name: e2e-dispatch

on:

push:

tags:

- '*'

branches:

- master

- release-*

pull_request:

types:

- opened

- reopened

- synchronize

- ready_for_review

permissions:

contents: read

pull-requests: read

defaults:

run:

shell: bash

jobs:

detect-changes:

uses: ./.github/workflows/detect-changes.yml

# Determines whether we should dispatch jobs that call real E2E workflows.

# This allows to skip running E2E tests on draft PRs without corresponding labels or on untrusted forks.

should-dispatch:

needs: [ detect-changes ]

runs-on: ubuntu-slim

outputs:

dispatch-any: ${{ steps.determine.outputs.dispatch-any }}

jobs: ${{ steps.determine.outputs.jobs }}

steps:

- name: Determine whether should dispatch workflows

id: determine

shell: python

env:

GH_TOKEN: ${{ github.token }}

PYTHONUNBUFFERED: "1"

input__event_name: ${{ github.event_name }}

input__is_fork: ${{ github.event.pull_request.head.repo.fork }}

input__is_draft: ${{ github.event.pull_request.draft }}

input__ui_only_change: ${{ needs.detect-changes.outputs.ui_only }}

input__repo: ${{ github.repository }}

input__pr_number: ${{ github.event.pull_request.number }}

run: |

import json

import os

import subprocess

from types import SimpleNamespace

input = SimpleNamespace(**{

key.removeprefix('input__'): val

for (key, val) in os.environ.items()

if key.startswith('input__')})

for k, v in vars(input).items():

print(f'{k} = {v}')

if input.event_name != 'pull_request':

all_labels = []

else:

p = subprocess.run(

['gh', 'pr', 'view', input.pr_number, '--repo', input.repo, '--json', 'labels', '--jq', '.labels[].name'],

check=True, encoding='utf-8', stdout=subprocess.PIPE, stdin=subprocess.DEVNULL)

all_labels = p.stdout.strip().splitlines()

print(f'all_labels = {", ".join(all_labels)}')

def should_run(job):

if input.is_fork == 'true':

return False

if input.event_name != 'pull_request':

return True

if input.ui_only_change == 'true':

# For now, all the workflows that we dispatch should be skipped for PRs that only change UI.

# As we add more E2E test workflows, we may want to make this more flexible.

return False

if input.is_draft != 'true':

return True

if job in all_labels:

return True

return False

with open(os.environ['GITHUB_OUTPUT'], mode='at', encoding='utf-8') as file:

def write(job, val):

line = f'{job}={val}'

print(line)

file.write(line + '\n')

jobs = { job: should_run(job) for job in [

'e2e-byodb-tests',

'e2e-db-backup-restore-test',

'e2e-gke-upgrade-tests',

'e2e-nongroovy-tests',

]}

write('jobs', json.dumps(jobs))

# dispatch_any==False is a shortcut to prevent executing the further workflow for draft PRs which don't

# qualify for running any actual e2e jobs.

# We must make sure that dispatch_any is True for non-drafts even if no actual jobs are to be dispatched

# (the case of UI-only PRs) because this lets GHA enter the corresponding workflows and skip the test jobs

# inside them "in proper way" that allows to satisfy branch protection rules.

dispatch_any = any(jobs.values()) or input.is_draft != 'true'

write('dispatch-any', str(dispatch_any).lower())

# Waits for images to be built so we don't start testing until they are available.

wait-for-images:

needs: [ should-dispatch ]

if: needs.should-dispatch.outputs.dispatch-any == 'true'

runs-on: ubuntu-slim

outputs:

tag: ${{ steps.build-tag.outputs.tag }}

operator_tag: ${{ steps.build-tag.outputs.operator_tag }}

## MAIN_IMAGE_TAG can be used for overriding when you want to run workflows for particular images.

# env:

# MAIN_IMAGE_TAG: 4.12.x-350-gc76d76b0fb

concurrency:

group: wait-for-images-${{ github.workflow }}-${{ github.head_ref || github.run_id }}

cancel-in-progress: true

steps:

- name: Checkout repo

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

fetch-depth: 0

ref: ${{ github.event.pull_request.head.sha || github.sha }}

persist-credentials: false

- uses: ./.github/actions/handle-tagged-build

- name: Compute build tag

id: build-tag

run: |

tag="${MAIN_IMAGE_TAG:-"$(make --quiet --no-print-directory tag)"}"

echo "tag=$tag" | tee -a "$GITHUB_OUTPUT" -a "$GITHUB_ENV"

echo "operator_tag=$(BUILD_TAG="${tag}" make -C operator --quiet --no-print-directory tag)" | tee -a "$GITHUB_OUTPUT" -a "$GITHUB_ENV"

- name: Wait for images

uses: stackrox/actions/release/wait-for-image@9238e423c3ae1ac4eb0f254cbb98da9daae24d86 # ratchet:stackrox/actions/release/wait-for-image@v1

with:

token: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }}

image: |

rhacs-eng/central-db:${{ env.tag }}

rhacs-eng/collector:${{ env.tag }}

rhacs-eng/fact:${{ env.tag }}

rhacs-eng/main:${{ env.tag }}

rhacs-eng/roxctl:${{ env.tag }}

rhacs-eng/scanner-db-slim:${{ env.tag }}

rhacs-eng/scanner-db:${{ env.tag }}

rhacs-eng/scanner-slim:${{ env.tag }}

rhacs-eng/scanner-v4-db:${{ env.tag }}

rhacs-eng/scanner-v4:${{ env.tag }}

rhacs-eng/scanner:${{ env.tag }}

rhacs-eng/stackrox-operator-bundle:v${{ env.operator_tag }}

rhacs-eng/stackrox-operator:${{ env.operator_tag }}

e2e-byodb-tests:

needs: [ wait-for-images, should-dispatch ]

uses: ./.github/workflows/e2e-byodb-tests.yaml

with:

tag: ${{ needs.wait-for-images.outputs.tag }}

should-run: ${{ fromJSON(needs.should-dispatch.outputs.jobs).e2e-byodb-tests }}

secrets: inherit

concurrency:

group: e2e-byodb-tests-${{ github.workflow }}-${{ github.head_ref || github.run_id }}

cancel-in-progress: true

e2e-db-backup-restore-test:

needs: [ wait-for-images, should-dispatch ]

uses: ./.github/workflows/e2e-db-backup-restore-test.yaml

with:

tag: ${{ needs.wait-for-images.outputs.tag }}

should-run: ${{ fromJSON(needs.should-dispatch.outputs.jobs).e2e-db-backup-restore-test }}

secrets: inherit

concurrency:

group: e2e-db-backup-restore-test-${{ github.workflow }}-${{ github.head_ref || github.run_id }}

cancel-in-progress: true

e2e-gke-upgrade-tests:

needs: [ wait-for-images, should-dispatch ]

uses: ./.github/workflows/e2e-gke-upgrade-tests.yaml

with:

tag: ${{ needs.wait-for-images.outputs.tag }}

should-run: ${{ fromJSON(needs.should-dispatch.outputs.jobs).e2e-gke-upgrade-tests }}

secrets: inherit

concurrency:

group: e2e-gke-upgrade-tests-${{ github.workflow }}-${{ github.head_ref || github.run_id }}

cancel-in-progress: true

e2e-nongroovy-tests:

needs: [ wait-for-images, should-dispatch ]

uses: ./.github/workflows/e2e-nongroovy-tests.yaml

with:

tag: ${{ needs.wait-for-images.outputs.tag }}

should-run: ${{ fromJSON(needs.should-dispatch.outputs.jobs).e2e-nongroovy-tests }}

secrets: inherit

concurrency:

group: e2e-nongroovy-tests-${{ github.workflow }}-${{ github.head_ref || github.run_id }}

cancel-in-progress: true