comment.body == '/ci-l4lb' ||
        github.event.comment.body == '/test'
      )) ||
      github.event_name == 'schedule' ||
      github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    outputs:
      tested: ${{ steps.tested-tree.outputs.src }}
    steps:
      # Because we run on issue comments, we need to checkout the code for
      # paths-filter to work.
      - name: Checkout code
        if: ${{ github.event.issue.pull_request }}
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
        with:
          persist-credentials: false
      - name: Retrieve pull request's base and head
        if: ${{ github.event.issue.pull_request }}
        id: pr
        run: |
          curl ${{ github.event.issue.pull_request.url }} > pr.json
          echo "base=$(jq -r '.base.sha' pr.json)" >> $GITHUB_OUTPUT
          echo "head=$(jq -r '.head.sha' pr.json)" >> $GITHUB_OUTPUT
      - name: Check code changes
        if: ${{ github.event.issue.pull_request }}
        uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
        id: tested-tree
        with:
          base: ${{ steps.pr.outputs.base }}
          ref: ${{ steps.pr.outputs.head }}
          filters: |
            src:
              - 'pkg/**'
              - 'daemon/**'
              - 'bpf/**'
              - 'test/l4lb/**'
              - 'test/nat46x64/**'
              - 'images/**'

  skip-test-run:
    # If the modified files are not relevant for this test then we can skip
    # this test and mark it as successful.
    if: github.event.comment.body == '/test' && needs.check_changes.outputs.tested == 'false'
    runs-on: ubuntu-latest
    needs: check_changes
    steps:
    - name: Set up job variables
      id: vars
      run: |
        if [ ${{ github.event.issue.pull_request || github.event.pull_request }} ]; then
          PR_API_JSON=$(curl \
            -H "Accept: application/vnd.github.v3+json" \
            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            ${{ github.event.issue.pull_request.url || github.event.pull_request.url }})
          SHA=$(echo "$PR_API_JSON" | jq -r ".head.sha")
        else
          SHA=${{ github.sha }}
        fi
        echo "sha=${SHA}" >> $GITHUB_OUTPUT
    - name: Set commit status to success
      uses: Sibz/github-status-action@650dd1a882a76dbbbc4576fb5974b8d22f29847f # v1.1.6
      with:
        authToken: ${{ secrets.GITHUB_TOKEN }}
        sha: ${{ steps.vars.outputs.sha }}
        context: ${{ github.workflow }}
        description: L4LB test skipped
        state: success
        target_url: ${{ env.check_url }}

  # This job is skipped when the workflow was triggered with the generic `/test`
  # trigger if the only modified files were under `test/` or `Documentation/`.
  setup-and-test:
    needs: check_changes
    name: Setup & Test
    if: |
      (github.event_name == 'issue_comment' && (
        github.event.comment.body == '/ci-l4lb' ||
        (github.event.comment.body == '/test' && needs.check_changes.outputs.tested == 'true')
      )) ||
      github.event_name == 'schedule' ||
      github.event_name == 'pull_request'
    # Ubuntu 22.04 runner uses cgroup v2-only which is needed for some
    # our LB functionality
    runs-on: ubuntu-22.04
    timeout-minutes: 45
    steps:
      - name: Checkout main branch to access local actions
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
      - name: Set Environment Variables
        uses: ./.github/actions/set-env-variables

      - name: Set up job variables
        id: vars
        run: |
          if [ ${{ github.event.issue.pull_request || github.event.pull_request }} ]; then
            PR_API_JSON=$(curl \
              -H "Accept: application/vnd.github.v3+json" \
              -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
              ${{ github.event.issue.pull_request.url || github.event.pull_request.url }})
            SHA=$(echo "$PR_API_JSON" | jq -r ".head.sha")
          else
            SHA=${{ github.sha }}
          fi

          echo sha=${SHA} >> $GITHUB_OUTPUT

      - name: Set commit status to pending
        uses: Sibz/github-status-action@650dd1a882a76dbbbc4576fb5974b8d22f29847f # v1.1.6
        with:
          authToken: ${{ secrets.GITHUB_TOKEN }}
          sha: ${{ steps.vars.outputs.sha }}
          context: ${{ github.workflow }}
          description: L4LB test in progress...
          state: pending
          target_url: ${{ env.check_url }}

      - name: Install Cilium CLI
        uses: cilium/cilium-cli@d610d6e2774e29aef9565bad935e3b4943d541af # v0.14.5
        with:
          release-version: ${{ env.cilium_cli_version }}
          ci-version: ${{ env.cilium_cli_ci_version }}

      - name: Checkout upstream for test files
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
        with:
          # This is intentionally set to stable branch to avoid using test.sh from pull requests.
          ref: main
          persist-credentials: false

      - name: Checkout pull request for Helm chart
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
        with:
          ref: ${{ steps.vars.outputs.sha }}
          persist-credentials: false
          path: pull-request

      - name: Wait for image to be available
        timeout-minutes: 10
        shell: bash
        run: |
          until docker manifest inspect quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-ci:${{ steps.vars.outputs.sha }} &> /dev/null; do sleep 45s; done

      - name: Run LoadBalancing test
        run: |
          cd ${{ github.workspace }}/test/l4lb && sudo ./test.sh ${{ env.QUAY_ORGANIZATION_DEV }} ${{ steps.vars.outputs.sha }}

      - name: Run NAT46x64 test
        run: |
          cd ${{ github.workspace }}/test/nat46x64 && sudo ./test.sh ${{ env.QUAY_ORGANIZATION_DEV }} ${{ steps.vars.outputs.sha }}

      - name: Fetch cilium-sysdump
        if: ${{ !success() }}
        run: |
          sudo cilium sysdump --output-filename cilium-sysdump-out

      - name: Upload cilium-sysdump
        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        if: ${{ !success() }}
        with:
          name: cilium-sysdump-out.zip
          path: cilium-sysdump-out.zip

      - name: Set commit status to success
        if: ${{ success() }}
        uses: Sibz/github-status-action@650dd1a882a76dbbbc4576fb5974b8d22f29847f # v1.1.6
        with:
          authToken: ${{ secrets.GITHUB_TOKEN }}
          sha: ${{ steps.vars.outputs.sha }}
          context: ${{ github.workflow }}
          description: L4LB test successful
          state: success
          target_url: ${{ env.check_url }}

      - name: Set commit status to failure
        if: ${{ failure() }}
        uses: Sibz/github-status-action@650dd1a882a76dbbbc4576fb5974b8d22f29847f # v1.1.6
        with:
          authToken: ${{ secrets.GITHUB_TOKEN }}
          sha: ${{ steps.vars.outputs.sha }}
          context: ${{ github.workflow }}
          description: L4LB test failed
          state: failure
          target_url: ${{ env.check_url }}

      - name: Set commit status to cancelled
        if: ${{ cancelled() }}
        uses: Sibz/github-status-action@650dd1a882a76dbbbc4576fb5974b8d22f29847f # v1.1.6
        with:
          authToken: ${{ secrets.GITHUB_TOKEN }}
          sha: ${{ steps.vars.outputs.sha }}
          context: ${{ github.workflow }}
          description: L4LB test cancelled
          state: error
          target_url: ${{ env.check_url }}