test-e2e-kbs.yml

name: KBS e2e Suite

on:
  pull_request:
    branches: ["main"]
    paths-ignore:
      - '**/*.md'
  workflow_dispatch:

permissions: {}

jobs:
  # Common checkout + source archive for all e2e jobs
  code-checkout:
    name: KBS - checkout & archive
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Archive source
        run: git archive -o kbs.tar.gz HEAD

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          path: ./kbs.tar.gz

  # Sample TEE e2e (reuses kbs-e2e template)
  sample-e2e-amd64:
    name: Sample TEE e2e (amd64)
    needs: code-checkout
    uses: ./.github/workflows/workflow-call-kbs-e2e.yml
    permissions:
      contents: read
      packages: write
    with:
      tee: sample
      tarball: kbs.tar.gz

  sample-e2e-arm64:
    name: Sample TEE e2e (arm64)
    needs: code-checkout
    uses: ./.github/workflows/workflow-call-kbs-e2e.yml
    permissions:
      contents: read
      packages: write
    with:
      tee: sample
      arch: aarch64
      runs-on-build: '["ubuntu-22.04-arm"]'
      runs-on-test: '["ubuntu-22.04-arm"]'
      tarball: kbs.tar.gz
      kbs-client-features: "cca-attester"

  # Vault integration e2e
  vault-e2e-test:
    name: Vault e2e
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    env:
      OS_VERSION: ubuntu-24.04
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      
      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
        with:
          rustflags: ""
          cache: false

      - name: Set up rust build cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        continue-on-error: false
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            target/
          key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }}

      - name: Run KBS Vault integration e2e (no SSL + SSL)
        run: make test-kbs-vault-e2e

  # Docker Compose cluster images (shared with docker-e2e-test via workflow artifacts)
  build-docker-e2e-images:
    name: Build Docker Compose e2e images
    uses: ./.github/workflows/workflow-call-build-docker-e2e-images.yml
    permissions:
      contents: read

  # Docker Compose cluster e2e
  docker-e2e-test:
    name: Docker Compose e2e
    needs: build-docker-e2e-images
    strategy:
      matrix:
        instance:
          - ubuntu-24.04
          - ubuntu-24.04-arm
        include:
          - instance: ubuntu-24.04
            platform_slug: linux-amd64
          - instance: ubuntu-24.04-arm
            platform_slug: linux-arm64
    runs-on: ${{ matrix.instance }}
    permissions:
      contents: read
    env:
       OS_VERSION: ${{ matrix.instance }}
    steps:
      - name: Checkout KBS
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Download pre-built images
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: docker-e2e-images-${{ matrix.platform_slug }}
          path: ${{ runner.temp }}/docker-e2e-images

      - name: Load images
        run: docker load --input "${{ runner.temp }}/docker-e2e-images/images.tar"

      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
        with:
          rustflags: ""
          cache: false

      - name: Set up rust build cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        continue-on-error: false
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            target/
          key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }}

      - name: Run KBS Docker Compose e2e
        env:
          SKIP_DOCKER_COMPOSE_BUILD: "1"
        run: make test-kbs-docker-e2e

  # External plugin e2e
  ext-plugin-e2e-test:
    name: External Plugin e2e
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    env:
      OS_VERSION: ubuntu-24.04
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false

    - name: Install Rust toolchain
      uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
      with:
        rustflags: ""
        cache: false

    - name: Set up rust build cache
      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      continue-on-error: false
      with:
        path: |
          ~/.cargo/registry/index/
          ~/.cargo/registry/cache/
          target/
        key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }}

    - name: Install build dependencies
      run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libprotobuf-dev libtss2-dev

    - name: Install TDX build dependencies
      run: |
        curl -L https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo gpg --dearmor --output /usr/share/keyrings/intel-sgx.gpg
        echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx.gpg] https://download.01.org/intel-sgx/sgx_repo/ubuntu noble main' | sudo tee /etc/apt/sources.list.d/intel-sgx.list
        sudo apt-get update
        sudo apt-get install -y libsgx-dcap-quote-verify-dev libsgx-dcap-default-qpl

    - name: Run external plugin unit tests
      working-directory: kbs
      run: make check TEST_FEATURES="external-plugin"

    - name: Install e2e test dependencies
      working-directory: kbs/test
      run: make install-dev-dependencies

    - name: Run external plugin e2e tests
      working-directory: kbs/test
      run: make e2e-ext-plugin

  # Azure vTPM TEE e2e (manual trigger only)
  tdx-e2e-test:
    name: KBS e2e (Azure TDX vTPM)
    needs: code-checkout
    if: github.event_name == 'workflow_dispatch'
    uses: ./.github/workflows/workflow-call-kbs-e2e.yml
    permissions:
      packages: write
      contents: read
    with:
      runs-on-test: '["self-hosted","azure-cvm-tdx"]'
      tee: az-tdx-vtpm
      tarball: kbs.tar.gz
      kbs-client-features: az-tdx-vtpm-attester

  snp-e2e-test:
    name: KBS e2e (Azure SNP vTPM)
    needs: code-checkout
    if: github.event_name == 'workflow_dispatch'
    uses: ./.github/workflows/workflow-call-kbs-e2e.yml
    permissions:
      packages: write
      contents: read
    with:
      runs-on-test: '["self-hosted","azure-cvm"]'
      tee: az-snp-vtpm
      tarball: kbs.tar.gz
      kbs-client-features: az-snp-vtpm-attester