ci.yaml

name: CI

on:
  push:
    branches:
      - 'main'
    tags:
      - '*.*.*'
    paths-ignore:
      - '*.md'
  pull_request:
    paths-ignore:
      - '*.md'
  workflow_dispatch:

concurrency:
  # Branches and PR all run in their individual, separate concurrency groups (with cancel-in-progress: true). The main
  # branch and tags (which are used for releases) run in one shared concurrency group (with cancel-in-progress: true).
  # This allows to schedule a release immediately after merging a PR to main, and have the release's CI build be queued
  # automatically after the CI build for main has finished. That way, the CI build for the release will be able to reuse
  # the Docker cache from the CI build for main.
  group: ci-concurrency-group-${{ (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/')) && 'main-and-tags' || github.ref }}
  # For branches and PRs, we cancel existing builds if a new commit comes in. For the main branch and tags, we queue
  # them and let the run one after the other. The reason is that we build multi-arch container images on main and for
  # tags, which takes a really long time if there are changes. But once they have been build, Docker caching makes the
  # next builds fast again.
  cancel-in-progress: ${{ !(github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/')) }}

jobs:
  check_for_successful_builds_for_same_commit:
    name: Check for existing successful builds for same commit
    runs-on: ubuntu-latest
    outputs:
      should_skip: ${{ steps.skip_check.outputs.should_skip }}
    steps:
      - id: skip_check
        uses: fkirc/skip-duplicate-actions@v5

  verify:
    name: Build & Test
    runs-on: ubuntu-latest
    timeout-minutes: 15

    needs: check_for_successful_builds_for_same_commit
    if: needs.check_for_successful_builds_for_same_commit.outputs.should_skip != 'true'

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: ~1.23
          cache: true

      - name: go version
        run: |
          go version

      - name: build
        run: |
          make

      - name: verify that generated code is up-to-date
        run: |
          # make (which we ran in the previous step) will implicitly also run the targets manifests & generate, which
          # could potentially modify code that is under version control, if changes have been comitted that would have
          # required updating manifests or generated code and these updates have not been done.
          git diff --exit-code

      - name: lint
        run: |
          make lint

      - name: lint C sources with clang-format
        uses: jidicula/clang-format-action@v4.14.0
        with:
          clang-format-version: '19'
          check-path: 'images/instrumentation/injector/src'

      - name: install Helm unittest plugin
        shell: bash
        run: |
          helm plugin install https://github.com/helm-unittest/helm-unittest.git

      - name: run operator and Helm chart unit tests
        run: |
          make test

  injector_binary_and_instrumentation_image_tests:
    name: Injector Binary & Instrumentation Image Tests
    runs-on: ubuntu-latest
    timeout-minutes: 40

    needs: check_for_successful_builds_for_same_commit
    if: needs.check_for_successful_builds_for_same_commit.outputs.should_skip != 'true'

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: run test suites
        uses: ./.github/actions/injector-and-instrumentation-tests
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}

  # Builds and potentially pushes all container images. For pushes to PRs/branches, we simply verify that the image
  # build still works, the resulting image will not be pushed to any target registry. For pushes to the main branch, the
  # images are tagged with "main-dev", but not with a version x.y.z. Finally, for pushes to a tag (or when a tag is
  # created), the images are tagged with the version indicated by the tag respectively, and also with latest. That is:
  # Creating a GitHub release (or creating a git tag via other means) will trigger building images tagged with x.y.z
  # meant for production use.
  build_and_push_images:
    name: Build Images
    runs-on: ubuntu-latest
    needs:
      - verify
      - injector_binary_and_instrumentation_image_tests
    if: |
      always() &&
      (needs.verify.result == 'skipped' || needs.verify.result == 'success') &&
      (needs.injector_binary_and_instrumentation_image_tests.result == 'skipped' || needs.injector_binary_and_instrumentation_image_tests.result == 'success')

    # Building all container images across architectures via qemu can take _really_ long, especially if the build cache
    # is empty.
    timeout-minutes: 120

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: build operator controller image
        uses: ./.github/actions/build-image
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          imageName: operator-controller
          imageTitle: Dash0 Kubernetes Operator Controller
          imageDescription: the controller for the Dash0 operator for Kubernetes
          imageUrl: https://github.com/dash0hq/dash0-operator/tree/main
          context: .

      - name: build instrumentation image
        uses: ./.github/actions/build-image
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          imageName: instrumentation
          imageTitle: Dash0 Instrumentation
          imageDescription: contains Dash0 OpenTelemetry distributions for multiple runtimes
          imageUrl: https://github.com/dash0hq/dash0-operator/tree/main/images/instrumentation
          context: images/instrumentation

      - name: build collector image
        uses: ./.github/actions/build-image
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          imageName: collector
          imageTitle: Dash0 Kubernetes Collector
          imageDescription: the OpenTelemetry collector for the Dash0 operator for Kubernetes
          imageUrl: https://github.com/dash0hq/dash0-operator/tree/main/images/collector
          context: images/collector

      - name: build configuration reloader image
        uses: ./.github/actions/build-image
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          imageName: configuration-reloader
          imageTitle: Dash0 Kubernetes Configuration Reloader
          imageDescription: the configuration reloader for the Dash0 operator for Kubernetes
          imageUrl: https://github.com/dash0hq/dash0-operator/tree/main/images/configreloader
          context: images
          file: images/configreloader/Dockerfile

      - name: build filelog offset synch image
        uses: ./.github/actions/build-image
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          imageName: filelog-offset-synch
          imageTitle: Dash0 Kubernetes Filelog Offset Synch
          imageDescription: the filelog offset synch for the Dash0 operator for Kubernetes
          imageUrl: https://github.com/dash0hq/dash0-operator/tree/main
          context: images
          file: images/filelogoffsetsynch/Dockerfile

  publish_helm_chart_dry_run:
    name: Publish Helm Chart (Dry Run)
    runs-on: ubuntu-latest
    needs:
      - build_and_push_images
    if: ${{ always() && ! contains(github.ref, 'refs/tags/') && github.actor != 'dependabot[bot]' && needs.build_and_push_images.result == 'success' }}

    steps:
      - uses: actions/checkout@v4

      - name: publish helm chart (dry run)
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          echo "verifying that helm chart can be published"
          DRY_RUN=true helm-chart/bin/publish.sh 0.0.0

  # By default, when a GH action run is triggered by dependabot, it will only get read-only permissions.
  # See https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#changing-github_token-permissions
  # For that reason, we skip the check whether the Helm chart can still be published for Dependabot update PRs.
  # Those PRs do not change the Helm chart anyway.
  # Note that the value of the "name" attribute needs to be identical to the publish_helm_chart_dry_run job, since the
  # branch protection rules reference this property, and it is a required check.
  skip_publish_helm_chart_dry_run_for_dependabot:
    name: Publish Helm Chart (Dry Run)
    runs-on: ubuntu-latest
    if: ${{ ! contains(github.ref, 'refs/tags/') && github.actor == 'dependabot[bot]'}}
    needs:
      - build_and_push_images

    steps:
      - name: skipping publish helm chart (dry run)
        run: |
          echo skipping publish helm chart dry run for dependabot commit

  publish_helm_chart:
    name: Publish Helm Chart
    runs-on: ubuntu-latest
    if: ${{ contains(github.ref, 'refs/tags/') && github.actor != 'dependabot[bot]'}}
    needs:
      - build_and_push_images

    steps:
      - uses: actions/checkout@v4

      - name: publish helm chart
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          echo "publishing helm chart version ${{ github.ref_name }}"
          helm-chart/bin/publish.sh ${{ github.ref_name }}