BYO bootstrap Job + orkano bootstrap-token (M4.2) #27
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Hermetic engine E2E (M1.6) + dashboard smoke (M2.6). Stands up a full Orkano | |
| # control plane on kind from CI-built operator/receiver/dashboard/helper images + the real config/ | |
| # manifests + an in-cluster GitHub stub and git fixture, then drives a signed push | |
| # all the way to a digest-pinned, HTTP-answering deployment, runs the invariant | |
| # probes, and smokes the dashboard (deploy + rollout/readyz + auth-status API, | |
| # M2.6) (hack/ci/e2e/run.sh). Separate workflow on purpose, like the substrate smoke: | |
| # it proves the END-TO-END engine on a live cluster, not the Go units, so PRs | |
| # only trigger it when an input that can change the runtime behaviour changes; | |
| # every push to main re-proves it unconditionally. | |
| # | |
| # Known flake source (shared with the substrate smoke): anonymous Docker Hub | |
| # pulls on shared GHA egress IPs. run.sh pre-pulls + kind-loads the cluster's | |
| # Docker Hub images (registry/postgres/buildkit), but the fixture's busybox base | |
| # is pulled mid-build by the build pod and the two canary pods' busybox is pulled | |
| # by the cluster. If `toomanyrequests` shows up, the fix is a docker-login step | |
| # backed by DOCKERHUB_USERNAME/DOCKERHUB_TOKEN repo secrets — not added until the | |
| # flake is real. | |
| name: e2e | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| paths: | |
| - hack/ci/e2e/** | |
| - hack/local-loop/main.go | |
| - hack/ci/substrate-smoke/kind-config.yaml | |
| - operator/** | |
| - receiver/** | |
| # Only the inputs to the Node-free `go build ./dashboard` the E2E runs | |
| # (placeholder embed, no -tags webdist): the SPA source under | |
| # dashboard/web/src, npm manifests, and Vite config change the release | |
| # binary, not this one, and are already gated by ci.yml's `web` job. | |
| - dashboard/*.go | |
| - dashboard/internal/** | |
| - dashboard/web/*.go | |
| - dashboard/web/placeholder/** | |
| - internal/install/** | |
| - internal/db/** | |
| - api/v1alpha1/** | |
| - config/** | |
| - build/Dockerfile | |
| - go.mod | |
| - go.sum | |
| - .github/workflows/e2e.yml | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: e2e-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| e2e: | |
| # Pinned to 24.04: the orkano-buildkit profile uses AppArmor abi/4.0, and the | |
| # E2E is only meaningful on the substrate the smoke verdict was taken on. | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 75 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| - name: install kind (pinned) | |
| run: | | |
| curl -fsSLo kind https://github.com/kubernetes-sigs/kind/releases/download/v0.32.0/kind-linux-amd64 | |
| echo "50030de23cf40a18505f20426f6a8506bedf13c6e509244bd1fa9463721b0f54 kind" | sha256sum -c | |
| sudo install -m 0755 kind /usr/local/bin/kind && rm kind | |
| - name: run engine e2e | |
| run: hack/ci/e2e/run.sh |