nightly-quality-gate.yaml

name: "Nightly Quality Gate"
on:
  # allow for kicking off quality gate check manually
  workflow_dispatch:

  # run 5 AM (UTC) daily
  schedule:
    - cron: "0 5 * * *"

permissions: {}

concurrency:
  group: nightly-quality-gate
  cancel-in-progress: true

jobs:
  select-providers:
    runs-on: runs-on=${{ github.run_id }}/cpu=2/ram=4+8/family=t4g+t3a+t3+m6g+m6a/spot=price-capacity-optimized/retry=when-interrupted
    permissions:
      contents: read
    outputs:
      providers: ${{ steps.determine-providers.outputs.providers }}
      multicore-providers: ${{ steps.split-providers.outputs.multicore-providers }}
      other-providers: ${{ steps.split-providers.outputs.other-providers }}
    steps:
      - uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc #v2.2.0
        if: ${{ vars.TRACK_RESOURCE_METRICS != '' }}
        with:
          metrics: ${{ vars.TRACK_RESOURCE_METRICS }}

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
        with:
          # in order to properly resolve the version from git
          fetch-depth: 0
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          tools: false

      - name: Determine providers
        id: determine-providers
        run: |
          # select all providers as test subjects (this populates the matrix downstream)
          content=`cd tests/quality && make all-providers`
          echo $content
          echo "providers=$content" >> $GITHUB_OUTPUT

      - name: Split providers by concurrency needs
        id: split-providers
        run: |
          cd tests/quality
          # use vunnel's tag system to split providers by concurrency needs
          multicore_providers=$(make all-providers TAG=multicore)
          other_providers=$(make all-providers TAG='!multicore')
          echo "multicore-providers=$multicore_providers" >> $GITHUB_OUTPUT
          echo "other-providers=$other_providers" >> $GITHUB_OUTPUT

  validate-provider-multicore:
    runs-on: runs-on=${{ github.run_id }}-multicore-${{ strategy.job-index }}/cpu=16/ram=32+64/family=c6gd+c5ad+m6gd+c7gd+c5d/spot=price-capacity-optimized/retry=when-interrupted
    timeout-minutes: 480
    needs: select-providers
    if: needs.select-providers.outputs.multicore-providers != '[]'
    strategy:
      matrix:
        provider: ${{fromJson(needs.select-providers.outputs.multicore-providers)}}
      fail-fast: false
    permissions:
      contents: read
      packages: read
    steps:
      - uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc #v2.2.0
        if: ${{ vars.TRACK_RESOURCE_METRICS != '' }}
        with:
          metrics: ${{ vars.TRACK_RESOURCE_METRICS }}

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
        with:
          # in order to properly resolve the version from git
          fetch-depth: 0
          # we need submodules for the quality gate to work (requires vulnerability-match-labels repo)
          submodules: true
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap

      - name: Run quality gate
        uses: ./.github/actions/quality-gate
        with:
          provider: ${{ matrix.provider }}
        env:
          # needed as a secret for the github provider
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  validate-provider:
    runs-on: runs-on=${{ github.run_id }}-provider-${{ strategy.job-index }}/cpu=8/ram=16+64/family=c6gd+c5ad+m6gd+c7gd+c5d+c6id+m5ad+m7gd+m5d+r6gd+m6id+r5ad+r7gd+r5d+r6id/spot=price-capacity-optimized/retry=when-interrupted
    timeout-minutes: 480
    needs: select-providers
    if: needs.select-providers.outputs.other-providers != '[]'
    strategy:
      matrix:
        provider: ${{fromJson(needs.select-providers.outputs.other-providers)}}
      fail-fast: false
    permissions:
      contents: read
      packages: read
    steps:
      - uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc #v2.2.0
        if: ${{ vars.TRACK_RESOURCE_METRICS != '' }}
        with:
          metrics: ${{ vars.TRACK_RESOURCE_METRICS }}

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
        with:
          # in order to properly resolve the version from git
          fetch-depth: 0
          # we need submodules for the quality gate to work (requires vulnerability-match-labels repo)
          submodules: true
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap

      - name: Run quality gate
        uses: ./.github/actions/quality-gate
        with:
          provider: ${{ matrix.provider }}
        env:
          # needed as a secret for the github provider
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # note: the name for this check is referenced in release.yaml, do not change here without changing there
  Nightly-Quality-Gate:
    runs-on: runs-on=${{ github.run_id }}/cpu=2/ram=4+8/family=t4g+t3a+t3+m6g+m6a/spot=price-capacity-optimized/retry=when-interrupted
    needs:
      - validate-provider
      - validate-provider-multicore
    if: ${{ always() && !cancelled() }}
    steps:
      - uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc #v2.2.0
        if: ${{ vars.TRACK_RESOURCE_METRICS != '' }}
        with:
          metrics: ${{ vars.TRACK_RESOURCE_METRICS }}

      # based on https://docs.github.com/en/actions/learn-github-actions/contexts#job-context
      # the valid result values are: success, failure, cancelled
      - env:
          VALIDATION_STATUS: ${{ needs.validate-provider.result }}
          VALIDATION_MULTICORE_STATUS: ${{ needs.validate-provider-multicore.result }}
        run: |
          echo "Validations Status: $VALIDATION_STATUS"
          echo "Validations Multicore Status: $VALIDATION_MULTICORE_STATUS"
          # allow "skipped" status since empty matrices result in skipped jobs
          case "$VALIDATION_STATUS" in
            success|skipped) ;;
            *) fail=1 ;;
          esac
          case "$VALIDATION_MULTICORE_STATUS" in
            success|skipped) ;;
            *) fail=1 ;;
          esac
          if [ "$fail" = 1 ]; then
            echo "🔴 Quality gate FAILED! 😭"
            exit 1
          fi
          echo "🟢 Quality gate passed!"

      - name: Notify Slack on failure
        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a #v2.1.1
        if: ${{ failure() }}
        with:
          webhook: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }}
          webhook-type: incoming-webhook
          payload: |
            text: "Vunnel nightly quality gate has failed"
            blocks:
              - type: section
                text:
                  type: mrkdwn
                  text: |
                    *Vunnel nightly quality gate has failed*
                    • Repo: `${{ github.repository }}`
                    • Workflow: `${{ github.workflow }}`
                    • Event: `${{ github.event_name }}`
                    • <https://github.com/anchore/vunnel/actions/workflows/nightly-quality-gate.yaml|View Workflow>