name: Pull Request

env:

# TODO: unhardcode this

REGISTRY: iad.ocir.io/idyksih5sir9/cozystack

on:

pull_request:

types: [opened, synchronize, reopened]

# Cancel in‑flight runs for the same PR when a new push arrives.

concurrency:

group: pr-${{ github.workflow }}-${{ github.event.pull_request.number }}

cancel-in-progress: true

jobs:

detect-changes:

name: Detect changes

runs-on: ubuntu-latest

outputs:

code: ${{ steps.filter.outputs.code }}

steps:

- uses: dorny/paths-filter@v3

id: filter

with:

filters: |

code:

- '!docs/**'

build:

name: Build

runs-on: [self-hosted]

timeout-minutes: 30

permissions:

contents: read

packages: write

needs: ["detect-changes"]

# Never run when the PR carries the "release" label or only docs changed.

if: |

needs.detect-changes.outputs.code == 'true'

&& !contains(github.event.pull_request.labels.*.name, 'release')

steps:

- name: Checkout code

uses: actions/checkout@v4

with:

fetch-depth: 0

fetch-tags: true

- name: Run unit tests

run: make unit-tests

- name: Run controller Go tests

run: make test-controllers

- name: Set up Docker config

run: |

if [ -d ~/.docker ]; then

cp -r ~/.docker "${{ runner.temp }}/.docker"

fi

- name: Login to GitHub Container Registry

if: ${{ !github.event.pull_request.head.repo.fork }}

uses: docker/login-action@v3

with:

username: ${{ secrets.OCIR_USER}}

password: ${{ secrets.OCIR_TOKEN }}

registry: iad.ocir.io

env:

DOCKER_CONFIG: ${{ runner.temp }}/.docker

- name: Build

run: make build

env:

DOCKER_CONFIG: ${{ runner.temp }}/.docker

# Unique per (PR, commit) so concurrent PR builds never push the same

# tag. PUBLISH_VERSIONED/PUBLISH_FLOATING stay off — PR images are

# consumed by digest, and :latest belongs to release builds.

IMAGE_TAG: pr-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}

PUBLISH_VERSIONED: '0'

PUBLISH_FLOATING: '0'

- name: Build Talos image

run: make -C packages/core/talos talos-nocloud

- name: Save git diff as patch

if: "!contains(github.event.pull_request.labels.*.name, 'release')"

run: git diff HEAD > _out/assets/pr.patch

- name: Upload git diff patch

if: "!contains(github.event.pull_request.labels.*.name, 'release')"

uses: actions/upload-artifact@v4

with:

name: pr-patch

path: _out/assets/pr.patch

- name: Upload Talos image

uses: actions/upload-artifact@v4

with:

name: talos-image

path: _out/assets/nocloud-amd64.raw.xz

resolve_assets:

name: "Resolve assets"

runs-on: ubuntu-latest

if: contains(github.event.pull_request.labels.*.name, 'release')

outputs:

disk_id: ${{ steps.fetch_assets.outputs.disk_id }}

steps:

- name: Generate GitHub App token

id: app-token

uses: actions/create-github-app-token@v1

with:

app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}

private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}

owner: cozystack

- name: Checkout code

if: contains(github.event.pull_request.labels.*.name, 'release')

uses: actions/checkout@v4

with:

fetch-depth: 0

fetch-tags: true

- name: Extract tag from PR branch (release PR)

if: contains(github.event.pull_request.labels.*.name, 'release')

id: get_tag

uses: actions/github-script@v7

with:

script: |

const branch = context.payload.pull_request.head.ref;

const m = branch.match(/^release-(\d+\.\d+\.\d+(?:[-\w\.]+)?)$/);

if (!m) {

core.setFailed(`❌ Branch '${branch}' does not match 'release-X.Y.Z[-suffix]'`);

return;

}

core.setOutput('tag', `v${m[1]}`);

- name: Find draft release & asset IDs (release PR)

if: contains(github.event.pull_request.labels.*.name, 'release')

id: fetch_assets

uses: actions/github-script@v7

with:

github-token: ${{ steps.app-token.outputs.token }}

script: |

const tag = '${{ steps.get_tag.outputs.tag }}';

const releases = await github.rest.repos.listReleases({

owner: context.repo.owner,

repo: context.repo.repo,

per_page: 100

});

const draft = releases.data.find(r => r.tag_name === tag && r.draft);

if (!draft) {

core.setFailed(`Draft release '${tag}' not found`);

return;

}

const find = (n) => draft.assets.find(a => a.name === n)?.id;

const diskId = find('nocloud-amd64.raw.xz');

if (!diskId) {

core.setFailed('Required assets missing in draft release');

return;

}

core.setOutput('disk_id', diskId);

e2e:

name: "E2E Tests"

runs-on: ${{ contains(github.event.pull_request.labels.*.name, 'debug') && 'self-hosted' || 'oracle-vm-24cpu-96gb-x86-64' }}

#runs-on: [oracle-vm-32cpu-128gb-x86-64]

timeout-minutes: 180

permissions:

contents: read

packages: read

checks: write

needs: ["build", "resolve_assets"]

if: ${{ always() && (needs.build.result == 'success' || needs.resolve_assets.result == 'success') }}

steps:

- name: Generate GitHub App token

if: contains(github.event.pull_request.labels.*.name, 'release')

id: app-token

uses: actions/create-github-app-token@v1

with:

app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}

private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}

owner: cozystack

# ▸ Checkout and prepare the codebase

- name: Checkout code

uses: actions/checkout@v4

# ▸ Regular PR path – download artefacts produced by the *build* job

- name: "Download Talos image (regular PR)"

if: "!contains(github.event.pull_request.labels.*.name, 'release')"

uses: actions/download-artifact@v4

with:

name: talos-image

path: _out/assets

- name: Download PR patch

if: "!contains(github.event.pull_request.labels.*.name, 'release')"

uses: actions/download-artifact@v4

with:

name: pr-patch

path: _out/assets

- name: Apply patch

if: "!contains(github.event.pull_request.labels.*.name, 'release')"

run: |

git apply _out/assets/pr.patch

# ▸ Release PR path – fetch artefacts from the corresponding draft release

- name: Download assets from draft release (release PR)

if: contains(github.event.pull_request.labels.*.name, 'release')

run: |

mkdir -p _out/assets

curl -sSL -H "Authorization: token ${APP_TOKEN}" -H "Accept: application/octet-stream" \

-o _out/assets/nocloud-amd64.raw.xz \

"https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/assets/${{ needs.resolve_assets.outputs.disk_id }}"

env:

APP_TOKEN: ${{ steps.app-token.outputs.token }}

- name: Set sandbox ID

run: echo "SANDBOX_NAME=cozy-e2e-sandbox-$(echo "${GITHUB_REPOSITORY}:${GITHUB_WORKFLOW}:${GITHUB_REF}" | sha256sum | cut -c1-10)" >> $GITHUB_ENV

# ▸ Prepare environment

- name: Prepare workspace

run: |

rm -rf /tmp/$SANDBOX_NAME

cp -r ${{ github.workspace }} /tmp/$SANDBOX_NAME

- name: Prepare environment

run: |

cd /tmp/$SANDBOX_NAME

attempt=0

until make SANDBOX_NAME=$SANDBOX_NAME prepare-env; do

attempt=$((attempt + 1))

if [ $attempt -ge 3 ]; then

echo "❌ Attempt $attempt failed, exiting..."

exit 1

fi

echo "❌ Attempt $attempt failed, retrying..."

done

echo "✅ The task completed successfully after $attempt attempts"

# ▸ Install Cozystack

- name: Install Cozystack into sandbox

run: |

cd /tmp/$SANDBOX_NAME

attempt=0

until make -C packages/core/testing SANDBOX_NAME=$SANDBOX_NAME install-cozystack; do

attempt=$((attempt + 1))

if [ $attempt -ge 3 ]; then

echo "❌ Attempt $attempt failed, exiting..."

exit 1

fi

echo "❌ Attempt $attempt failed, retrying..."

done

echo "✅ The task completed successfully after $attempt attempts"

- name: Run OpenAPI tests

run: |

cd /tmp/$SANDBOX_NAME

make -C packages/core/testing SANDBOX_NAME=$SANDBOX_NAME test-openapi

# ▸ Run E2E tests

- name: Run E2E tests

id: e2e_tests

run: |

cd /tmp/$SANDBOX_NAME

failed_tests=""

for app in $(ls hack/e2e-apps/*.bats | xargs -n1 basename | cut -d. -f1); do

echo "::group::Testing $app"

attempt=0

success=false

until [ $attempt -ge 3 ]; do

if make -C packages/core/testing SANDBOX_NAME=$SANDBOX_NAME test-apps-$app; then

success=true

break

fi

attempt=$((attempt + 1))

echo "❌ Attempt $attempt failed, retrying..."

done

if [ "$success" = true ]; then

echo "✅ Test $app completed successfully"

else

echo "❌ Test $app failed after $attempt attempts"

failed_tests="$failed_tests $app"

fi

echo "::endgroup::"

done

if [ -n "$failed_tests" ]; then

echo "❌ Failed tests:$failed_tests"

exit 1

fi

echo "✅ All E2E tests passed"

# ▸ Collect debug information (always runs)

- name: Collect report

if: always()

run: |

cd /tmp/$SANDBOX_NAME

make -C packages/core/testing SANDBOX_NAME=$SANDBOX_NAME collect-report || true

- name: Upload cozyreport.tgz

if: always()

uses: actions/upload-artifact@v4

with:

name: cozyreport

path: /tmp/${{ env.SANDBOX_NAME }}/_out/cozyreport.tgz

- name: Collect images list

if: always()

run: |

cd /tmp/$SANDBOX_NAME

make -C packages/core/testing SANDBOX_NAME=$SANDBOX_NAME collect-images || true

- name: Upload image list

if: always()

uses: actions/upload-artifact@v4

with:

name: image-list

path: /tmp/${{ env.SANDBOX_NAME }}/_out/images.txt

# ▸ Open an SSH breakpoint to the failing sandbox so maintainers can attach,

# inspect Talos/Cozystack state and resume with `breakpoint resume`.

#

# Gated by the `debug` or `release` label (release PRs are bot-created,

# so their presence implies maintainer authorship). authorized-users is

# kept as a second defense layer at the breakpoint level.

#

# Uses cozystack/breakpoint-action (fork of namespacelabs/breakpoint-action)

# pinned by SHA. The fork adds: pause-idle mode (initial grace period for

# the first SSH connection, idle-aware exit afterwards), endpoint output

# and ::notice:: annotation, and a dedicated Check Run "Breakpoint Open"

# that carries the SSH endpoint in output.summary while the breakpoint is

# paused (conclusion=failure → standard ✗ in `gh pr checks`; updated to

# conclusion=success when the breakpoint exits).

#

# Configured via the BREAKPOINT_ENDPOINT repository variable — in fork

# PRs repository variables are not exposed, so the step is skipped and

# forks cannot reach the self-hosted rendezvous server.

- name: Breakpoint on E2E failure

if: |

failure() &&

vars.BREAKPOINT_ENDPOINT != '' &&

(contains(github.event.pull_request.labels.*.name, 'debug')

|| contains(github.event.pull_request.labels.*.name, 'release'))

# cozystack/breakpoint-action v2-cozy.1

# mode: pause-idle defaults: grace-period=20m, idle-timeout=10m

uses: cozystack/breakpoint-action@a6f3a6f87be398ad63b6577351e3398e53f578e4

with:

mode: pause-idle

endpoint: ${{ vars.BREAKPOINT_ENDPOINT }}

authorized-users: androndo, Arsolitt, IvanHunters, kvaps, lexfrei, lllamnyp, mattia-eleuteri, matthieu-robin, myasnikovdaniil, sircthulhu, tym83

check-run-name: "Breakpoint Open"

github-token: ${{ github.token }}

check-run-summary-template: |

## 🔴 SSH breakpoint open — paused for debug

```

{endpoint}

```

Enter the e2e sandbox after SSH:

```

docker exec -ti $(docker ps --filter name=cozy-e2e-sandbox -q | head -1) bash

export KUBECONFIG=/workspace/kubeconfig

```

Resume from inside: `breakpoint resume`. Otherwise the breakpoint

exits 10 minutes after the last SSH session disconnects.

# ▸ Tear down environment (always runs)

- name: Tear down sandbox

if: always()

run: make -C packages/core/testing SANDBOX_NAME=$SANDBOX_NAME delete || true

- name: Remove workspace

if: always()

run: rm -rf /tmp/$SANDBOX_NAME