release-testing.yml

name: Release Testing
on:
  push:
    branches:
      - 'hotfix-*-rc--*'
      - 'rc--*'
      - 'marko-update-release-testing'
  workflow_dispatch:
env:
  CI_COMMIT_SHA: ${{ github.sha }}
  CI_COMMIT_REF_PROTECTED: ${{ github.ref_protected }}
  CI_JOB_NAME: ${{ github.job }}
  CI_JOB_ID: ${{ github.job }} # github does not expose this variable https://github.com/orgs/community/discussions/8945
  CI_JOB_URL: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
  CI_PIPELINE_SOURCE: ${{ github.event_name }}
  CI_PROJECT_DIR: ${{ github.workspace }}
  CI_MERGE_REQUEST_TARGET_BRANCH_NAME: ${{ github.event.pull_request.base.ref }}
  BRANCH_NAME: ${{ github.event.workflow_run.head_branch || github.ref_name }}
  ROOT_PIPELINE_ID: ${{ github.run_id }}
  BAZEL_STARTUP_ARGS: "--output_base=/var/tmp/bazel-output/"
  RUSTFLAGS: "--remap-path-prefix=${CI_PROJECT_DIR}=/ic"
  AWS_SHARED_CREDENTIALS_CONTENT: ${{ secrets.AWS_SHARED_CREDENTIALS_FILE }}
  DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
  DOCKER_HUB_PASSWORD_RO: ${{ secrets.DOCKER_HUB_PASSWORD_RO }}
  BUILDEVENT_APIKEY: ${{ secrets.HONEYCOMB_API_TOKEN }}
  BUILDEVENT_DATASET: "github-ci-dfinity"
jobs:
  ci-main:
    name: CI Main
    uses: ./.github/workflows/ci-main.yml
    secrets: inherit
  bazel-system-test-nightly:
    name: Bazel System Test Nightly
    runs-on:
      group: zh1
      labels: dind-large
    container:
      image: ghcr.io/dfinity/ic-build@sha256:26cc347efa50935342742acddfb5d710fae1982d401911013ad8750f0603c590
      options: >-
        -e NODE_NAME --privileged --cgroupns host -v /cache:/cache -v /var/sysimage:/var/sysimage -v /var/tmp:/var/tmp
    timeout-minutes: 180 # 3 hours
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_branch }}
      - name: Before script
        id: before-script
        shell: bash
        run: ./gitlab-ci/src/ci-scripts/before-script.sh
      - name: Run Bazel System Test Nightly
        id: bazel-test-all
        uses: ./.github/actions/bazel-test-all/
        with:
          BAZEL_COMMAND: "test"
          BAZEL_TARGETS: "//rs/tests/..."
          BAZEL_CI_CONFIG: "--config=ci --repository_cache=/cache/bazel"
          BAZEL_EXTRA_ARGS: "--keep_going --test_tag_filters=system_test_nightly --deleted_packages=gitlab-ci/src/gitlab_config"
          HONEYCOMB_API_TOKEN: ${{ secrets.HONEYCOMB_API_TOKEN }}
  bazel-system-test-staging:
    name: Bazel System Test Staging
    continue-on-error: True
    runs-on:
      group: zh1
      labels: dind-large
    container:
      image: ghcr.io/dfinity/ic-build@sha256:26cc347efa50935342742acddfb5d710fae1982d401911013ad8750f0603c590
      options: >-
        -e NODE_NAME --privileged --cgroupns host -v /cache:/cache -v /var/sysimage:/var/sysimage -v /var/tmp:/var/tmp
    timeout-minutes: 180 # 3 hours
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_branch }}
      - name: Before script
        id: before-script
        shell: bash
        run: ./gitlab-ci/src/ci-scripts/before-script.sh
      - name: Run Bazel System Test Staging
        id: bazel-test-all
        uses: ./.github/actions/bazel-test-all/
        with:
          BAZEL_COMMAND: "test"
          BAZEL_TARGETS: "//rs/tests/..."
          BAZEL_CI_CONFIG: "--config=ci --repository_cache=/cache/bazel"
          BAZEL_EXTRA_ARGS: "--keep_going --test_tag_filters=system_test_staging --deleted_packages=gitlab-ci/src/gitlab_config"
          HONEYCOMB_API_TOKEN: ${{ secrets.HONEYCOMB_API_TOKEN }}
  bazel-system-test-hotfix:
    name: Bazel System Test Hotfix
    runs-on:
      group: zh1
      labels: dind-large
    container:
      image: ghcr.io/dfinity/ic-build@sha256:26cc347efa50935342742acddfb5d710fae1982d401911013ad8750f0603c590
      options: >-
        -e NODE_NAME --privileged --cgroupns host -v /cache:/cache -v /var/sysimage:/var/sysimage -v /var/tmp:/var/tmp
    timeout-minutes: 90
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_branch }}
      - name: Before script
        id: before-script
        shell: bash
        run: ./gitlab-ci/src/ci-scripts/before-script.sh
      - name: Run Bazel Test All
        id: bazel-test-all
        uses: ./.github/actions/bazel-test-all/
        with:
          BAZEL_COMMAND: "test"
          BAZEL_TARGETS: "//rs/tests/..."
          BAZEL_CI_CONFIG: "--config=ci --repository_cache=/cache/bazel"
          BAZEL_EXTRA_ARGS_RULES: "--test_tag_filters=system_test_hotfix --deleted_packages=gitlab-ci/src/gitlab_config"
          HONEYCOMB_API_TOKEN: ${{ secrets.HONEYCOMB_API_TOKEN }}
  dependency-scan-release-cut:
    name: Dependency Scan for Release builds
    runs-on:
      group: zh1
      labels: dind-large
    container:
      image: ghcr.io/dfinity/ic-build@sha256:26cc347efa50935342742acddfb5d710fae1982d401911013ad8750f0603c590
      options: >-
        -e NODE_NAME --privileged --cgroupns host -v /cache:/cache -v /var/sysimage:/var/sysimage -v /var/tmp:/var/tmp
    timeout-minutes: 60
    env:
      SHELL_WRAPPER: "/usr/bin/time"
      CI_PROJECT_PATH: ${{ github.repository }}
      CI_PIPELINE_ID: ${{ github.run_id }}
      CI_COMMIT_SHA: ${{ github.sha }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
      SLACK_PSEC_BOT_OAUTH_TOKEN: ${{ secrets.SLACK_PSEC_BOT_OAUTH_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_branch }}
      - name: Before script
        id: before-script
        shell: bash
        run: ./gitlab-ci/src/ci-scripts/before-script.sh
      - name: Setup python deps
        id: setup-python-deps
        shell: bash
        run: |
          pip3 install --ignore-installed -r requirements.txt
      - name: Dependency Scan for Release
        id: dependency-scan-release-cut
        shell: bash
        run: |
          set -euo pipefail
          export PYTHONPATH=$PWD/gitlab-ci/src:$PWD/gitlab-ci/src/dependencies
          cd gitlab-ci/src/dependencies/
          $SHELL_WRAPPER python3 job/bazel_rust_ic_scanner_release_job.py