tests.yml

# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
name: Build and Run Apigee Migration Assessment Image

on:  # yamllint disable-line rule:truthy
  push:
    paths-ignore:
      - '**.md'
  pull_request:
    paths-ignore:
      - '**.md'
    branches:
      - main

permissions: read-all

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ghcr.io/${{ github.repository }}/apigee-migration-assessment-tool:latest

jobs:
  docker-build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and export to Docker
        uses: docker/build-push-action@v6
        with:
          load: true
          tags: ${{ env.IMAGE_NAME }}

      - name: Save the image as a tar archive
        run: docker save "$IMAGE_NAME" | gzip > image.tar.gz

      - name: Upload the image artifact
        uses: actions/upload-artifact@v4
        with:
          name: docker-image
          path: image.tar.gz

  test-opdk:
    runs-on: ubuntu-latest
    needs:
      - docker-build
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - id: 'auth'
        uses: 'google-github-actions/auth@v2'
        with:
          token_format: 'access_token'
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_POOL_PROVIDER_NAME }}
          service_account: ${{ secrets.SVC_ACCOUNT_EMAIL }}
          export_environment_variables: false

      - name: Fetch input.properties
        run: |
            echo ${{ secrets.OPDK_INPUT_PROPERTIES }} | base64 -d > ${{ github.workspace }}/input.properties

      - name: Download the image artifact
        uses: actions/download-artifact@v4
        with:
          name: docker-image

      - name: Load the image from the archive
        run: docker load < image.tar.gz

      - name: Run Docker container
        run: |
          docker run \
            -v ${{ github.workspace }}/input.properties:/app/input.properties \
            -e "SOURCE_AUTH_TOKEN=${{ secrets.APIGEE_OPDK_TOKEN }}" \
            -e "APIGEE_ACCESS_TOKEN=${{ steps.auth.outputs.access_token }}" \
            "$IMAGE_NAME" \
            --resources all

  publish-image:
    runs-on: ubuntu-latest
    needs:
      - docker-build
      - test-opdk
    permissions:
      id-token: write
      contents: write # needed to publish sbom
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log into registry ${{ env.REGISTRY }}
        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a #v2.1.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Download the image artifact
        uses: actions/download-artifact@v4
        with:
          name: docker-image

      - name: Load the image from the archive
        run: docker load < image.tar.gz

      - name: Run Docker container
        run: |
          docker push "$IMAGE_NAME"