kind-e2e.yaml

name: KinD e2e tests

on:
  workflow_dispatch:  # Allow manual runs.
  pull_request:
    branches:
      - 'main'

jobs:
  e2e-tests:
    name: e2e tests
    runs-on: ubuntu-latest
    env:
      # https://github.com/google/go-containerregistry/pull/125 allows insecure registry for
      # '*.local' hostnames. This works both for `ko` and our own tag-to-digest resolution logic,
      # thus allowing us to test without bypassing tag-to-digest resolution.
      REGISTRY_NAME: registry.local
      REGISTRY_PORT: 5000
      KO_DOCKER_REPO: registry.local:5000/ko

    steps:
    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      with:
        go-version: '1.21'
        check-latest: true

    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

    - name: Install ko
      run: go install ./

    - name: Setup Cluster
      uses: chainguard-dev/actions/setup-kind@81dc0f9b6cd749004a9567afffef41ea84cf954c # main
      with:
        k8s-version: v1.25.x
        registry-authority: ${{ env.REGISTRY_NAME }}:${{ env.REGISTRY_PORT }}

    - name: Install Cosign
      uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2

    - name: Run Smoke Test
      run: |
        # Test with kind load
        KO_DOCKER_REPO=kind.local ko apply --platform=all -f ./test
        kubectl wait --timeout=10s --for=condition=Ready pod/kodata
        kubectl delete pod kodata

        # Test with registry
        ko apply --platform=all -f ./test
        kubectl wait --timeout=60s --for=condition=Ready pod/kodata
        kubectl delete pod kodata

        # Test ko run with kind load
        # This tests that --labels are passed to kubectl, and -wait is passed to the test binary.
        KO_DOCKER_REPO=kind.local ko run ./test -- --labels=foo=bar -- -wait=false

    - name: Check SBOM
      run: |
        set -o pipefail

        echo '::group:: SBOM'
        cosign download sbom $(ko build ./test)
        echo "${SBOM}"
        echo '::endgroup::'

    - name: Collect diagnostics and upload
      if: ${{ failure() }}
      uses: chainguard-dev/actions/kind-diag@84c993eaf02da1c325854fb272a4df9184bd80fc # main