e2e.yaml

name: E2E
# Runs e2e tests against a kind cluster:
# - on pushes to master;
# - on pull requests targeting master or release-* branches, when the PR is approved
#   or when the run-e2e label is added. To run them again, e.g. after new commits or a rebase,
#   comment /run-e2e (see e2e-command.yaml) or re-add the run-e2e label.
#   An approval doesn't run them if they already passed or are running for the latest commit.
#
# Draft PRs are skipped. e2e is also skipped when only these paths change:
# - docs/**, *.md, config/examples/**, config/samples/**, codespell/**, .github/**
#   (except this workflow and .github/actions/**);
# - the root Makefile and go.mod/go.sum: skipped on PRs, but tested on pushes to master.
#
# See the "Check changed files" step for the filters.
on:
  push:
    branches:
      - master
  pull_request_review:
    types:
      - submitted
  pull_request:
    branches:
      - master
      - release-*
    types:
      - labeled

permissions: {}

jobs:
  changes:
    name: Check changed files
    if: >-
      github.event_name == 'push' ||
      (github.event.pull_request.draft == false &&
       (github.event.pull_request.base.ref == 'master' || startsWith(github.event.pull_request.base.ref, 'release-')) &&
       ((github.event.review.state == 'approved' &&
         contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.review.author_association)) ||
        github.event.label.name == 'run-e2e'))
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      pull-requests: read
    outputs:
      run_e2e: >-
        ${{ steps.previous.outputs.covered != 'true' &&
            (steps.changes.outputs.src == 'true' || steps.changes.outputs.ci == 'true' ||
             (github.event_name == 'push' && steps.changes.outputs.deps == 'true')) }}
    steps:
      # an approval doesn't run e2e if it already passed or is running for the PR's latest commit,
      # e.g. when a second maintainer approves; the run-e2e label and /run-e2e always run it
      - name: Check previous e2e runs
        id: previous
        if: github.event_name == 'pull_request_review'
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          SHA: ${{ github.event.pull_request.head.sha }}
          RUN_ID: ${{ github.run_id }}
        run: |
          runs=$(gh api "repos/$REPO/actions/workflows/e2e.yaml/runs?head_sha=$SHA&per_page=100" \
            --jq ".workflow_runs[] | select(.id != $RUN_ID) | .id")
          for id in $runs; do
            # both e2e jobs of a run are running or passed
            ok=$(gh api "repos/$REPO/actions/runs/$id/jobs" \
              --jq '[.jobs[] | select(.name == "E2E / main" or .name == "E2E / upgrade")
                     | select(.status != "completed" or .conclusion == "success")] | length')
            if [ "$ok" -eq 2 ]; then
              echo "e2e already passed or is running for $SHA in run $id, skipping"
              echo "covered=true" >> "$GITHUB_OUTPUT"
              break
            fi
          done

      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Check changed files
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d  # v4.0.3
        id: changes
        with:
          # a file matches a filter when it matches one of its rules and none of its '!' rules
          predicate-quantifier: 'some-with-excludes'
          filters: |
            src:
              - '**'
              - '!Makefile'
              - '!docs/**'
              - '!**/*.md'
              - '!config/examples/**'
              - '!config/samples/**'
              - '!**/go.mod'
              - '!**/go.sum'
              - '!.github/**'
              - '!codespell/**'
            # kept out of src, since an excluded path cannot be re-included there
            ci:
              - '.github/workflows/e2e.yaml'
              - '.github/actions/**'
            # dependency and tool version bumps: e2e on master pushes only
            deps:
              - 'Makefile'
              - '**/go.mod'
              - '**/go.sum'

  e2e:
    name: E2E / ${{ matrix.name }}
    needs: changes
    if: needs.changes.outputs.run_e2e == 'true'
    # job-level, so that unrelated reviews and labels, which skip all jobs, don't cancel a running e2e
    concurrency:
      group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ matrix.name }}
      cancel-in-progress: true
    runs-on: vm-runner
    permissions:
      actions: read
      contents: read
      checks: write
    strategy:
      fail-fast: false
      matrix:
        include:
          # the job names "E2E / main" and "E2E / upgrade" are also used by the "Check previous e2e runs" step
          # every suite under test/e2e, except upgrade, which runs in its own job
          - name: main
            e2e_target: --skip-package=upgrade ./test/e2e/...
          - name: upgrade
            e2e_target: ./test/e2e/upgrade/...
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - name: Setup build environment
        id: setup
        uses: ./.github/actions/setup-build-env
      - name: E2E Tests
        env:
          DOCKER_BUILD_ARGS: --cache-from=type=gha --cache-to=type=gha,mode=max
          LICENSE_KEY: ${{ secrets.ENTERPRISE_COMPONENTS_LICENSE_KEY }}
          E2E_TARGET: ${{ matrix.e2e_target }}
        run: |
          TAG=${GITHUB_SHA:0:7} make test-e2e
      - name: Save Go cache
        if: ${{ github.ref == 'refs/heads/master' }}
        uses: ./.github/actions/save-go-cache
      - name: Publish reports
        uses: ./.github/actions/publish-reports