ci.yaml

name: CI

on:
  push:
    branches:
      - main
      - release-*
  pull_request:
    branches:
      - "*"

permissions:
  contents: read

env:
  DOCKER_REGISTRY: "quay.io"
  DOCKER_REPOSITORY: "dynatrace/dynatrace-operator"

jobs:
  helm-test:
    name: Run helm unit tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set up Helm
        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: Run Unit tests
        id: helm-unittest
        run: |
          make test/helm/unit

  helm-lint:
    name: Run helm linting
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Set up Helm
        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: Run Linting
        id: helm-linting
        run: |
          make test/helm/lint

  tests:
    name: Run unit tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup Golang
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version-file: "${{ github.workspace }}/go.mod"
      - name: Download dependencies
        id: depdownload
        run: |
          hack/build/ci/install-cgo-dependencies.sh
      - name: Run Unit tests and Integration tests
        id: unittest
        run: |
          make go/test
          make go/integration_test
      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v4
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
          verbose: true

  linting:
    name: Run linting
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version-file: "${{ github.workspace }}/go.mod"
      - name: Download dependencies
        id: depdownload
        run: |
          hack/build/ci/install-cgo-dependencies.sh
      - name: golangci-lint
        uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # v4.0.0
        with:
          # renovate depName=github.com/golangci/golangci-lint
          version: v1.57.1
          args: --build-tags e2e --timeout 300s --out-${NO_FUTURE}format colored-line-number
      - name: Run deadcode
        id: deadcode
        run: |
          make go/deadcode

  security:
    name: Code security scanning alerts
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/golang@b98d498629f1c368650224d6d212bf7dfa89e4bf # v0.4.0
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_API_TOKEN }}
        with:
          args: --severity-threshold=high

  markdown-lint:
    name: Lint markdown files
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Lint markdown files
        uses: articulate/actions-markdownlint@87f495d21507d6844dc917a01e742eaaa45049c0 # v1.1.0
        with:
          config: .markdownlint.json
          # renovate depName=github.com/igorshubovych/markdownlint-cli
          version: v0.39.0

  check-uncommitted-doc-changes:
    name: Check uncommitted changes in api docs action
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version-file: "${{ github.workspace }}/go.mod"
      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
      - name: Run make doc to see uncommitted changes
        run: make doc
      - name: Check for uncommitted changes
        id: check-changes
        uses: mskri/check-uncommitted-changes-action@2b152539dd033c3a26e0dd1d8b9a0c8e4d3a8a19 # v1.0.1
      - name: Evaluate if there are changes
        if: steps.check-changes.outputs.outcome == failure()
        run: echo "There are uncommitted changes"

  prepare:
    name: Prepare properties
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Prepare build parameters
        id: prep
        run: |
          hack/build/ci/prepare-build-variables.sh
      - name: Docker metadata
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
        id: meta
        with:
          images: dynatrace/dynatrace-operator
          tags: ${{ steps.prep.outputs.docker_image_tag }}
          labels: |
            ${{ steps.prep.outputs.docker_image_labels }}
            vcs-ref=${{ github.sha }}
      - name: Prepare build parameters
        id: prepenv
        run: |
          # Set output parameters.
          # Reason: global envs do not work in workflow calls
          # More info: https://github.com/actions/runner/issues/480#issuecomment-1021278915

          echo "registry=${{ env.DOCKER_REGISTRY }}" >> "$GITHUB_OUTPUT"
          echo "repository=${{ env.DOCKER_REPOSITORY }}" >> "$GITHUB_OUTPUT"
    outputs:
      labels: ${{ steps.meta.outputs.labels }}
      version: ${{ steps.prep.outputs.docker_image_tag }}
      registry: ${{ steps.prepenv.outputs.registry }}
      repository: ${{ steps.prepenv.outputs.repository }}

  build:
    name: Build images
    runs-on: ubuntu-latest
    needs: [prepare, tests, linting]
    strategy:
      matrix:
        platform: [amd64, arm64, ppc64le]
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Build image
        if: matrix.platform == 'amd64' || github.ref_protected
        uses: ./.github/actions/build-image
        with:
          platform: ${{ matrix.platform }}
          labels: ${{ needs.prepare.outputs.labels }}
          image-tag: ${{ needs.prepare.outputs.version }}

  push:
    name: Push images
    runs-on: ubuntu-latest
    needs: [prepare, build]
    strategy:
      matrix:
        platform: [amd64, arm64, ppc64le]
    if: ${{ !github.event.pull_request.head.repo.fork }}
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Login to Registry
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}
      - name: Upload Image
        if: matrix.platform == 'amd64' || github.ref_protected
        uses: ./.github/actions/upload-image
        with:
          platform: ${{ matrix.platform }}
          labels: ${{ needs.prepare.outputs.labels }}
          version: ${{ needs.prepare.outputs.version }}
          registry: ${{ needs.prepare.outputs.registry }}
          repository: ${{ needs.prepare.outputs.repository }}

  manifest:
    name: Create manifest
    needs: [prepare, push]
    runs-on: ubuntu-latest
    env:
      COMBINED: ${{ github.ref_protected }}
    if: ${{ !github.event.pull_request.head.repo.fork }}
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Login to Registry
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}
      - name: Create Manifests
        uses: ./.github/actions/create-manifests
        with:
          version: ${{ needs.prepare.outputs.version }}
          registry: ${{ needs.prepare.outputs.registry }}
          repository: ${{ needs.prepare.outputs.repository }}
          combined: ${{ env.COMBINED }}