module_acceptance.yml

# This is a generic workflow for Puppet module acceptance operations.
name: "Module Acceptance"

on:
  workflow_call:
    inputs:
      runs_on:
        description: "The operating system used for the runner."
        required: false
        type: "string"
      flags:
        description: "Additional flags to pass to matrix_from_metadata_v3."
        required: false
        default: ''
        type: "string"
      service_url:
        description: "The service URL to target when provisioning from GCP."
        required: false
        default: 'https://facade-release-6f3kfepqcq-ew.a.run.app/v1/provision'
        type: "string"
      kernel_modules:
        description: "Volume map host kernel /lib/modules into docker container"
        default: true
        type: boolean
      disable_apparmor:
        description: "Disable and stop apparmor"
        default: false
        type: boolean
      ruby_version:
        description: "Ruby version to use"
        required: false
        default: '3.2'
        type: "string"


permissions:
  contents: read

env:
  SERVICE_URL: ${{ inputs.service_url }}

jobs:

  setup_matrix:
    name: "Setup Test Matrix"
    runs-on: ubuntu-latest
    # Defense-in-depth: on `pull_request_target` (where this workflow runs
    # with secrets in scope), fork PRs require the `allowed-for-ci` label.
    # Other invocations are unaffected.
    if: >-
      github.event_name != 'pull_request_target' ||
      github.event.pull_request.head.repo.fork != true ||
      contains(github.event.pull_request.labels.*.name, 'allowed-for-ci')
    outputs:
      acceptance_matrix: ${{ steps.get-matrix.outputs.matrix }}

    env:
      BUNDLE_WITHOUT: release_prep

    steps:

      - name: "Checkout"
        uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10"  # v6.0.3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: "Configure forge authentication"
        env:
          FORGE_TOKEN: ${{ secrets.PUPPET_FORGE_TOKEN || secrets.PUPPET_FORGE_TOKEN_PUBLIC }}
        run: |
          if [ -n "$FORGE_TOKEN" ]; then
            echo "PUPPET_FORGE_TOKEN=$FORGE_TOKEN" >> $GITHUB_ENV
            echo "BUNDLE_RUBYGEMS___PUPPETCORE__PUPPET__COM=forge-key:$FORGE_TOKEN" >> $GITHUB_ENV
          fi

      - name: "Setup ruby"
        uses: "ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f"  # v1.310.0
        with:
          ruby-version: ${{ inputs.ruby_version }}
          bundler-cache: true

      - name: "Bundle environment"
        run: |
          echo ::group::bundler environment
          bundle env
          echo ::endgroup::

      - name: Setup Test Matrix
        id: get-matrix
        run: |
          bundle exec matrix_from_metadata_v3 ${{ inputs.flags }}

  approval_gate:
    name: "Fork PR approval gate"
    needs: setup_matrix
    runs-on: ubuntu-latest
    # Funnels the `puppetcore-fork` environment approval through a single
    # non-matrix job. Without this, every matrix entry of `acceptance` would
    # declare `environment:` and create its own deployment event, producing
    # 2N timeline notifications per labelled fork PR. Same-repo PRs and
    # `workflow_dispatch` skip this job entirely; the `acceptance` job
    # below handles the skipped case.
    if: >-
      github.event_name == 'pull_request_target' &&
      github.event.pull_request.head.repo.fork == true
    environment: puppetcore-fork
    steps:
      - name: "Approval received"
        run: |
          echo "Approved fork PR #${{ github.event.pull_request.number }}"
          echo "Head SHA at approval: ${{ github.event.pull_request.head.sha }}"

  acceptance:
    name: "Acceptance tests (${{matrix.platforms.label}}, ${{matrix.collection.collection || matrix.collection}})"
    needs: [setup_matrix, approval_gate]
    # Runs after both setup_matrix and approval_gate. The `always()` is
    # required so the if-expression is evaluated when approval_gate is
    # skipped (non-fork events); without it, dependency-skip would
    # cascade and skip acceptance too.
    if: >-
      always() &&
      needs.setup_matrix.result == 'success' &&
      (needs.approval_gate.result == 'success' ||
       needs.approval_gate.result == 'skipped')
    runs-on: ${{ inputs.runs_on || matrix.platforms.runner }}
    timeout-minutes: 180
    strategy:
      fail-fast: false
      matrix: ${{ fromJson( needs.setup_matrix.outputs.acceptance_matrix ) }}

    env:
      BUNDLE_WITHOUT: release_prep
      PUPPET_GEM_VERSION: '~> 8.9'
      FACTER_GEM_VERSION: '~> 4.10'
      TWINGATE_PUBLIC_REPO_KEY: ${{ secrets.TWINGATE_PUBLIC_REPO_KEY }}

    steps:
      - name: "Configure forge authentication"
        env:
          FORGE_TOKEN: ${{ secrets.PUPPET_FORGE_TOKEN || secrets.PUPPET_FORGE_TOKEN_PUBLIC }}
        run: |
          if [ -n "$FORGE_TOKEN" ]; then
            echo "PUPPET_FORGE_TOKEN=$FORGE_TOKEN" >> $GITHUB_ENV
            echo "BUNDLE_RUBYGEMS___PUPPETCORE__PUPPET__COM=forge-key:$FORGE_TOKEN" >> $GITHUB_ENV
          fi

      - name: "Install Twingate"
        if: env.TWINGATE_PUBLIC_REPO_KEY != ''
        uses: "twingate/github-action@f1e69fc5af67b737d8597b759e5c607f567e77f2"  # v1
        with:
          service-key: ${{ env.TWINGATE_PUBLIC_REPO_KEY }}

      - name: Fix DNS
        if: env.TWINGATE_PUBLIC_REPO_KEY != ''
        run: |
          echo "=== Remove Azure DNS from eth0 interface ==="
          sudo resolvectl dns eth0 ""

          echo "=== Configure Twingate DNS properly ==="
          sudo resolvectl dns sdwan0 100.95.0.251 100.95.0.252
          sudo resolvectl domain sdwan0 delivery.puppetlabs.net

          echo "=== Flush DNS cache ==="
          sudo resolvectl flush-caches

          echo "=== Check new configuration ==="
          resolvectl status

          echo "=== Test DNS resolution ==="
          nslookup artifactory.delivery.puppetlabs.net

      - name: "Checkout"
        uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10"  # v6.0.3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: "Disable Apparmor"
        if: ${{ inputs.disable_apparmor }}
        run: |
          if command -v apparmor_parser >/dev/null ; then
            sudo find /etc/apparmor.d/ -maxdepth 1 -type f -exec ln -sf {} /etc/apparmor.d/disable/ \;
            sudo apparmor_parser -R /etc/apparmor.d/disable/* || true
            sudo systemctl disable apparmor
            sudo systemctl stop apparmor
          fi

      - name: "Setup ruby"
        uses: "ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f"  # v1.310.0
        with:
          ruby-version: ${{ inputs.ruby_version }}
          bundler-cache: true

      - name: "Bundle environment"
        run: |
          echo ::group::bundler environment
          bundle env
          echo ::endgroup::

      - name: "Provision environment"
        env:
          PROVIDER: ${{ matrix.platforms.provider }}
          IMAGE: ${{ matrix.platforms.image }}
        run: |
          if [[ "${{ inputs.kernel_modules }}" == "true" ]] && [[ "$PROVIDER" =~ docker* ]] ; then
            DOCKER_RUN_OPTS="docker_run_opts: {'--volume': '/lib/modules/$(uname -r):/lib/modules/$(uname -r)'}"
          else
            DOCKER_RUN_OPTS=''
          fi
          bundle exec rake "litmus:provision[$PROVIDER,$IMAGE,$DOCKER_RUN_OPTS]"
          FILE='spec/fixtures/litmus_inventory.yaml'
          sed -e 's/password: .*/password: "[redacted]"/' < $FILE || true
          if [[ -n "$TWINGATE_PUBLIC_REPO_KEY" ]]; then
            bundle exec bolt command run "sed '/^nameserver 168.63.129.16\$/d; /^search/d' /etc/resolv.conf > /tmp/resolv.conf && cat /tmp/resolv.conf > /etc/resolv.conf" --targets all --inventoryfile spec/fixtures/litmus_inventory.yaml
          fi


      - name: "Install Puppet agent"
        env:
          COLLECTION_KEY: ${{ matrix.collection.collection }}
          COLLECTION_STRING: ${{ matrix.collection.collection || matrix.collection }}
          VERSION: ${{ matrix.collection.version }}
        run: |
          if [[ "$VERSION" ]] ; then
            export PUPPET_VERSION="$VERSION"
            bundle exec rake "litmus:install_agent[$COLLECTION_KEY]"
          else
            bundle exec rake "litmus:install_agent[$COLLECTION_STRING]"
          fi

      - name: "Install module"
        run: |
          bundle exec rake 'litmus:install_module'

      - name: "Run acceptance tests"
        run: |
          bundle exec rake 'litmus:acceptance:parallel'

      - name: "Remove test environment"
        if: ${{ always() }}
        continue-on-error: true
        run: |
          if [[ -f spec/fixtures/litmus_inventory.yaml ]]; then
            bundle exec rake 'litmus:tear_down'
          fi