.github/workflows/ci.yml

name: CI

on:
  push:
    branches:
      - main
      - release-*
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+*"
  pull_request:
    branches:
      - "*"
  schedule:
    - cron: "0 4 * * *" # run every day at 4am UTC

defaults:
  run:
    shell: bash

concurrency:
  group: ${{ github.ref_name }}-ci
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  vars:
    name: Checks and variables
    runs-on: ubuntu-22.04
    outputs:
      go_path: ${{ steps.vars.outputs.go_path }}
      min_k8s_version: ${{ steps.vars.outputs.min_k8s_version }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

      - name: Setup Golang Environment
        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version: stable

      - name: Output Variables
        id: vars
        run: |
          echo "go_path=$(go env GOPATH)" >> $GITHUB_OUTPUT
          echo "min_k8s_version=1.25.16" >> $GITHUB_OUTPUT

      - name: Check if go.mod and go.sum are up to date
        run: go mod tidy && git diff --exit-code -- go.mod go.sum

      - name: Check if go.mod and go.sum are up to date in tests
        run: go mod tidy && git diff --exit-code -- go.mod go.sum
        working-directory: tests

      - name: Check if generated go files are up to date
        run: make generate && git diff --exit-code

      - name: Check if generated CRDs and types are up to date
        run: make generate-crds && git diff --exit-code

      - name: Check if generated manifests are up to date
        run: make generate-manifests && git diff --exit-code

  unit-tests:
    name: Unit Tests
    runs-on: ubuntu-22.04
    needs: vars
    steps:
      - name: Checkout Repository
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

      - name: Setup Golang Environment
        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version: stable

      - name: Run Tests
        run: make unit-test

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@125fc84a9a348dbcf27191600683ec096ec9021c # v4.4.1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Upload Coverage Report
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
          name: cover-${{ github.run_id }}.html
          path: ${{ github.workspace }}/cover.html
        if: always()

  njs-unit-tests:
    name: NJS Unit Tests
    runs-on: ubuntu-22.04
    needs: vars
    steps:
      - name: Checkout Repository
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

      - name: Setup Node.js Environment
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version-file: .nvmrc

      - name: Run tests
        run: npm --prefix ${{ github.workspace }}/internal/mode/static/nginx/modules install-ci-test

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@125fc84a9a348dbcf27191600683ec096ec9021c # v4.4.1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  binary:
    name: Build Binary
    runs-on: ubuntu-22.04
    needs: [vars, unit-tests, njs-unit-tests]
    permissions:
      contents: write # for goreleaser/goreleaser-action and lucacome/draft-release to create/update releases
      id-token: write # for goreleaser/goreleaser-action to sign artifacts
      issues: write # for goreleaser/goreleaser-action to close milestone
    steps:
      - name: Checkout Repository
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
          fetch-depth: 0

      - name: Setup Golang Environment
        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version: stable

      - name: Create/Update Draft
        uses: lucacome/draft-release@e076259ceb036bc5f2c2a76559784c12cf8d2e74 # v1.0.4
        with:
          minor-label: "enhancement"
          major-label: "change"
          publish: ${{ github.ref_type == 'tag' }}
          collapse-after: 20
          notes-header: |
            *Below is the auto-generated changelog, which includes all PRs that went into the release.
            For a shorter version that highlights only important changes, see [CHANGELOG.md](https://github.com/nginxinc/nginx-gateway-fabric/blob/{{version}}/CHANGELOG.md).*
        if: ${{ github.event_name == 'push' && github.ref != 'refs/heads/main' }}

      - name: Download Syft
        uses: anchore/sbom-action/download-syft@e8d2a6937ecead383dfe75190d104edd1f9c5751 # v0.16.0
        if: github.ref_type == 'tag'

      - name: Install Cosign
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
        if: github.ref_type == 'tag'

      - name: Build binary
        uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
        with:
          version: latest
          args: ${{ github.ref_type == 'tag' && 'release' || 'build --snapshot' }} --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GOPATH: ${{ needs.vars.outputs.go_path }}
          AZURE_STORAGE_ACCOUNT: ${{ secrets.AZURE_STORAGE_ACCOUNT }}
          AZURE_STORAGE_KEY: ${{ secrets.AZURE_STORAGE_KEY }}
          AZURE_BUCKET_NAME: ${{ secrets.AZURE_BUCKET_NAME }}
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_COMMUNITY }}
          TELEMETRY_ENDPOINT: oss.edge.df.f5.com:443
          TELEMETRY_ENDPOINT_INSECURE: "false"

      - name: Cache Artifacts
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: ${{ github.workspace }}/dist
          key: nginx-gateway-fabric-${{ github.run_id }}-${{ github.run_number }}

  build-oss:
    name: Build OSS images
    needs: [vars, binary]
    strategy:
      fail-fast: false
      matrix:
        image: [ngf, nginx]
        platforms: ["linux/arm64, linux/amd64"]
    uses: ./.github/workflows/build.yml
    with:
      image: ${{ matrix.image }}
      platforms: ${{ matrix.platforms }}
    permissions:
      contents: read # for docker/build-push-action to read repo content
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      packages: write # for docker/build-push-action to push to GHCR
      id-token: write # for docker/login to login to NGINX registry
    secrets: inherit

  build-plus:
    name: Build Plus images
    needs: [vars, binary]
    uses: ./.github/workflows/build.yml
    with:
      image: plus
      platforms: "linux/arm64, linux/amd64"
    permissions:
      contents: read # for docker/build-push-action to read repo content
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      packages: write # for docker/build-push-action to push to GHCR
      id-token: write # for docker/login to login to NGINX registry
    secrets: inherit

  functional-tests:
    name: Functional tests
    needs: [vars, build-oss, build-plus]
    strategy:
      fail-fast: false
      matrix:
        image: [nginx, plus]
        k8s-version: ["${{ needs.vars.outputs.min_k8s_version }}", "latest"]
    uses: ./.github/workflows/functional.yml
    with:
      image: ${{ matrix.image }}
      k8s-version: ${{ matrix.k8s-version }}
    permissions:
      contents: read

  conformance-tests:
    name: Conformance tests
    needs: [vars, build-oss, build-plus]
    strategy:
      fail-fast: false
      matrix:
        image: [nginx, plus]
        k8s-version: ["${{ needs.vars.outputs.min_k8s_version }}", "latest"]
        enable-experimental: [true, false]
    uses: ./.github/workflows/conformance.yml
    with:
      image: ${{ matrix.image }}
      k8s-version: ${{ matrix.k8s-version }}
      enable-experimental: ${{ matrix.enable-experimental }}
    permissions:
      contents: write

  helm-tests:
    name: Helm Tests
    runs-on: ubuntu-22.04
    needs: [vars, build-oss]
    steps:
      - name: Checkout Repository
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

      - name: Fetch Cached Artifacts
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: ${{ github.workspace }}/dist
          key: nginx-gateway-fabric-${{ github.run_id }}-${{ github.run_number }}

      - name: Docker Buildx
        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0

      - name: NGF Docker meta
        id: ngf-meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
        with:
          images: |
            name=ghcr.io/nginxinc/nginx-gateway-fabric
          tags: |
            type=semver,pattern={{version}}
            type=edge
            type=ref,event=pr
            type=ref,event=branch,suffix=-rc,enable=${{ startsWith(github.ref, 'refs/heads/release') }}

      - name: NGINX Docker meta
        id: nginx-meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
        with:
          images: |
            name=ghcr.io/nginxinc/nginx-gateway-fabric/nginx
          tags: |
            type=semver,pattern={{version}}
            type=edge
            type=ref,event=pr
            type=ref,event=branch,suffix=-rc,enable=${{ startsWith(github.ref, 'refs/heads/release') }}

      - name: Build NGF Docker Image
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          file: build/Dockerfile
          tags: ${{ steps.ngf-meta.outputs.tags }}
          context: "."
          target: goreleaser
          load: true
          cache-from: type=gha,scope=ngf
          pull: true

      - name: Build NGINX Docker Image
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          file: build/Dockerfile.nginx
          tags: ${{ steps.nginx-meta.outputs.tags }}
          context: "."
          load: true
          cache-from: type=gha,scope=nginx
          pull: true
          build-args: |
            NJS_DIR=internal/mode/static/nginx/modules/src
            NGINX_CONF_DIR=internal/mode/static/nginx/conf
            BUILD_AGENT=gha

      - name: Deploy Kubernetes
        id: k8s
        run: |
          kube_config=${{ github.workspace }}/kube-${{ github.run_id }}-helm
          make create-kind-cluster KIND_KUBE_CONFIG=${kube_config}
          echo "KUBECONFIG=${kube_config}" >> "$GITHUB_ENV"
          kind load docker-image ghcr.io/nginxinc/nginx-gateway-fabric:${{ steps.ngf-meta.outputs.version }} ghcr.io/nginxinc/nginx-gateway-fabric/nginx:${{ steps.nginx-meta.outputs.version }}
          kubectl kustomize config/crd/gateway-api/standard | kubectl apply -f -

      - name: Install Chart
        run: >
          helm install
          helm-$(echo ${{ steps.ngf-meta.outputs.version }} | tr '.' '-')
          .
          --wait
          --create-namespace
          --set nginxGateway.image.repository=ghcr.io/nginxinc/nginx-gateway-fabric
          --set nginxGateway.image.tag=${{ steps.ngf-meta.outputs.version }}
          --set nginxGateway.image.pullPolicy=Never
          --set nginxGateway.productTelemetry.enable=false
          --set nginx.image.repository=ghcr.io/nginxinc/nginx-gateway-fabric/nginx
          --set nginx.image.tag=${{ steps.nginx-meta.outputs.version }}
          --set nginx.image.pullPolicy=Never
          --set service.type=NodePort
          -n nginx-gateway
        working-directory: ${{ github.workspace }}/charts/nginx-gateway-fabric

  publish-helm:
    name: Package and Publish Helm Chart
    runs-on: ubuntu-22.04
    needs: [vars, helm-tests]
    if: ${{ github.event_name == 'push' && ! startsWith(github.ref, 'refs/heads/release-') }}
    permissions:
      contents: read
      packages: write # for helm to push to GHCR
    steps:
      - name: Checkout Repository
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

      - name: Login to GitHub Container Registry
        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Package
        id: package
        run: |
          output=$(helm package ${{ github.ref_type != 'tag' && '--app-version edge --version 0.0.0-edge' || '' }} charts/nginx-gateway-fabric)
          echo "path=$(basename -- $(echo $output | cut -d: -f2))" >> $GITHUB_OUTPUT

      - name: Push to GitHub Container Registry
        run: |
          helm push ${{ steps.package.outputs.path }} oci://ghcr.io/nginxinc/charts