Add Slurm Operator 1.2.0 #84
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI - Plan (Both) | |
| # Runs validation, Terraform plan, and ORM plan jobs on /ok-to-run-plan | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| pr_number: | |
| description: "Pull request number to test (leave empty to use current branch)" | |
| required: false | |
| type: number | |
| issue_comment: | |
| types: [created] | |
| # Cancel in-flight plan runs for the same PR when a new /ok-to-run-plan is triggered. | |
| # Non-plan comments (e.g. /ok-to-run-apply-both) also fire this workflow; give them | |
| # a unique group so they don't cancel a real plan run. | |
| concurrency: | |
| group: >- | |
| ${{ | |
| github.event.issue.pull_request && | |
| startsWith(github.event.comment.body, '/ok-to-run-plan') && | |
| !startsWith(github.event.comment.body, '/ok-to-run-plan-') && | |
| contains(fromJSON('["OguzPastirmaci","arnaudfroidmont","robo-cap"]'), github.event.comment.user.login) && | |
| format('ci-plan-{0}', github.event.issue.number) || | |
| github.event_name == 'workflow_dispatch' && | |
| github.event.inputs.pr_number != '' && | |
| format('ci-plan-{0}', github.event.inputs.pr_number) || | |
| github.run_id | |
| }} | |
| cancel-in-progress: true | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| GIT_TEMPLATE_DIR: "" # workaround for missing git hook templates on ubuntu-24.04 runners | |
| permissions: | |
| contents: read | |
| pull-requests: write # needed to post the rocket reaction on the trigger comment | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # Gate: verify the comment is authorized, post a reaction, and check which | |
| # files changed. Downstream jobs only run if infra-relevant files changed. | |
| # --------------------------------------------------------------------------- | |
| check-changes: | |
| name: Check changed files | |
| if: >- | |
| (github.event.issue.pull_request && | |
| startsWith(github.event.comment.body, '/ok-to-run-plan') && | |
| !startsWith(github.event.comment.body, '/ok-to-run-plan-') && | |
| contains(fromJSON('["OguzPastirmaci","arnaudfroidmont","robo-cap"]'), github.event.comment.user.login)) || | |
| github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| run-tests: ${{ steps.filter.outputs.infra }} | |
| pr_number: ${{ steps.pr-comment.outputs.pr_number || steps.pr-dispatch.outputs.pr_number }} | |
| pr_head_sha: ${{ steps.pr-comment.outputs.head_sha || steps.pr-dispatch.outputs.head_sha }} | |
| base_ref: ${{ steps.pr-comment.outputs.base_ref || steps.pr-dispatch.outputs.base_ref }} | |
| steps: | |
| - name: React to trigger comment | |
| if: github.event_name == 'issue_comment' | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 | |
| with: | |
| script: | | |
| await github.rest.reactions.createForIssueComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| comment_id: context.payload.comment.id, | |
| content: 'rocket' | |
| }) | |
| - name: Resolve PR context from comment | |
| id: pr-comment | |
| if: github.event_name == 'issue_comment' | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 | |
| env: | |
| PR_NUMBER: ${{ github.event.issue.number }} | |
| with: | |
| script: | | |
| const prNumber = Number(process.env.PR_NUMBER); | |
| const pr = await github.rest.pulls.get({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: prNumber, | |
| }); | |
| core.setOutput('pr_number', String(prNumber)); | |
| core.setOutput('head_sha', pr.data.head.sha); | |
| core.setOutput('base_ref', pr.data.base.ref); | |
| - name: Resolve PR context from workflow input | |
| id: pr-dispatch | |
| if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_number != '' | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 | |
| env: | |
| PR_NUMBER: ${{ github.event.inputs.pr_number }} | |
| with: | |
| script: | | |
| const prNumber = Number(process.env.PR_NUMBER); | |
| const pr = await github.rest.pulls.get({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: prNumber, | |
| }); | |
| core.setOutput('pr_number', String(prNumber)); | |
| core.setOutput('head_sha', pr.data.head.sha); | |
| core.setOutput('base_ref', pr.data.base.ref); | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| ref: >- | |
| ${{ | |
| (steps.pr-comment.outputs.pr_number || steps.pr-dispatch.outputs.pr_number) && | |
| format('refs/pull/{0}/head', steps.pr-comment.outputs.pr_number || steps.pr-dispatch.outputs.pr_number) || | |
| github.ref | |
| }} | |
| fetch-depth: 0 | |
| - name: Verify checked-out PR SHA | |
| if: steps.pr-comment.outputs.head_sha != '' || steps.pr-dispatch.outputs.head_sha != '' | |
| env: | |
| EXPECTED_SHA: ${{ steps.pr-comment.outputs.head_sha || steps.pr-dispatch.outputs.head_sha }} | |
| run: | | |
| ACTUAL_SHA=$(git rev-parse HEAD) | |
| if [ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]; then | |
| echo "Expected PR head SHA $EXPECTED_SHA but checked out $ACTUAL_SHA." | |
| echo "The PR changed after this run started. Re-run against the latest commit." | |
| exit 1 | |
| fi | |
| - name: Fetch base branch for diff | |
| if: steps.pr-comment.outputs.base_ref != '' || steps.pr-dispatch.outputs.base_ref != '' | |
| env: | |
| BASE_REF: ${{ steps.pr-comment.outputs.base_ref || steps.pr-dispatch.outputs.base_ref }} | |
| run: git fetch origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}" | |
| - name: Check for infra-relevant changes | |
| id: filter | |
| env: | |
| BASE_REF: ${{ steps.pr-comment.outputs.base_ref || steps.pr-dispatch.outputs.base_ref }} | |
| HEAD_SHA: ${{ steps.pr-comment.outputs.head_sha || steps.pr-dispatch.outputs.head_sha }} | |
| run: | | |
| if [ -z "$BASE_REF" ] || [ -z "$HEAD_SHA" ]; then | |
| echo "No PR context; running all tests." | |
| echo "infra=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| CHANGED=$(git diff --name-only "origin/${BASE_REF}...${HEAD_SHA}" -- \ | |
| 'terraform/' 'test/' 'files/' 'manifests/' '.github/workflows/' '.github/scripts/' || true) | |
| if [ -n "$CHANGED" ]; then | |
| echo "infra=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "infra=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| # --------------------------------------------------------------------------- | |
| # Validation tests: check all terraform preconditions produce the expected | |
| # errors (no apply required, but OCI auth is still needed for terraform plan) | |
| # --------------------------------------------------------------------------- | |
| validate: | |
| name: Validation tests | |
| needs: check-changes | |
| if: needs.check-changes.outputs.run-tests == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| ref: >- | |
| ${{ | |
| needs.check-changes.outputs.pr_number != '' && | |
| format('refs/pull/{0}/head', needs.check-changes.outputs.pr_number) || | |
| github.ref | |
| }} | |
| fetch-depth: 0 | |
| - name: Verify checked-out PR SHA | |
| if: needs.check-changes.outputs.pr_head_sha != '' | |
| env: | |
| EXPECTED_SHA: ${{ needs.check-changes.outputs.pr_head_sha }} | |
| run: | | |
| ACTUAL_SHA=$(git rev-parse HEAD) | |
| if [ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]; then | |
| echo "Expected PR head SHA $EXPECTED_SHA but checked out $ACTUAL_SHA." | |
| echo "The PR changed after this run started. Re-run against the latest commit." | |
| exit 1 | |
| fi | |
| - name: Squash PR changes and rebase onto base branch | |
| if: needs.check-changes.outputs.base_ref != '' | |
| env: | |
| BASE_REF: ${{ needs.check-changes.outputs.base_ref }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git fetch origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}" | |
| MERGE_BASE=$(git merge-base HEAD "origin/${BASE_REF}") | |
| git reset --soft "$MERGE_BASE" | |
| git commit -m "Squashed PR changes" | |
| git rebase "origin/${BASE_REF}" | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 | |
| with: | |
| go-version-file: test/go.mod | |
| cache: true | |
| cache-dependency-path: test/go.sum | |
| - name: Install Terraform | |
| run: | | |
| TF_VERSION="1.5.7" | |
| curl -fsSL "https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip" -o tf.zip | |
| unzip -o tf.zip -d /usr/local/bin | |
| rm tf.zip | |
| terraform version | |
| - name: Cache Terraform providers | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 | |
| with: | |
| path: terraform/.terraform | |
| key: terraform-${{ hashFiles('terraform/versions.tf', 'terraform/.terraform.lock.hcl') }} | |
| restore-keys: terraform- | |
| - name: Set up OCI credentials | |
| env: | |
| OCI_USER_OCID: ${{ secrets.OCI_USER_OCID }} | |
| OCI_API_KEY_FINGERPRINT: ${{ secrets.OCI_API_KEY_FINGERPRINT }} | |
| OCI_TENANCY_OCID: ${{ secrets.OCI_TENANCY_OCID }} | |
| OCI_REGION: ${{ vars.OCI_REGION }} | |
| OCI_API_KEY_PRIVATE_KEY: ${{ secrets.OCI_API_KEY_PRIVATE_KEY }} | |
| run: .github/scripts/setup-oci-credentials.sh | |
| - name: Run validation tests | |
| working-directory: test | |
| env: | |
| OCI_TENANCY_OCID: ${{ secrets.OCI_TENANCY_OCID }} | |
| OCI_REGION: ${{ vars.OCI_REGION }} | |
| OCI_COMPARTMENT_OCID: ${{ secrets.OCI_COMPARTMENT_OCID }} | |
| WORKER_OPS_AD: ${{ vars.WORKER_OPS_AD }} | |
| WORKER_OPS_IMAGE_CUSTOM_ID: ${{ vars.WORKER_OPS_IMAGE_CUSTOM_ID }} | |
| WORKER_CPU_AD: ${{ vars.WORKER_CPU_AD }} | |
| WORKER_CPU_IMAGE_CUSTOM_ID: ${{ vars.WORKER_CPU_IMAGE_CUSTOM_ID }} | |
| WORKER_GPU_AD: ${{ vars.WORKER_GPU_AD }} | |
| WORKER_GPU_IMAGE_CUSTOM_ID: ${{ vars.WORKER_GPU_IMAGE_CUSTOM_ID }} | |
| SSH_PUBLIC_KEY: ${{ vars.SSH_PUBLIC_KEY }} | |
| run: go test -v -count=1 -run TestValidation -timeout 30m ./... | |
| # --------------------------------------------------------------------------- | |
| # Terraform plan smoke tests: run terraform plan (no apply) across multiple | |
| # config combinations to catch regressions before anything is provisioned. | |
| # All matrix jobs run in parallel; a single failure does not stop the others. | |
| # --------------------------------------------------------------------------- | |
| plan-terraform: | |
| name: Terraform Plan / ${{ matrix.name }} | |
| needs: check-changes | |
| if: needs.check-changes.outputs.run-tests == 'true' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # Core network / access patterns | |
| - name: cluster-only | |
| tfvars: tfvars/core/cluster-only.tfvars | |
| - name: all-public-bastion-operator | |
| tfvars: tfvars/core/all-public-bastion-operator.tfvars | |
| - name: all-private | |
| tfvars: tfvars/core/all-private.tfvars | |
| - name: all-private-operator | |
| tfvars: tfvars/core/all-private-operator.tfvars | |
| - name: all-private-bastion-service | |
| tfvars: tfvars/core/all-private-bastion-service.tfvars | |
| # Add-on components layered on top of the minimal cluster config | |
| - name: monitoring | |
| tfvars: tfvars/core/cluster-only.tfvars,tfvars/monitoring/monitoring.tfvars | |
| - name: storage-fss | |
| tfvars: tfvars/core/cluster-only.tfvars,tfvars/storage/fss.tfvars | |
| - name: storage-lustre | |
| tfvars: tfvars/core/cluster-only.tfvars,tfvars/storage/lustre.tfvars | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| ref: >- | |
| ${{ | |
| needs.check-changes.outputs.pr_number != '' && | |
| format('refs/pull/{0}/head', needs.check-changes.outputs.pr_number) || | |
| github.ref | |
| }} | |
| fetch-depth: 0 | |
| - name: Verify checked-out PR SHA | |
| if: needs.check-changes.outputs.pr_head_sha != '' | |
| env: | |
| EXPECTED_SHA: ${{ needs.check-changes.outputs.pr_head_sha }} | |
| run: | | |
| ACTUAL_SHA=$(git rev-parse HEAD) | |
| if [ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]; then | |
| echo "Expected PR head SHA $EXPECTED_SHA but checked out $ACTUAL_SHA." | |
| echo "The PR changed after this run started. Re-run against the latest commit." | |
| exit 1 | |
| fi | |
| - name: Squash PR changes and rebase onto base branch | |
| if: needs.check-changes.outputs.base_ref != '' | |
| env: | |
| BASE_REF: ${{ needs.check-changes.outputs.base_ref }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git fetch origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}" | |
| MERGE_BASE=$(git merge-base HEAD "origin/${BASE_REF}") | |
| git reset --soft "$MERGE_BASE" | |
| git commit -m "Squashed PR changes" | |
| git rebase "origin/${BASE_REF}" | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 | |
| with: | |
| go-version-file: test/go.mod | |
| cache: true | |
| cache-dependency-path: test/go.sum | |
| - name: Install Terraform | |
| run: | | |
| TF_VERSION="1.5.7" | |
| curl -fsSL "https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip" -o tf.zip | |
| unzip -o tf.zip -d /usr/local/bin | |
| rm tf.zip | |
| terraform version | |
| - name: Cache Terraform providers | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 | |
| with: | |
| path: terraform/.terraform | |
| key: terraform-${{ hashFiles('terraform/versions.tf', 'terraform/.terraform.lock.hcl') }} | |
| restore-keys: terraform- | |
| - name: Set up OCI credentials | |
| env: | |
| OCI_USER_OCID: ${{ secrets.OCI_USER_OCID }} | |
| OCI_API_KEY_FINGERPRINT: ${{ secrets.OCI_API_KEY_FINGERPRINT }} | |
| OCI_TENANCY_OCID: ${{ secrets.OCI_TENANCY_OCID }} | |
| OCI_REGION: ${{ vars.OCI_REGION }} | |
| OCI_API_KEY_PRIVATE_KEY: ${{ secrets.OCI_API_KEY_PRIVATE_KEY }} | |
| run: .github/scripts/setup-oci-credentials.sh | |
| - name: Run Terraform plan test | |
| working-directory: test | |
| env: | |
| OCI_TENANCY_OCID: ${{ secrets.OCI_TENANCY_OCID }} | |
| OCI_REGION: ${{ vars.OCI_REGION }} | |
| OCI_COMPARTMENT_OCID: ${{ secrets.OCI_COMPARTMENT_OCID }} | |
| WORKER_OPS_AD: ${{ vars.WORKER_OPS_AD }} | |
| WORKER_OPS_IMAGE_CUSTOM_ID: ${{ vars.WORKER_OPS_IMAGE_CUSTOM_ID }} | |
| WORKER_CPU_AD: ${{ vars.WORKER_CPU_AD }} | |
| WORKER_CPU_IMAGE_CUSTOM_ID: ${{ vars.WORKER_CPU_IMAGE_CUSTOM_ID }} | |
| WORKER_GPU_AD: ${{ vars.WORKER_GPU_AD }} | |
| WORKER_GPU_IMAGE_CUSTOM_ID: ${{ vars.WORKER_GPU_IMAGE_CUSTOM_ID }} | |
| SSH_PUBLIC_KEY: ${{ vars.SSH_PUBLIC_KEY }} | |
| TFVARS_FILE: ${{ matrix.tfvars }} | |
| run: go test -v -count=1 -run TestPlanSmoke -timeout 15m ./... | |
| # --------------------------------------------------------------------------- | |
| # ORM plan tests: create an ORM stack and run a plan job (no apply) for each | |
| # network topology. Stack is deleted immediately after — no resources created. | |
| # --------------------------------------------------------------------------- | |
| plan-orm: | |
| name: ORM Plan / ${{ matrix.topology }} | |
| needs: check-changes | |
| if: needs.check-changes.outputs.run-tests == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - topology: public-base-orm | |
| - topology: public-fss-monitoring-orm | |
| - topology: public-lustre-orm | |
| - topology: public-fss-lustre-monitoring-orm | |
| - topology: private-base-orm | |
| - topology: private-fss-monitoring-orm | |
| - topology: private-lustre-orm | |
| - topology: private-fss-lustre-monitoring-orm | |
| env: | |
| TOPOLOGY: ${{ matrix.topology }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| ref: >- | |
| ${{ | |
| needs.check-changes.outputs.pr_number != '' && | |
| format('refs/pull/{0}/head', needs.check-changes.outputs.pr_number) || | |
| github.ref | |
| }} | |
| fetch-depth: 0 | |
| - name: Verify checked-out PR SHA | |
| if: needs.check-changes.outputs.pr_head_sha != '' | |
| env: | |
| EXPECTED_SHA: ${{ needs.check-changes.outputs.pr_head_sha }} | |
| run: | | |
| ACTUAL_SHA=$(git rev-parse HEAD) | |
| if [ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]; then | |
| echo "Expected PR head SHA $EXPECTED_SHA but checked out $ACTUAL_SHA." | |
| echo "The PR changed after this run started. Re-run against the latest commit." | |
| exit 1 | |
| fi | |
| - name: Squash PR changes and rebase onto base branch | |
| if: needs.check-changes.outputs.base_ref != '' | |
| env: | |
| BASE_REF: ${{ needs.check-changes.outputs.base_ref }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git fetch origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}" | |
| MERGE_BASE=$(git merge-base HEAD "origin/${BASE_REF}") | |
| git reset --soft "$MERGE_BASE" | |
| git commit -m "Squashed PR changes" | |
| git rebase "origin/${BASE_REF}" | |
| - name: Install OCI CLI | |
| run: pip install oci-cli --quiet | |
| - name: Set up OCI credentials | |
| env: | |
| OCI_USER_OCID: ${{ secrets.OCI_USER_OCID }} | |
| OCI_API_KEY_FINGERPRINT: ${{ secrets.OCI_API_KEY_FINGERPRINT }} | |
| OCI_TENANCY_OCID: ${{ secrets.OCI_TENANCY_OCID }} | |
| OCI_REGION: ${{ vars.OCI_REGION }} | |
| OCI_API_KEY_PRIVATE_KEY: ${{ secrets.OCI_API_KEY_PRIVATE_KEY }} | |
| run: .github/scripts/setup-oci-credentials.sh | |
| - name: Build variables JSON | |
| env: | |
| OCI_TENANCY_OCID: ${{ secrets.OCI_TENANCY_OCID }} | |
| OCI_REGION: ${{ vars.OCI_REGION }} | |
| OCI_COMPARTMENT_OCID: ${{ secrets.OCI_COMPARTMENT_OCID }} | |
| OCI_USER_OCID: ${{ secrets.OCI_USER_OCID }} | |
| WORKER_OPS_AD: ${{ vars.WORKER_OPS_AD }} | |
| WORKER_OPS_IMAGE_CUSTOM_ID: ${{ vars.WORKER_OPS_IMAGE_CUSTOM_ID }} | |
| WORKER_CPU_AD: ${{ vars.WORKER_CPU_AD }} | |
| WORKER_CPU_IMAGE_CUSTOM_ID: ${{ vars.WORKER_CPU_IMAGE_CUSTOM_ID }} | |
| WORKER_GPU_AD: ${{ vars.WORKER_GPU_AD }} | |
| WORKER_GPU_IMAGE_CUSTOM_ID: ${{ vars.WORKER_GPU_IMAGE_CUSTOM_ID }} | |
| SSH_PUBLIC_KEY: ${{ vars.SSH_PUBLIC_KEY }} | |
| OVERRIDES_JSON: '{}' | |
| run: .github/scripts/build-variables-orm.sh | |
| - name: Zip Terraform directory | |
| run: | | |
| cd terraform | |
| zip -r ../stack.zip . -x "*.terraform/*" -x "*.tfstate*" | |
| - name: Create ORM stack | |
| env: | |
| OCI_COMPARTMENT_OCID: ${{ secrets.OCI_COMPARTMENT_OCID }} | |
| GITHUB_RUN_ID: ${{ github.run_id }} | |
| STACK_NAME_PREFIX: ci-plan-orm | |
| run: .github/scripts/create-orm-stack.sh | |
| - name: Plan stack | |
| run: | | |
| PLAN_JOB_ID=$(oci resource-manager job create-plan-job \ | |
| --stack-id "$STACK_ID" \ | |
| --query 'data.id' \ | |
| --raw-output) | |
| echo "PLAN_JOB_ID=$PLAN_JOB_ID" >> "$GITHUB_ENV" | |
| echo "Plan job: $PLAN_JOB_ID" | |
| - name: Wait for plan to complete | |
| run: .github/scripts/wait-for-orm-job.sh "$PLAN_JOB_ID" 40 30 | |
| - name: Delete stack | |
| if: always() && env.STACK_ID != '' | |
| run: | | |
| oci resource-manager stack delete \ | |
| --stack-id "$STACK_ID" \ | |
| --force | |
| echo "Stack $STACK_ID deleted." | |
| # --------------------------------------------------------------------------- | |
| # Terraform plan smoke tests: run terraform plan (no apply) for each of the | |
| # 8 Terraform topology tfvars files to catch regressions before apply. | |
| # --------------------------------------------------------------------------- | |
| plan-tf: | |
| name: TF Plan / ${{ matrix.name }} | |
| needs: check-changes | |
| if: needs.check-changes.outputs.run-tests == 'true' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: public-base-tf | |
| tfvars: tfvars/tf/public-base-tf.tfvars | |
| - name: public-bastion-operator-tf | |
| tfvars: tfvars/tf/public-bastion-operator-tf.tfvars | |
| - name: public-fss-monitoring-tf | |
| tfvars: tfvars/tf/public-fss-monitoring-tf.tfvars | |
| - name: public-lustre-tf | |
| tfvars: tfvars/tf/public-lustre-tf.tfvars | |
| - name: public-fss-lustre-monitoring-tf | |
| tfvars: tfvars/tf/public-fss-lustre-monitoring-tf.tfvars | |
| - name: private-base-tf | |
| tfvars: tfvars/tf/private-base-tf.tfvars | |
| - name: private-fss-monitoring-tf | |
| tfvars: tfvars/tf/private-fss-monitoring-tf.tfvars | |
| - name: private-fss-lustre-monitoring-tf | |
| tfvars: tfvars/tf/private-fss-lustre-monitoring-tf.tfvars | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| ref: >- | |
| ${{ | |
| needs.check-changes.outputs.pr_number != '' && | |
| format('refs/pull/{0}/head', needs.check-changes.outputs.pr_number) || | |
| github.ref | |
| }} | |
| fetch-depth: 0 | |
| - name: Verify checked-out PR SHA | |
| if: needs.check-changes.outputs.pr_head_sha != '' | |
| env: | |
| EXPECTED_SHA: ${{ needs.check-changes.outputs.pr_head_sha }} | |
| run: | | |
| ACTUAL_SHA=$(git rev-parse HEAD) | |
| if [ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]; then | |
| echo "Expected PR head SHA $EXPECTED_SHA but checked out $ACTUAL_SHA." | |
| echo "The PR changed after this run started. Re-run against the latest commit." | |
| exit 1 | |
| fi | |
| - name: Squash PR changes and rebase onto base branch | |
| if: needs.check-changes.outputs.base_ref != '' | |
| env: | |
| BASE_REF: ${{ needs.check-changes.outputs.base_ref }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git fetch origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}" | |
| MERGE_BASE=$(git merge-base HEAD "origin/${BASE_REF}") | |
| git reset --soft "$MERGE_BASE" | |
| git commit -m "Squashed PR changes" | |
| git rebase "origin/${BASE_REF}" | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 | |
| with: | |
| go-version-file: test/go.mod | |
| cache: true | |
| cache-dependency-path: test/go.sum | |
| - name: Install Terraform | |
| run: | | |
| TF_VERSION="1.5.7" | |
| curl -fsSL "https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip" -o tf.zip | |
| unzip -o tf.zip -d /usr/local/bin | |
| rm tf.zip | |
| terraform version | |
| - name: Cache Terraform providers | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 | |
| with: | |
| path: terraform/.terraform | |
| key: terraform-${{ hashFiles('terraform/versions.tf', 'terraform/.terraform.lock.hcl') }} | |
| restore-keys: terraform- | |
| - name: Set up OCI credentials | |
| env: | |
| OCI_USER_OCID: ${{ secrets.OCI_USER_OCID }} | |
| OCI_API_KEY_FINGERPRINT: ${{ secrets.OCI_API_KEY_FINGERPRINT }} | |
| OCI_TENANCY_OCID: ${{ secrets.OCI_TENANCY_OCID }} | |
| OCI_REGION: ${{ vars.OCI_REGION }} | |
| OCI_API_KEY_PRIVATE_KEY: ${{ secrets.OCI_API_KEY_PRIVATE_KEY }} | |
| run: .github/scripts/setup-oci-credentials.sh | |
| - name: Run Terraform plan test | |
| working-directory: test | |
| env: | |
| OCI_TENANCY_OCID: ${{ secrets.OCI_TENANCY_OCID }} | |
| OCI_REGION: ${{ vars.OCI_REGION }} | |
| OCI_COMPARTMENT_OCID: ${{ secrets.OCI_COMPARTMENT_OCID }} | |
| WORKER_OPS_AD: ${{ vars.WORKER_OPS_AD }} | |
| WORKER_OPS_IMAGE_CUSTOM_ID: ${{ vars.WORKER_OPS_IMAGE_CUSTOM_ID }} | |
| WORKER_CPU_AD: ${{ vars.WORKER_CPU_AD }} | |
| WORKER_CPU_IMAGE_CUSTOM_ID: ${{ vars.WORKER_CPU_IMAGE_CUSTOM_ID }} | |
| WORKER_GPU_AD: ${{ vars.WORKER_GPU_AD }} | |
| WORKER_GPU_IMAGE_CUSTOM_ID: ${{ vars.WORKER_GPU_IMAGE_CUSTOM_ID }} | |
| SSH_PUBLIC_KEY: ${{ vars.SSH_PUBLIC_KEY }} | |
| TFVARS_FILE: ${{ matrix.tfvars }} | |
| run: go test -v -count=1 -run TestPlanSmoke -timeout 15m ./... | |
| # --------------------------------------------------------------------------- | |
| # Summary: post a single comment to the PR with pass/fail for every job and | |
| # a direct link to the run log. Runs even if upstream jobs fail. | |
| # --------------------------------------------------------------------------- | |
| summarize: | |
| name: Post results | |
| needs: [check-changes, validate, plan-terraform, plan-tf, plan-orm] | |
| if: always() && needs.check-changes.result == 'success' && needs.check-changes.outputs.pr_number != '' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Post result comment | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 | |
| env: | |
| VALIDATE_RESULT: ${{ needs.validate.result }} | |
| PLAN_TF_RESULT: ${{ needs.plan-terraform.result }} | |
| PLAN_TF_TOPOLOGIES_RESULT: ${{ needs.plan-tf.result }} | |
| PLAN_ORM_RESULT: ${{ needs.plan-orm.result }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| PR_NUMBER: ${{ needs.check-changes.outputs.pr_number }} | |
| with: | |
| script: | | |
| const icon = (r) => r === 'success' ? '✅' : r === 'skipped' ? '⏭️' : '❌' | |
| const validate = process.env.VALIDATE_RESULT | |
| const planTf = process.env.PLAN_TF_RESULT | |
| const planTfTop = process.env.PLAN_TF_TOPOLOGIES_RESULT | |
| const planOrm = process.env.PLAN_ORM_RESULT | |
| const runUrl = process.env.RUN_URL | |
| const prNumber = Number(process.env.PR_NUMBER) | |
| const ok = (r) => r === 'success' || r === 'skipped' | |
| const overall = ok(validate) && ok(planTf) && ok(planTfTop) && ok(planOrm) | |
| const body = [ | |
| `### ${overall ? '✅' : '❌'} CI - Plan (Both) results`, | |
| '', | |
| `| Job | Result |`, | |
| `|-----|--------|`, | |
| `| Validation tests | ${icon(validate)} ${validate} |`, | |
| `| Terraform plan tests | ${icon(planTf)} ${planTf} |`, | |
| `| TF topology plan tests | ${icon(planTfTop)} ${planTfTop} |`, | |
| `| ORM plan tests | ${icon(planOrm)} ${planOrm} |`, | |
| '', | |
| `[View full run log](${runUrl})`, | |
| ].join('\n') | |
| await github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: prNumber, | |
| body, | |
| }) |