release-testing.yml

name: Release Testing

on:
  push:
    branches:
      - "hotfix-*"
      - "rc--*"
  workflow_dispatch:

# new commits interrupt any running workflow on the same branch
concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true

permissions:
  actions: write
  contents: read
  id-token: write
  pull-requests: read

env:
  CI_COMMIT_SHA: ${{ github.sha }}
  CI_JOB_NAME: ${{ github.job }}
  CI_PROJECT_DIR: ${{ github.workspace }}
  BRANCH_NAME: ${{ github.event.workflow_run.head_branch || github.ref_name }}
  CI_RUN_ID: ${{ github.run_id }}

jobs:
  # Run some extra system tests that are skipped on CI Main.
  # Those test suites would overwhelm a runner, so each is run
  # as a separate job.
  release-system-tests:
    name: Release System Tests
    runs-on:
      group: dm1
      labels: dind-large
    container: &container-setup
      image: ghcr.io/dfinity/ic-build@sha256:65ab9023792784e8e13dbdd5b9a63c2dff0cd38237afd1cdbc299577505d4b88
      options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
    timeout-minutes: 180
    steps:
      - &checkout
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.workflow_run.head_branch }}
      - uses: ./.github/actions/netrc
      - name: Run Bazel System Tests
        uses: ./.github/actions/bazel
        with:
          run: |
            bazel test \
              --config=stamped \
              --config=flaky_retry \
              --test_tag_filters=system_test_large,-local_system_test \
              //rs/tests/... \
              --keep_going
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

  ci-main:
    name: CI Main
    uses: ./.github/workflows/ci-main.yml
    secrets: inherit
    with:
      commit-sha: ${{ github.sha }}
      release-build: 'true'

  setup-guest-os-qualification:
    name: Setting up guest os qualification pipeline
    runs-on: &dind-large-setup
      labels: dind-large
    container: *container-setup
    timeout-minutes: 180
    outputs:
      matrix: ${{ steps.generate.outputs.output }}
    steps:
      - name: Sparse checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.workflow_run.head_branch }}
          sparse-checkout: "ci/scripts/determine-initial-guest-os-versions.py"
      - id: generate
        name: Fetch beginning versions for qualification
        shell: bash
        run: |
          set -euo pipefail
          OUTPUT=$(python3 ci/scripts/determine-initial-guest-os-versions.py)
          echo "output=$OUTPUT" >> $GITHUB_OUTPUT

  guest-os-qualification:
    name: Qualifying ${{ matrix.version }} -> ${{ github.sha }}
    needs: setup-guest-os-qualification
    strategy:
      matrix: ${{ fromJson(needs.setup-guest-os-qualification.outputs.matrix) }}
    runs-on: *dind-large-setup
    container: *container-setup
    timeout-minutes: 180
    steps:
      - *checkout
      - uses: ./.github/actions/netrc
      - name: Run qualification for version ${{ matrix.version }} from the tip of the branch
        uses: ./.github/actions/bazel
        with:
          bazel-bep-artifact-name: ${{ github.job }}-${{ matrix.version }}-${{ github.action }}-bep
          run: |
            bazel test \
              --config=stamped \
              --config=flaky_retry \
              --test_tag_filters= \
              //rs/tests/dre:guest_os_qualification_colocate \
              --test_env=OLD_VERSION=${{ matrix.version }} \
              --keep_going --test_timeout=7200
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

  repro-check:
    name: Repro check for ${{ github.sha }}
    uses: ./.github/workflows/repro-check.yml
    needs: [ci-main]
    with:
      github_sha: ${{ github.sha }}