presubmit.yml

# Copyright 2024 EngFlow Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Presubmit checks for PRs
name: "presubmit"

on:
  workflow_dispatch:
  # Trigger on pull request rather than push, so that we can control whether
  # checks are run on a given PR (allowing checks to run automatically on PR
  # updates from third parties can be a security issue).
  pull_request:

concurrency:
  group: ${{ github.workflow }}.${{ github.ref }}
  cancel-in-progress: true

env:
  # Recommended here: https://github.com/bazelbuild/bazelisk/issues/88#issuecomment-625178467
  BAZELISK_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  CLUSTER_HOST: opal.cluster.engflow.com
  CLUSTER_CONFIG: opal
  CRED_HELPER_TOKEN: ${{ secrets.OPAL_CRED_HELPER_TOKEN }}
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  # TODO(OND-616): use remote execution and caching for all CI Runner jobs.
  bazel-builder:
    runs-on:
      - self-hosted
      - os=linux
      - arch=x64
      - "engflow-container-image=docker://645088952840.dkr.ecr.eu-west-1.amazonaws.com/engflow-ci/debian12-dind-x64@sha256:763903935682de148b4e09fe1d7ef3bbc4ec829d59c3f41cb9519984639eaa06"
      - "engflow-pool=ci_sysbox_x64"
      - "engflow-runtime=sysbox-runc"
      - "engflow-runner-id=${{ github.repository_id }}_bazel-builder_${{ github.run_id }}_${{ github.run_number }}_${{ github.run_attempt }}"
    timeout-minutes: 10

    env:
      ARCH: "x64"
      OS: "linux"

    steps:
      - uses: actions/checkout@v4

      - name: Log in
        run: infra/login.sh

      - name: Run all tests
        if: success()
        run: |
          # TODO(CUS-345): Enable remote execution
          bazel test --config=noninteractive --config="${CLUSTER_CONFIG}" //...

      - name: Log out
        run: infra/logout.sh

  golang-builder:
    runs-on:
      - self-hosted
      - "os=${{ matrix.os }}"
      - "arch=${{ matrix.arch }}"
      - "os_distribution=${{ matrix.os_distribution }}"
      - "os_version=${{ matrix.os_version }}"
      - "revision=${{ matrix.revision }}"
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: "macos"
            arch: "x64"
            os_distribution: "monterey"
            os_version: "12"
            revision: "d04e89854b3931f4aaced77aa3a2fcad5834b3a6"

          - os: "windows"
            arch: "x64"
            os_distribution: "server"
            os_version: "2022"
            revision: "d04e89854b3931f4aaced77aa3a2fcad5834b3a6"

    env:
      ARCH: "${{ matrix.arch }}"
      OS: "${{ matrix.os }}"

    steps:
      - uses: actions/checkout@v4

      - name: Log in
        shell: bash
        run: infra/login.sh

      - name: Run all tests
        if: success()
        shell: bash
        run: |
          # TODO(CUS-345): Enable remote execution
          bazel run --config=noninteractive --config="${CLUSTER_CONFIG}" @rules_go//go -- test ./...
          bazel run --config=noninteractive --config="${CLUSTER_CONFIG}" @rules_go//go -- clean -cache -modcache

      - name: Log out
        shell: bash
        run: infra/logout.sh

  golang-builder-ci-runners:
    runs-on:
      - self-hosted
      - os=linux
      - arch=x64
      - "engflow-container-image=docker://645088952840.dkr.ecr.eu-west-1.amazonaws.com/engflow-ci/debian12-dind-x64@sha256:763903935682de148b4e09fe1d7ef3bbc4ec829d59c3f41cb9519984639eaa06"
      - "engflow-pool=ci_sysbox_x64"
      - "engflow-runtime=sysbox-runc"
      - "engflow-runner-id=${{ github.repository_id }}_golang-builder-ci-runners_${{ github.run_id }}_${{ github.run_number }}_${{ github.run_attempt }}"
    timeout-minutes: 10

    env:
      ARCH: "x64"
      OS: "linux"

    steps:
      - uses: actions/checkout@v4

      - name: Log in
        run: infra/login.sh

      - name: Run all tests
        if: success()
        run: |
          # TODO(CUS-345): Enable remote execution
          bazel run --config=noninteractive --config="${CLUSTER_CONFIG}" @rules_go//go -- test ./...
          bazel run --config=noninteractive --config="${CLUSTER_CONFIG}" @rules_go//go -- clean -cache -modcache

      - name: Log out
        run: infra/logout.sh

  copyright-headers-check:
    runs-on:
      - self-hosted
      - os=linux
      - arch=x64
      - "engflow-container-image=docker://645088952840.dkr.ecr.eu-west-1.amazonaws.com/engflow-ci/debian12-dind-x64@sha256:763903935682de148b4e09fe1d7ef3bbc4ec829d59c3f41cb9519984639eaa06"
      - "engflow-pool=ci_sysbox_x64"
      - "engflow-runtime=sysbox-runc"
      - "engflow-runner-id=${{ github.repository_id }}_copyright-headers-check_${{ github.run_id }}_${{ github.run_number }}_${{ github.run_attempt }}"
    timeout-minutes: 10

    env:
      ARCH: "x64"
      OS: "linux"

    steps:
      - uses: actions/checkout@v4

      - name: Log in
        run: infra/login.sh

      - name: Check copyright headers
        if: success()
        run: |
          bazel run --config=noninteractive --config="${CLUSTER_CONFIG}" //infra/internal/check_copyright_headers

      - name: Log out
        run: infra/logout.sh