Charm Review

.github/.jira_sync_config.yaml

@@ -0,0 +1,18 @@
+# From https://github.com/canonical/gh-jira-sync-bot#client-side-configuration
+settings:
+  jira_project_key: "IAM"
+  status_mapping:
+    opened: Untriaged
+    closed: done
+  components:
+    - Hydra
+  labels:
+    - bug
+    - enhancement
+  add_gh_comment: true
+  sync_description: true
+  sync_comments: true
+  epic_key: "IAM-471"
+  label_mapping:
+    enhancement: Story
+    bug: Bug

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,57 @@
+name: Bug Report
+description: File a bug report
+labels: ["Type: Bug", "Status: Triage"]
+body:
+  - type: markdown
+    attributes:
+      value: >
+        Thanks for taking the time to fill out this bug report! Before submitting your issue, please make
+        sure you are using the latest version of the charm. If not, please switch to this image prior to 
+        posting your report to make sure it's not already solved.
+  - type: textarea
+    id: bug-description
+    attributes:
+      label: Bug Description
+      description: >
+        If applicable, add screenshots to help explain the problem you are facing.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: To Reproduce
+      description: >
+        Please provide a step-by-step instruction of how to reproduce the behavior.
+      placeholder: |
+        1. `juju deploy ...`
+        2. `juju relate ...`
+        3. `juju status --relations`
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: >
+        We need to know a bit more about the context in which you run the charm.
+        - Are you running Juju locally, on lxd, in multipass or on some other platform?
+        - What track and channel you deployed the charm from (ie. `latest/edge` or similar).
+        - Version of any applicable components, like the juju snap, the model controller, lxd, microk8s, and/or multipass.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant log output
+      description: >
+        Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
+        Fetch the logs using `juju debug-log --replay` and `kubectl logs ...`. Additional details available in the juju docs 
+        at https://juju.is/docs/olm/juju-logs
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional context
+

.github/ISSUE_TEMPLATE/enhancement_proposal.yml

@@ -0,0 +1,17 @@
+name: Enhancement Proposal
+description: File an enhancement proposal
+labels: ["Type: Enhancement", "Status: Triage"]
+body:
+  - type: markdown
+    attributes:
+      value: >
+        Thanks for taking the time to fill out this enhancement proposal! Before submitting your issue, please make
+        sure there isn't already a prior issue concerning this. If there is, please join that discussion instead.
+  - type: textarea
+    id: enhancement-proposal
+    attributes:
+      label: Enhancement Proposal
+      description: >
+        Describe the enhancement you would like to see in as much detail as needed.      
+    validations:
+      required: true

.github/workflows/auto-approver.yaml

@@ -0,0 +1,25 @@
+name: auto-approver
+run-name: CI for approving PRs
+
+on:
+  push:
+    branches:
+      - "renovate/**"
+      - "automated-update-charm-libs"
+
+jobs:
+  autoapprove:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - name: Approve PR
+        run: |
+          gh pr review --approve || true
+        env:
+          GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }}
+      - name: Enable automerge if required
+        if: startsWith(github.ref_name, 'renovate/auto-')
+        run: |
+          gh pr merge --auto --merge || true
+        env:
+          GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }}

.github/workflows/on_pull_request.yaml

@@ -0,0 +1,28 @@
+name: On Pull Request
+
+# On pull_request, we:
+# * always run lint checks
+# * always run tests
+
+on:
+  pull_request:
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+
+      - name: Install dependencies
+        run: python3 -m pip install tox
+
+      - name: Run linters
+        run: tox -e lint
+
+  tests:
+    name: Run Tests
+    needs:
+      - lint
+    uses: ./.github/workflows/tests.yaml

.github/workflows/on_push.yaml

@@ -0,0 +1,27 @@
+name: On Push
+
+# On push to a "special" branch, we:
+# * always publish to charmhub at latest/edge/branchname
+# * always run tests
+# where a "special" branch is one of main/master or track/**, as
+# by convention these branches are the source for a corresponding
+# charmhub edge channel.
+
+on:
+  push:
+    branches:
+      - main
+      - track/**
+
+jobs:
+  tests:
+    name: Run Tests
+    uses: ./.github/workflows/tests.yaml
+
+  # publish runs in series with tests, and only publishes if tests passes
+  publish-charm:
+    name: Publish Charm
+    needs: tests
+    uses: ./.github/workflows/publish.yaml
+    secrets:
+      CHARMCRAFT_CREDENTIALS: ${{ secrets.CHARMCRAFT_CREDENTIALS }}

.github/workflows/on_schedule.yaml

@@ -0,0 +1,15 @@
+on:
+  schedule:
+    - cron: '0 8 * * MON'
+
+jobs:
+  update-charm-libs:
+    name: Update Charm Libraries
+    uses: ./.github/workflows/update_libs.yaml
+    secrets:
+      CHARMCRAFT_CREDENTIALS: ${{ secrets.CHARMCRAFT_CREDENTIALS }}
+      PAT_TOKEN: ${{ secrets.PAT_TOKEN }}
+
+  tests:
+    name: Run Tests
+    uses: ./.github/workflows/tests.yaml

.github/workflows/publish.yaml

@@ -0,0 +1,61 @@
+# reusable workflow for publishing all charms in this repo
+name: Publish
+
+on:
+  workflow_call:
+    inputs:
+      source_branch:
+        description: Github branch from this repo to publish.  If blank, will use the default branch
+        default: ''
+        required: false
+        type: string
+    secrets:
+      CHARMCRAFT_CREDENTIALS:
+        required: true
+
+  workflow_dispatch:
+    inputs:
+      destination_channel:
+        description: CharmHub channel to publish to
+        required: false
+        default: 'latest/edge'
+        type: string
+      source_branch:
+        description: Github branch from this repo to publish.  If blank, will use the default branch
+        required: false
+        default: ''
+        type: string
+
+jobs:
+  publish-charm:
+    name: Publish Charm
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.source_branch }}
+
+      - name: Select charmhub channel
+        uses: canonical/charming-actions/channel@631c2d944da2bd12430f1f3a954c8fffcf2385cd # 2.4.0
+        id: select-channel
+        if: ${{ inputs.destination_channel == '' }}
+
+      # Combine inputs from different sources to a single canonical value so later steps don't
+      # need logic for picking the right one
+      - name: Parse and combine inputs
+        id: parse-inputs
+        run: |
+          # destination_channel
+          destination_channel="${{ inputs.destination_channel || steps.select-channel.outputs.name }}"
+          echo "setting output of destination_channel=$destination_channel"
+          echo "::set-output name=destination_channel::$destination_channel"
+
+      - name: Upload charm to charmhub
+        uses: canonical/charming-actions/upload-charm@631c2d944da2bd12430f1f3a954c8fffcf2385cd # 2.4.0
+        with:
+          credentials: ${{ secrets.CHARMCRAFT_CREDENTIALS }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          channel: ${{ steps.parse-inputs.outputs.destination_channel }}

.github/workflows/release.yaml

@@ -0,0 +1,27 @@
+# reusable workflow triggered manually
+name: Release charm to other tracks and channels
+
+on:
+  workflow_dispatch:
+    inputs:
+      destination-channel:
+        description: 'Destination Channel'
+        required: true
+      origin-channel:
+        description: 'Origin Channel'
+        required: true
+
+jobs:
+  promote-charm:
+    name: Promote charm
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - name: Release charm to channel
+        uses: canonical/charming-actions/release-charm@631c2d944da2bd12430f1f3a954c8fffcf2385cd # 2.4.0
+        with:
+          credentials: ${{ secrets.CHARMCRAFT_CREDENTIALS }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          destination-channel: ${{ github.event.inputs.destination-channel }}
+          origin-channel: ${{ github.event.inputs.origin-channel }}
+          base-channel: '22.04'

.github/workflows/release_libs.yaml

@@ -0,0 +1,24 @@
+# Release charm's libraries if they have changed
+name: Release Libraries
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "lib/charms/hydra/**"
+
+jobs:
+  release-libs:
+    name: Release any bumped library
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        with:
+          fetch-depth: 0
+      - name: Release any bumped charm library
+        uses: canonical/charming-actions/release-libraries@main
+        with:
+          credentials: "${{ secrets.CHARMCRAFT_CREDENTIALS }}"
+          github-token: "${{ github.token }}"

.github/workflows/tests.yaml

@@ -0,0 +1,66 @@
+name: Tests
+on:
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  unit-test:
+    name: Unit tests
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+
+      - name: Install dependencies
+        run: python -m pip install tox
+
+      - name: Run tests
+        run: tox -e unit
+
+  integration-test-microk8s:
+    name: Integration tests (microk8s)
+    runs-on: ubuntu-22.04
+    needs:
+      - unit-test
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+
+      - name: Setup operator environment
+        uses: charmed-kubernetes/actions-operator@main
+        with:
+          provider: microk8s
+          channel: 1.28-strict/stable
+          juju-channel: 3.1
+          bootstrap-options: '--agent-version=3.1.0'
+
+      - name: Run integration tests
+        # set a predictable model name so it can be consumed by charm-logdump-action
+        run: tox -e integration -- --model testing
+
+      - name: Get contexts
+        run: kubectl config view
+        if: failure()
+
+      - name: Get juju status
+        run: juju status --relations
+        if: failure()
+
+      - name: Get juju logs
+        run: juju debug-log --replay --include unit-hydra-0
+        if: failure()
+
+      - name: Get hydra container logs
+        run: kubectl logs hydra-0 -c hydra -n testing
+        if: failure()
+
+      # Hack to overcome lack of tools (cat, tar) in the workload container
+      - name: Get hydra config file
+        run: |
+          juju ssh hydra/0 "PYTHONPATH=agents/unit-hydra-0/charm/venv/ python3 -c '
+          from ops import pebble
+          p = pebble.Client(\"/charm/containers/hydra/pebble.socket\")
+          f = p.pull(\"/etc/config/hydra.yaml\")
+          print(f.read())
+          '"
+        if: failure()