integration-tests-pr.yml

on:
  pull_request:
  workflow_dispatch:
    inputs:
      tests:
        description: 'The tests to run.'
        required: false
      sha:
        description: 'The hash value of the commit.'
        required: true
      pull_request_number:
        description: 'The number of the PR.'
        required: false

name: Integration tests on PR

jobs:
  integration-fork:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: .ansible/collections/ansible_collections/linode/cloud
    
    if: github.event_name == 'workflow_dispatch' && inputs.sha != ''
    steps:
      - uses: actions-ecosystem/action-regex-match@v2
        id: disallowed-char-check
        with:
          text: ${{ inputs.tests }}
          regex: '[^a-z0-9_]'
          flags: gi

      # Check out merge commit
      - name: Checkout PR
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.sha }}
          path: .ansible/collections/ansible_collections/linode/cloud
          fetch-depth: 0
          submodules: 'recursive'

      - name: setup python 3
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: install dependencies
        run: make deps

      - name: install ansible dependencies
        run: ansible-galaxy collection install amazon.aws:==9.1.0

      - name: install collection
        run: make install

      - name: replace existing keys
        run: rm -rf ~/.ansible/test && mkdir -p ~/.ansible/test && ssh-keygen -m PEM -q -t rsa -N '' -f ~/.ansible/test/id_rsa

      - run: make deps && make TEST_ARGS="-v ${{ inputs.tests }}" test
        if: ${{ steps.disallowed-char-check.outputs.match == '' }}
        env:
          LINODE_API_TOKEN: ${{ secrets.DX_LINODE_TOKEN }}
      
      - name: Get the hash value of the latest commit from the PR branch
        uses: octokit/graphql-action@v2.x
        id: commit-hash
        if: ${{ inputs.pull_request_number != '' }}
        with:
          query: |
            query PRHeadCommitHash($owner: String!, $repo: String!, $pr_num: Int!) {
              repository(owner:$owner, name:$repo) {
                pullRequest(number: $pr_num) {
                  headRef {
                    target {
                      ... on Commit {
                        oid
                      }
                    }
                  }
                }
              }
            }
          owner: ${{ github.event.repository.owner.login }}
          repo: ${{ github.event.repository.name }}
          pr_num: ${{ fromJSON(inputs.pull_request_number) }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/github-script@v7
        id: update-check-run
        if: ${{ inputs.pull_request_number != '' && fromJson(steps.commit-hash.outputs.data).repository.pullRequest.headRef.target.oid == inputs.sha }}
        env:
          number: ${{ inputs.pull_request_number }}
          job: ${{ github.job }}
          conclusion: ${{ job.status }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const { data: pull } = await github.rest.pulls.get({
              ...context.repo,
              pull_number: process.env.number
            });
            const ref = pull.head.sha;
            const { data: checks } = await github.rest.checks.listForRef({
              ...context.repo,
              ref
            });
            const check = checks.check_runs.filter(c => c.name === process.env.job);
            const { data: result } = await github.rest.checks.update({
              ...context.repo,
              check_run_id: check[0].id,
              status: 'completed',
              conclusion: process.env.conclusion
            });
            return result;

  apply-calico-rules:
    runs-on: ubuntu-latest
    needs: [integration-fork]
    if: ${{ success() || failure() }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: 'recursive'

      - name: Download kubectl and calicoctl for LKE clusters
        run: |
          curl -LO "https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl"
          curl -LO "https://github.com/projectcalico/calico/releases/download/v3.25.0/calicoctl-linux-amd64"
          chmod +x calicoctl-linux-amd64 kubectl
          mv calicoctl-linux-amd64 /usr/local/bin/calicoctl
          mv kubectl /usr/local/bin/kubectl

      - name: Apply Calico Rules to LKE
        run: |
          cd e2e_scripts/cloud_security_scripts/lke_calico_rules/ && ./lke_calico_rules_e2e.sh
        env:
          LINODE_TOKEN: ${{ secrets.DX_LINODE_TOKEN }}

  add-fw-to-remaining-instances:
    runs-on: ubuntu-latest
    needs: [integration-fork]
    if: ${{ success() || failure() }}

    steps:
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Install Linode CLI
        run: |
          pip install linode-cli

      - name: Create Firewall and Attach to Instances
        run: |
          FIREWALL_ID=$(linode-cli firewalls create --label "e2e-fw-$(date +%s)" --rules.inbound_policy "DROP" --rules.outbound_policy "ACCEPT" --text --format=id --no-headers)
          echo "Created Firewall with ID: $FIREWALL_ID"
          
          for instance_id in $(linode-cli linodes list --format "id" --text --no-header); do
            echo "Attaching firewall to instance: $instance_id"
            if linode-cli firewalls device-create "$FIREWALL_ID" --id "$instance_id" --type linode; then
              echo "Firewall attached to instance $instance_id successfully."
            else
              echo "An error occurred while attaching firewall to instance $instance_id. Skipping..."
            fi
          done
        env:
          LINODE_CLI_TOKEN: ${{ secrets.DX_LINODE_TOKEN }}