pull-request.yaml

# Jobs defined in this file are responsible for things that do not require container image
# but still relevant to the codebase such as unit tests, linting etc

name: Pull Request

on:
  pull_request:
    types: [ synchronize, opened, reopened, ready_for_review ]
    branches:
      - "main"

permissions:
  contents: read

env:
  GITLEAKS_VERSION: 8.21.0

jobs:
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Fetch gitleaks ${{ env.GITLEAKS_VERSION }}
        run: curl -Lso gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v${{ env.GITLEAKS_VERSION }}/gitleaks_${{ env.GITLEAKS_VERSION }}_linux_x64.tar.gz && tar -xvzf ./gitleaks.tar.gz
      - name: Run gitleaks
        # Scan commits between base and head of the pull request
        run: ./gitleaks detect --log-opts=${PULL_BASE_SHA}...${PULL_HEAD_SHA} --verbose --redact
        env:
          PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PULL_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
  build-image:
    name: Build manager image
    runs-on: ubuntu-latest
    if: github.event.pull_request.draft == false
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
      - uses: ./.github/actions/build-manager-image
        with:
          operator-image-name: "api-gateway-manager:PR-${{github.event.number}}"

  unit-tests:
    name: Unit tests & lint
    if: github.event.pull_request.draft == false
    uses: ./.github/workflows/pull-unit-lint.yaml
    secrets: inherit

  integration-tests:
    name: Integration tests
    if: github.event.pull_request.draft == false
    needs: [build-image]
    uses: ./.github/workflows/pull-integration.yaml
    secrets: inherit

  ui-tests:
    name: UI tests
    if: github.event.pull_request.draft == false
    needs: [build-image]
    uses: ./.github/workflows/ui-tests.yaml
    secrets: inherit

  verify-pins:
    name: Verify-commit-pins
    if: github.event.pull_request.draft == false
    uses: ./.github/workflows/verify-commit-pins.yaml
    secrets: inherit

  pull-request-status:
    needs: [ build-image, unit-tests, integration-tests, ui-tests, verify-pins ]
    runs-on: ubuntu-latest
    if: always()
    steps:
      - if: ${{ !(contains(needs.*.result, 'failure')) }}
        run: exit 0
      - if: ${{ contains(needs.*.result, 'failure') }}
        run: exit 1