ci.yml

name: Main CI

on:
  push:
    branches:
    - main
    - release-*
    tags:
    - '*'
  pull_request:
  schedule:
    - cron: '0 6 * * *'

concurrency:
  # append event name on the off chance that a push to master
  # runs at the same time as the nightlies - we want both to run
  group: ${{ github.head_ref || github.run_id }}-${{ github.event_name }}
  cancel-in-progress: true

jobs:
  basic:
    runs-on: ${{ (matrix.arch == 'arm64' && 'ubuntu-24.04-arm') || 'ubuntu-24.04' }}
    strategy:
      fail-fast: false
      matrix:
        arch:
          - amd64
          - arm64
        rust-version:
          - stable
          - nightly
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: true

    - name: Install dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y \
          libbpf-dev \
          protobuf-compiler

        rustup +${{ matrix.rust-version }} component add clippy

    - uses: actions/cache@v4
      with:
        path: |
          ~/.cargo/bin/
          ~/.cargo/registry/index/
          ~/.cargo/registry/cache/
          ~/.cargo/git/db/
          target/
        key: ${{ runner.os }}-${{ runner.arch }}-cargo-${{ matrix.rust-version }}-${{ hashFiles('**/Cargo.lock') }}

    - name: Build
      run: cargo +${{ matrix.rust-version }} build --release
    - name: Lint
      run: cargo +${{ matrix.rust-version }} clippy --all-targets --all-features -- -D warnings
    - name: Test
      run: cargo +${{ matrix.rust-version }} test


  coverage:
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: true

    - name: Install dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y \
          libbpf-dev \
          protobuf-compiler

    - uses: actions/cache@v4
      with:
        path: |
          ~/.cargo/bin/
          ~/.cargo/registry/index/
          ~/.cargo/registry/cache/
          ~/.cargo/git/db/
          target/
        key: ${{ runner.os }}-${{ runner.arch }}-cargo-coverage-${{ hashFiles('**/Cargo.lock') }}

    - name: Install cargo-llvm-cov
      run: |
        rustup component add llvm-tools
        cargo install --force cargo-llvm-cov

    - name: Generate coverage
      run: make coverage

    - name: Upload to Codecov
      uses: codecov/codecov-action@v5
      with:
        files: codecov.json
        token: ${{ secrets.CODECOV_TOKEN }}

  lint-tests:
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: true
    - uses: actions/setup-python@v5
      with:
        python-version: "3.14"
    - name: Lint
      run: |
        python3 -m venv .venv
        source .venv/bin/activate
        pip install ruff pyright
        pip install -r tests/requirements.txt
        make -C tests lint

  format-check:
    runs-on: ubuntu-24.04
    env:
      CLANG_FMT: clang-format-18
    steps:
    - uses: actions/checkout@v4
    - name: Check code format
      run: |
        rustup component add rustfmt
        pip install ruff
        make format-check

  vars:
    runs-on: ubuntu-24.04
    outputs:
      tag: ${{ steps.vars.outputs.tag }}
      stackrox-io-image: ${{ steps.vars.outputs.stackrox-io-image }}
      rhacs-eng-image: ${{ steps.vars.outputs.rhacs-eng-image }}
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: true
        fetch-depth: 0

    - id: vars
      run: |
        cat << EOF >> "$GITHUB_OUTPUT"
        tag=$(make tag)
        stackrox-io-image=$(make image-name)
        rhacs-eng-image=$(FACT_REGISTRY="quay.io/rhacs-eng/fact" make image-name)
        EOF

  container:
    needs:
      - vars
    strategy:
      fail-fast: false
      matrix:
        arch:
          - amd64
          - arm64
    runs-on: ${{ (matrix.arch == 'arm64' && 'ubuntu-24.04-arm') || 'ubuntu-24.04' }}
    env:
      FACT_TAG: ${{ needs.vars.outputs.tag }}-${{ matrix.arch }}
      FACT_VERSION: ${{ needs.vars.outputs.tag }}
      STACKROX_IO_IMAGE: ${{ needs.vars.outputs.stackrox-io-image }}-${{ matrix.arch }}
      RHACS_ENG_IMAGE: ${{ needs.vars.outputs.rhacs-eng-image }}-${{ matrix.arch }}
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: true

    - name: Build image
      run: DOCKER=podman make image

    - name: Login to quay.io/stackrox-io
      uses: docker/login-action@v3
      with:
        registry: quay.io
        username: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
        password: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}

    - run: podman push "${STACKROX_IO_IMAGE}"

    - name: Login to quay.io/rhacs-eng
      uses: docker/login-action@v3
      with:
        registry: quay.io
        username: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}
        password: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}

    - name: Tag and push to rhacs-eng
      run: |
        podman tag "${STACKROX_IO_IMAGE}" "${RHACS_ENG_IMAGE}"
        podman push "${RHACS_ENG_IMAGE}"

  manifest-stackrox-io:
    runs-on: ubuntu-24.04
    needs:
      - container
      - vars
    env:
      ARCHS: amd64 arm64
    steps:
      - uses: redhat-actions/podman-login@v1
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
          password: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}

      - name: Create multiarch manifest
        run: |
          podman manifest create ${{ needs.vars.outputs.stackrox-io-image }} \
            ${{ needs.vars.outputs.stackrox-io-image }}-amd64 \
            ${{ needs.vars.outputs.stackrox-io-image }}-arm64
          podman manifest inspect ${{ needs.vars.outputs.stackrox-io-image }}
          podman manifest push ${{ needs.vars.outputs.stackrox-io-image }}

  manifest-rhacs-eng:
    runs-on: ubuntu-24.04
    needs:
      - container
      - vars
    env:
      ARCHS: amd64 arm64
    steps:
      - uses: redhat-actions/podman-login@v1
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}
          password: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}

      - name: Create multiarch manifest
        run: |
          podman manifest create ${{ needs.vars.outputs.rhacs-eng-image }} \
            ${{ needs.vars.outputs.rhacs-eng-image }}-amd64 \
            ${{ needs.vars.outputs.rhacs-eng-image }}-arm64
          podman manifest inspect ${{ needs.vars.outputs.rhacs-eng-image }}
          podman manifest push ${{ needs.vars.outputs.rhacs-eng-image }}

  unit-tests:
    uses: ./.github/workflows/unit-tests.yml
    secrets: inherit

  integration-tests:
    needs:
      - vars
      - manifest-stackrox-io
      - manifest-rhacs-eng
    uses: ./.github/workflows/integration-tests.yml
    with:
      tag: ${{ needs.vars.outputs.tag }}
    secrets: inherit

  performance-tests:
    if: github.event_name == 'schedule'
    needs:
      - vars
      - manifest-stackrox-io
      - manifest-rhacs-eng
      - integration-tests
    uses: ./.github/workflows/performance-tests.yml
    with:
      tag: ${{ needs.vars.outputs.tag }}
    secrets: inherit