name: e2e-byodb-tests

on:

workflow_call:

inputs:

tag:

description: Image tag to test.

type: string

required: true

should-run:

description: true if should really run the job. false - otherwise, i.e. the job should be skipped.

type: boolean

required: true

workflow_dispatch:

inputs:

tag:

description: Image tag to test.

type: string

required: true

permissions:

contents: read

pull-requests: read

defaults:

run:

shell: bash

jobs:

gke-byodb-qa-e2e-tests:

if: github.event_name == 'workflow_dispatch' || inputs.should-run

runs-on: ubuntu-24.04

env:

MAIN_IMAGE_TAG: ${{ inputs.tag }}

BUILD_TAG: ${{ inputs.tag }}

GCP_SERVICE_ACCOUNT_STACKROX_CI: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

CI_JOB_NAME: gke-byodb-qa-e2e-tests

ARTIFACT_DIR: ./junit-reports

LOAD_BALANCER: lb

ORCHESTRATOR_FLAVOR: k8s

KUBERNETES_PROVIDER: gke

SCANNER_V4_DB_STORAGE_CLASS: stackrox-gke-ssd

POSTGRES_VERSION: "17"

LONGTERM_LICENSE: "unused"

BYODB_TEST: "true"

# roxctl helm values pin scannerV4.disable=true unless this is set.

ROX_SCANNER_V4: "true"

ROX_RISK_REPROCESSING_INTERVAL: "15s"

ROX_SENSOR_CONNECTION_RETRY_MAX_INTERVAL: "30s"

PYTHONUNBUFFERED: "1"

timeout-minutes: 361

steps:

- name: Checkout repo

uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7.0.0

with:

fetch-depth: 0

ref: ${{ github.event.pull_request.head.sha || github.sha }}

persist-credentials: false

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Docker login to Quay.io

env:

REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}

REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}

run: docker login -u "${REGISTRY_USERNAME}" --password-stdin quay.io <<<"${REGISTRY_PASSWORD}"

- name: Set up Cloud SDK

uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # ratchet:google-github-actions/setup-gcloud@v3

with:

install_components: "gke-gcloud-auth-plugin,beta"

- name: Create GKE cluster

env:

MACHINE_TYPE: e2-standard-8

NUM_NODES: "1"

GKE_SPOT: "false"

timeout-minutes: 20

run: |

scripts/ci/gke.sh provision_gke_cluster byodb

echo "KUBECONFIG=${HOME}/.kube/config" >> "$GITHUB_ENV"

- name: Build roxctl

run: |

make roxctl_linux-amd64

sudo cp bin/linux_amd64/roxctl /usr/local/bin/roxctl

echo "${HOME}/go/bin" >> "$GITHUB_PATH"

- name: Verify kubectl access and wait for cluster to stabilize

timeout-minutes: 5

run: |

kubectl cluster-info

kubectl get nodes

scripts/ci/gke.sh wait_for_cluster

- name: Create artifact directory

run: mkdir -p "$ARTIFACT_DIR"

- name: Retrieve roxie version from repository

id: roxie-version

run: echo "version=$(cat ROXIE_VERSION)" >> "$GITHUB_OUTPUT"

- name: Install roxie

uses: stackrox/actions/roxie/install-cli@bcda9b2d6d2b644c267e699479656973e84ef7fa # ratchet:stackrox/actions@v1

with:

version: "v${{ steps.roxie-version.outputs.version }}"

gh-token: ${{ github.token }}

- name: Run pre-test

shell: python

env:

QUAY_RHACS_ENG_BEARER_TOKEN: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }}

QUAY_RHACS_ENG_RO_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}

QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}

run: |

import sys

sys.path.append('.openshift-ci')

from pre_tests import PreSystemTests

PreSystemTests().run()

- name: Run BYODB test

env:

QUAY_RHACS_ENG_RO_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}

QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}

REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}

REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}

AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}

AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

AWS_ECR_REGISTRY_REGION: ${{ secrets.AWS_ECR_REGISTRY_REGION }}

AWS_ECR_REGISTRY_NAME: ${{ secrets.AWS_ECR_REGISTRY_NAME }}

AWS_ASSUME_ROLE_ACCESS_KEY_ID: ${{ secrets.AWS_ASSUME_ROLE_ACCESS_KEY_ID }}

AWS_ASSUME_ROLE_SECRET_ACCESS_KEY: ${{ secrets.AWS_ASSUME_ROLE_SECRET_ACCESS_KEY }}

AWS_ASSUME_ROLE_ROLE_ID: ${{ secrets.AWS_ASSUME_ROLE_ROLE_ID }}

AWS_ASSUME_ROLE_EXTERNAL_ID: ${{ secrets.AWS_ASSUME_ROLE_EXTERNAL_ID }}

AWS_ASSUME_ROLE_TEST_CONDITION_ID: ${{ secrets.AWS_ASSUME_ROLE_TEST_CONDITION_ID }}

AZURE_REGISTRY_PASSWORD: ${{ secrets.AZURE_REGISTRY_PASSWORD }}

GOOGLE_CREDENTIALS_GCR_SCANNER_V2: ${{ secrets.GOOGLE_CREDENTIALS_GCR_SCANNER_V2 }}

GOOGLE_CREDENTIALS_GCR_NO_ACCESS_KEY_V2: ${{ secrets.GOOGLE_CREDENTIALS_GCR_NO_ACCESS_KEY_V2 }}

GOOGLE_ARTIFACT_REGISTRY_SERVICE_ACCOUNT_V2: ${{ secrets.GOOGLE_ARTIFACT_REGISTRY_SERVICE_ACCOUNT_V2 }}

GHCR_REGISTRY_USER: ${{ secrets.GHCR_REGISTRY_USER }}

GHCR_REGISTRY_PASSWORD: ${{ secrets.GHCR_REGISTRY_PASSWORD }}

QUAY_RHACS_ENG_BEARER_TOKEN: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }}

REDHAT_USERNAME: ${{ secrets.RH_REGISTRY_USERNAME_RO }}

REDHAT_PASSWORD: ${{ secrets.RH_REGISTRY_PASSWORD_RO }}

SLACK_FIXABLE_VULNS_CHANNEL: ${{ secrets.SLACK_FIXABLE_VULNS_CHANNEL }}

SLACK_MAIN_WEBHOOK: ${{ secrets.SLACK_MAIN_WEBHOOK }}

SLACK_ALT_WEBHOOK: ${{ secrets.SLACK_ALT_WEBHOOK }}

OCM_OFFLINE_TOKEN: ${{ secrets.OCM_OFFLINE_TOKEN }}

CLOUD_SOURCES_TEST_OCM_CLIENT_ID: ${{ secrets.CLOUD_SOURCES_TEST_OCM_CLIENT_ID }}

CLOUD_SOURCES_TEST_OCM_CLIENT_SECRET: ${{ secrets.CLOUD_SOURCES_TEST_OCM_CLIENT_SECRET }}

BUILD_ID: ${{ github.run_id }}

USE_ROXIE_DEPLOY: true

timeout-minutes: 245

run: tests/byodb/run.sh /tmp/byodb-test-logs

- name: Persist env vars for post-test

if: always()

run: |

source tests/e2e/lib.sh

wait_for_api

echo "API_ENDPOINT=${API_ENDPOINT}" >> "$GITHUB_ENV"

echo "ROX_ADMIN_PASSWORD=$(cat deploy/k8s/central-deploy/password)" >> "$GITHUB_ENV"

- name: Run post-test

if: always()

shell: python

env:

ROX_USERNAME: admin

run: |

import os, sys

sys.path.append('.openshift-ci')

from post_tests import PostClusterTest

post = PostClusterTest(

collect_central_artifacts=False,

)

if os.environ.get("ORCHESTRATOR_FLAVOR") == "k8s":

post.openshift_namespaces = []

post.run(['/tmp/byodb-test-logs', '${{ env.ARTIFACT_DIR }}'])

- name: Run final-post

if: always()

shell: python

run: |

import sys

sys.path.append('.openshift-ci')

from post_tests import FinalPost

FinalPost(store_qa_tests_data=False).run()

- name: Teardown GKE cluster

if: always()

continue-on-error: true

run: |

if [[ -z "${CLUSTER_NAME:-}" ]]; then

echo "No cluster to teardown"

exit 0

fi

if ! scripts/ci/gke.sh teardown_gke_cluster false; then

echo "::warning::WARNING: Could not tear down cluster ${CLUSTER_NAME}. See Teardown step logs for details."

exit 6

fi

- name: Publish summary for failed tests

uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2

if: always()

with:

paths: ${{ env.ARTIFACT_DIR }}/**/*.xml

show: "fail"

- name: Publish summary for passed and skipped tests

uses: test-summary/action@37b508cfee6d4d080eedd00b5bb240a6a784a6a5 # ratchet:test-summary/action@v2

if: always()

with:

paths: ${{ env.ARTIFACT_DIR }}/**/*.xml

show: "pass, skip"

- name: Report junit failures in jira

if: (!cancelled())

id: junit2jira

uses: ./.github/actions/junit2jira

with:

create-jiras: ${{ github.event_name == 'push' }}

jira-user: ${{ secrets.JIRA_USER }}

jira-token: ${{ secrets.JIRA_TOKEN }}

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

directory: ${{ env.ARTIFACT_DIR }}