tests.yml

---
name: Tests

# NOTE(mhayden): Restricting branches prevents jobs from being doubled since
# a push to a pull request triggers two events.
on:  # yamllint disable-line rule:truthy
  pull_request:
    branches:
      - "*"
  push:
    branches:
      - main
  # for merge queue
  merge_group:

jobs:
  unit-tests-fedora:
    strategy:
      matrix:
        fedora_version:
          - name: previous
            version: 43
          - name: current
            version: 44
            # Enable this when we get osbuild rpm builds for Fedora 44
            # - name: rawhide
            #   version: rawhide
            #   continue-on-error: true
      fail-fast: false  # if one fails, keep the other(s) running
    name: "🛃 Unit tests (Fedora ${{ matrix.fedora_version.name }})"
    runs-on: ubuntu-24.04
    container:
      image: registry.fedoraproject.org/fedora:${{ matrix.fedora_version.version }}
      options: --privileged
    continue-on-error: ${{ matrix.continue-on-error || false }}
    env:
      # workaround for expired cert at source of indirect dependency
      # (go.opencensus.io/trace)
      GOPROXY: "https://proxy.golang.org|direct"
    steps:
      - name: Check out code into the Go module directory
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          set-safe-directory: true

      - name: Install python3
        # The Fedora container doesn't have python3 installed by default
        run: dnf -y install python3

      - name: Set up repository for pinned osbuild commit
        run: ./test/scripts/setup-osbuild-repo

      - name: Install test dependencies
        run: ./test/scripts/install-dependencies

      - name: Mark the working directory as safe for git
        run: git config --global --add safe.directory "$(pwd)"

      - name: Run unit tests
        # Skip tests that resolve manifests from local container storage.
        # They are tested separately (see gitlab-ci.yml)
        run: go test -count=1 -race -timeout 20m ./... -test.skip 'TestBlockingResolverLocalManifest|TestResolverLocalManifest|TestGetManifestLocal'

      - name: Run depsolver tests with force-dnf to make sure it's not skipped
        run: go test -count=1 -race ./pkg/depsolvednf/... -force-dnf

      - name: Run depsolver tests with dnf5
        run: |
          sudo sed -i 's/"use_dnf5": false/"use_dnf5": true/' /usr/lib/osbuild/solver.json
          go test -count=1 -race ./pkg/depsolvednf/... -force-dnf

  unit-tests-cs:
    strategy:
      matrix:
        centos_stream:
          - version: 9
            image_tag: stream9
          - version: 10
            image_tag: stream10
      fail-fast: false  # if one fails, keep the other(s) running
    name: "🛃 Unit tests (CentOS Stream ${{ matrix.centos_stream.version }})"
    runs-on: ubuntu-24.04
    container:
      image: quay.io/centos/centos:${{ matrix.centos_stream.image_tag }}
      options: --privileged
    env:
      GOFLAGS: "-tags=exclude_graphdriver_btrfs"
      # workaround for expired cert at source of indirect dependency
      # (go.opencensus.io/trace)
      GOPROXY: "https://proxy.golang.org|direct"

    steps:
      - name: Install dnf plugins
        run: dnf -y install dnf-plugins-core

      - name: Enable crb repo
        run: dnf config-manager --set-enabled crb

      - name: Check out code into the Go module directory
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          set-safe-directory: true

      - name: Set up repository for pinned osbuild commit
        run: ./test/scripts/setup-osbuild-repo

      - name: Install build and test dependencies
        run: dnf -y install krb5-devel libvirt-devel gcc git-core go gpgme-devel osbuild-depsolve-dnf device-mapper-devel

      - name: Mark the working directory as safe for git
        run: git config --global --add safe.directory "$(pwd)"

      - name: Install openssl for cgo test below
        run: dnf -y install openssl

      - name: Run unit tests
        run: make test

  lint:
    name: "⌨ Lint"
    runs-on: ubuntu-24.04
    env:
      # workaround for expired cert at source of indirect dependency
      # (go.opencensus.io/trace)
      GOPROXY: "https://proxy.golang.org|direct"
    steps:
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version: "1.24.12"
        id: go

      - name: Check out code into the Go module directory
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          set-safe-directory: true

      - name: Apt update
        run: sudo apt update

      # This is needed to lint internal/upload/koji package
      - name: Install kerberos devel package
        run: sudo apt install -y libkrb5-dev

      # This is needed to lint pkg/cloud/libvirt package
      - name: Install libvirt devel package
        run: sudo apt install -y libvirt-dev

      # This is needed for the container resolver dependencies
      - name: Install libgpgme devel package
        run: sudo apt install -y libgpgme-dev libbtrfs-dev libdevmapper-dev podman

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: v2.8
          args: --verbose --timeout 5m0s

  shellcheck:
    name: "🐚 Shellcheck"
    runs-on: ubuntu-24.04
    env:
      # workaround for expired cert at source of indirect dependency
      # (go.opencensus.io/trace)
      GOPROXY: "https://proxy.golang.org|direct"
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          set-safe-directory: true
      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
        with:
          ignore: vendor  # We don't want to fix the code in vendored dependencies
        env:
          # don't check /etc/os-release sourcing, allow useless cats to live inside our codebase, and
          # allow seemingly unreachable commands
          SHELLCHECK_OPTS: -e SC1091 -e SC2002 -e SC2317

  python-test:
    name: "🐍 pytest (imgtestlib and test scripts)"
    runs-on: ubuntu-24.04
    env:
      # workaround for expired cert at source of indirect dependency
      # (go.opencensus.io/trace)
      GOPROXY: "https://proxy.golang.org|direct"
    container:
      image: registry.fedoraproject.org/fedora:latest
    steps:

      - name: Check out code into the Go module directory
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          set-safe-directory: true

      - name: Install build and test dependencies
        run: ./test/scripts/install-dependencies

      - name: Testing imgtestlib and test scripts
        run: |
          python3 -m pytest -v -k "not images_integration" ./test

  python-lint:
    name: "🐍 Lint (test scripts)"
    runs-on: ubuntu-24.04
    env:
      # workaround for expired cert at source of indirect dependency
      # (go.opencensus.io/trace)
      GOPROXY: "https://proxy.golang.org|direct"
    container:
      image: registry.fedoraproject.org/fedora:latest
    steps:

      - name: Check out code into the Go module directory
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          set-safe-directory: true

      - name: Install build and test dependencies
        run: |
          ./test/scripts/install-dependencies

      - name: Analysing the code with pylint
        run: |
          pylint --version
          pylint --recursive=y .

  yaml-checks:
    name: "YAML checks"
    runs-on: ubuntu-24.04
    steps:
      - name: Check out code
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          set-safe-directory: true

      - name: Install checkers
        run: |
          sudo apt update
          sudo apt install -y yamllint yq

      - name: Check YAML
        run: |
          tools/yaml-lint.sh

  cross-arch-integration-test:
    strategy:
      matrix:
        arch:
          # ppc64le disabled
          - s390x
      fail-fast: false  # if one fails, keep the other(s) running
    name: "Cross-arch qemu based image build/boot smoke test"
    runs-on: ubuntu-24.04
    env:
      # workaround for expired cert at source of indirect dependency
      # (go.opencensus.io/trace)
      GOPROXY: "https://proxy.golang.org|direct"
      GOFLAGS: "-buildvcs=false"
    container:
      image: registry.fedoraproject.org/fedora:44
      options: "--privileged"
    steps:
      - name: Check out code into the Go module directory
        uses: actions/checkout@v7
        with:
          set-safe-directory: true

      - name: Install python3
        # The Fedora container doesn't have python3 installed by default
        run: dnf -y install python3

      - name: Setup repository for pinned osbuild commit
        run: ./test/scripts/setup-osbuild-repo

      - name: Install osbuild dependencies
        run: dnf -y install osbuild osbuild-depsolve-dnf

      - name: Install build and test dependencies
        run: ./test/scripts/install-dependencies

      - name: Manually start qemu-user-static
        run: |
          # mostly for debugging
          mount | grep binfmt_misc || true
          ls /proc/sys/fs/binfmt_misc/
          sudo mount -t binfmt_misc none /proc/sys/fs/binfmt_misc
          ls /proc/sys/fs/binfmt_misc/
          sudo SYSTEMD_LOG_LEVEL=debug /usr/lib/systemd/systemd-binfmt
          ls /proc/sys/fs/binfmt_misc/
          sudo SYSTEMD_LOG_LEVEL=debug /usr/lib/systemd/systemd-binfmt /usr/lib/binfmt.d/qemu-*.conf
          ls /proc/sys/fs/binfmt_misc/

      - name: Cross arch integration test
        run: |
          sudo -E pytest -rs -k ${{ matrix.arch }} -s -v ./test/test_cross_arch_integration.py